Xiǎoxīn tā shì ròulǐcì, shuōhuà bànshì dōu děi liúshén.
Watch out — he hides a sting; you need to be careful in both words and dealings with him.
Tips
usage
Close cousin of 笑里藏刀 (smile-with-hidden-blade) but emphasizes the lingering, nagging hurt rather than a sudden attack. The thorn is already inside the flesh — you can't easily pull it out.