douyin-content-intelligence-guaikei

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:17 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Douyin public-data purpose, but it needs review because its code contradicts its own auth-error policy and handles the API token insecurely.

Review carefully before installing. Use it only if you are comfortable sending Douyin keywords, account/video URLs, and an API token to guaikei.com, and with result data being saved under the skill's logs directory. The publisher should remove runtime website/contact prompts from auth errors and move the token out of URL query strings before this is treated as low-risk.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: src/utils/token.js:23

Finding

Deceptive Promotional and Contact Information Injected into Authentication Error Output

Content

View full analysis

process.exit(exitCode), ); return; } ``` ### Technical Analysis The Skill documentation explicitly states that invalid-token handling must produce only neutral error messages and must not emit contact details, website links, or marketing language at runtime. The implementation contradicts this declared be ...[truncated 2168 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/api/search.js:59

Finding

API Authentication Token Exposed in URL Query Strings

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims minimal privileges and says it does not read/write user private files, yet it explicitly states that logs are automatically saved to a local logs/ directory. Undeclared filesystem write behavior increases risk of sensitive-data persistence, especially because URLs, query terms, and error payloads may be written locally despite the narrow-use framing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims minimal privileges and says it does not read/write user private files, yet it explicitly states that logs are automatically saved to a local logs/ directory. Undeclared filesystem write behavior increases risk of sensitive-data persistence, especially because URLs, query terms, and error payloads may be written locally despite the narrow-use framing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims minimal privileges and says it does not read/write user private files, yet it explicitly states that logs are automatically saved to a local logs/ directory. Undeclared filesystem write behavior increases risk of sensitive-data persistence, especially because URLs, query terms, and error payloads may be written locally despite the narrow-use framing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares use of an environment variable token but does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization boundary gap: the runtime may expose environment access more broadly than intended, and reviewers cannot verify least-privilege from the manifest alone.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs activation in broader multi-step workflows even when the user never mentions Douyin. That can cause over-invocation of networked data-collection behavior and unnecessary token use in contexts where the user did not clearly request this capability, weakening user-intent and least-surprise boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Telling the agent to invoke the skill even when the user does not mention '抖音' makes activation boundaries ambiguous and encourages speculative use of external data access. In practice, this can lead to unintended collection/processing of third-party platform data and unnecessary exposure of credentials and logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The schema title and description are written only in Chinese, which creates a language-specific constraint in the skill metadata without offering any language choice or documenting that the skill is intentionally limited to Chinese-speaking users. This matches the policy category for language or locale restrictions expressed in natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON schema contains natural-language titles and descriptions exclusively in Chinese, including the top-level title/description and nearly all property descriptions. Because the file does not offer a language option or document that the skill is intentionally China/Chinese-locale specific, it may violate a language/locale policy that requires user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README explicitly promotes automatic JSON log export and local storage of scraped Douyin data, including comments and account content, but does not give a clear privacy and data-handling warning near that feature. In this skill context, the stored data may contain personal data, user-generated content, or sensitive business intelligence, increasing the risk of unintended retention, sharing, or misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The changelog and skill-facing text are entirely in Chinese, which can impose a language constraint on users without any opt-in or explicit justification. Under the policy, forcing a specific language without offering user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill documentation is presented in Chinese, including headings, parameter descriptions, and usage guidance, with no indication that users may choose another language or that the skill is region-specific. This can violate a language/locale policy when a skill implicitly requires a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The natural-language comments and descriptions are entirely in Chinese, including the module purpose and parameter documentation, with no indication that language selection is optional or region-specific. Per the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends a skill token and user-supplied search keyword to a remote API via requestApi, which is a safety-relevant network operation. Although the functions have developer docstrings, there is no user-facing confirmation, warning, or visible disclosure in this file that user input and the token will be transmitted externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The GET request places the token and search parameters into the query string, which is more likely to be exposed via server logs, proxies, browser/network tooling, monitoring systems, and referer-style leakage than a request body. In a skill designed to perform bulk content intelligence and keyword research, those queries may reveal sensitive business intent or account credentials if the token is reused elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The code sends the normalized Douyin URL and requested comment limit to external API functions to create and fetch a comment task. There is no visible user disclosure in this file that the provided URL and related request data will be transmitted to a remote service, which matters for privacy-sensitive operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The CLI automatically persists fetched Douyin comment data to a local JSON file after successful execution, without any opt-in flag, warning, or data-minimization control. Because comment data can contain personal data, user handles, or sensitive text, this creates a privacy and retention risk if the host system is shared, monitored, or later exfiltrated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language strings in comments, status messages, and output messages are consistently Chinese, and the file provides no mechanism for user language selection or opt-in. That can violate a language/locale policy when a skill imposes a specific language unconditionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code reads a sensitive API token from the environment and then makes remote API calls with the user's supplied identifier/URL. While the CLI prints progress messages, it does not clearly disclose that user input and authentication data will be transmitted to an external service, which matches the missing-warning criterion for code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code persists the full output to disk via log.taskWrite, which is a file write affecting local user data/state. Although there are success messages, there is no visible disclosure near the CLI usage/help that results will be saved to a file, so users may not expect local persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CLI persists full search output to a local JSON log file, including the queried keyword and returned results, without any consent prompt, opt-in flag, or indication that data will be stored on disk. In this skill context, results may contain commercially sensitive research terms, competitor intelligence, or comment data, so silent persistence increases the risk of unintended disclosure to other local users, backup systems, or later processes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code contains natural-language strings shown to users in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file contains user-visible error strings such as "请求失败", "响应解析失败", and the authentication error message entirely in Chinese. This forces a specific language/locale without any visible opt-in or fallback, which is a natural-language policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JavaScript file contains natural-language comments and user-facing error/output strings in Chinese only, starting with the function documentation and continuing throughout the file. Under the policy for language/locale handling, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title and description force a specific language/locale in natural-language metadata, and the file does not indicate that this schema is region-specific or that users can opt into another language. Under the stated policy, fixed-language behavior without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title on L04 and multiple field descriptions through L40. Because SQP-3 applies to all file types and flags language-policy issues when a skill forces a specific language without opt-in or justification, this is a policy concern in the file's embedded natural language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.