Security audit

douyin-detail

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Douyin data-analysis purpose, but needs review because it sends the API token in URL query strings and automatically saves large result logs locally.

Review this skill before installing. Use a limited-scope or low-quota API token, rotate it if it has already been used with this package, confirm you are comfortable sending Douyin keywords and target URLs to guaikei.com, and manage or delete the local logs because they may contain public user/comment data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: API Token Exposed in URL Query Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (46)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码块的核心功能非常明确：打印 banner，读取 API token，调用 hot.getHotTask 获取抖音热榜任务结果，并以 JSON 输出成功、空结果或错误状态。描述中强调的是抖音作品详情、图文详情、作品数据、互动指标、内容调研和内容分析等分析型能力，但代码并未展示这些能力，反而实现了“抖音热榜”获取这一未声明的具体功能。因此描述与实际行为存在明显不一致，属于主要用途和能力范围上的错配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码片段并未体现任何抖音数据分析、作品详情获取、互动指标计算、内容调研或内容分析相关逻辑。其实际功能是一个与业务无关的通用 CLI 参数工具模块，只负责解析命令行参数、校验输入并生成帮助文本。这属于与声明用途 materially different 的主要功能，因此描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音数据分析与内容研究的技能，但提供的代码片段只是一个辅助函数：通过 fs 读取本地 package.json，并返回 pkg.name。该行为与声明的核心用途无直接对应关系，也没有实现任何抖音相关的数据访问、分析、详情查询或指标处理能力。虽然读取 package.json 可能是内部辅助实现，但就这段代码本身而言，其实际行为与声明用途明显不一致，因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill declares use of an environment variable (GUAIKEI_API_TOKEN) but does not define any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries can let the runtime grant broader-than-necessary access, making secret exposure or unintended command execution easier if the skill or downstream scripts are abused.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest context describes a skill for 抖音数据分析、作品详情、图文详情、作品数据、互动指标、内容调研和内容分析, which implies detail-oriented analysis of content and engagement. In contrast, this package identifies itself as "douyin-search-keyword" and describes keyword search, ranking, blogger scraping, and hot-list retrieval, which is a materially different focus and broader discovery capability than the stated detail-analysis purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation emphasizes convenience and public-data collection but does not clearly warn that returned datasets and local JSON logs may contain personal information, usernames, comments, or other sensitive content. This increases the risk of operators collecting, retaining, sharing, or mishandling personal data without informed consent or adequate safeguards.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language mapping includes broad trigger phrases such as '搜索/找/看看' that could match ordinary conversation and cause the skill to run unintentionally. Because this skill performs external data collection and writes logs, accidental invocation may collect unnecessary third-party content or store personal data without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The intent recognition rules rely on very common words like '热点', '搜索', '评论', and '视频', with only limited disambiguation. In an agent setting, these generic terms can cause the wrong tool path to be selected, leading to unintended scraping of posts, comments, or rankings and unnecessary processing of public but potentially sensitive personal data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The changelog documents capabilities far broader than the declared skill purpose, including keyword search, hotlists, author work enumeration, bulk competitor-account scraping, and comment collection. This creates a scope-transparency problem: users, reviewers, or calling agents may authorize or invoke the skill under a narrower 'detail/data analysis' assumption while the implementation appears able to perform wider surveillance or collection actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The changelog content is presented entirely in Chinese and describes the skill in that language without indicating that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific audience. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This section documents bulk retrieval of Douyin comment data up to 10,000 entries without any warning about privacy, consent, rate limits, or platform terms. Even though it is only documentation, it operationalizes large-scale collection of user-generated data, which can facilitate privacy-invasive scraping or non-compliant monitoring when used by downstream agents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file includes natural-language strings and comments in Chinese, and operation labels later in the file are also hardcoded in Chinese. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file’s natural-language interface elements, including the module description, function description, parameter docs, and error-related documentation, are written only in Chinese. Under the policy, forcing a specific language without user opt-in or documented locale justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The function sends a credential-like token and a user-provided Douyin profile URL to a remote API via requestApi, which is a privacy-relevant network operation. Although there are docstrings describing parameters, this file does not provide a user-facing disclosure, confirmation, or warning about transmitting that data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This function performs a GET request that includes the token, target URL, and limit in request parameters, transmitting potentially sensitive or user-related data over the network. The code contains no visible user-facing warning, confirmation, or privacy notice for this transmission.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes the skill as being for Douyin data analysis, work details, and content analysis, which implies retrieval/analysis behavior. This CLI additionally writes the full comment results to a local file via log.taskWrite, introducing persistent local storage behavior not stated in the manifest description for this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code embeds user-facing text such as comments, error messages, and success messages entirely in Chinese, including runtime output like '获取抖音热榜失败' and '抖音热榜任务完成'. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a locale constraint is clearly documented and justified, which is not evident in this file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Manifest 描述聚焦于“抖音作品详情、图文详情、作品数据、互动指标、内容调研和内容分析”，语义上围绕作品级或分析类数据。该文件实际调用 hot.getHotTask 获取“抖音热榜”，属于榜单/趋势检索能力，而不是已声明的作品详情或分析范围，构成描述与实际行为不一致。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI automatically persists fetched Douyin results to a local JSON file after displaying them, without user consent, opt-in, or a warning. Because the results may contain profile/content analysis data and are derived from user-supplied targets, this creates an unnecessary local data-retention risk: sensitive or regulated data may remain on disk, be exposed to other local users/processes, or be unintentionally committed, backed up, or shared.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The code reads GUAIKEI_API_TOKEN and then sends search parameters to remote search APIs through createSearchTask and getSearchTask. While the tool is a search CLI, there is no explicit user-facing notice in this file that the provided keyword and related parameters will be transmitted to an external service using credentials from the environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI writes full search output to a local file whose name includes the user keyword, without any explicit consent, warning, or retention control. This can unintentionally persist potentially sensitive search terms and result data on disk, creating privacy and local data exposure risks on shared systems or monitored environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Multiple error messages are hard-coded in Chinese, including authentication and network failure text, with no indication that the skill is region-specific or that users can opt into this locale. That creates a natural-language policy concern because the skill imposes a specific language on all users rather than offering a language choice or documenting the restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This JavaScript code constructs and sends outbound HTTPS GET and POST requests, including URL parameters, a derived skill name, and arbitrary JSON data. The file includes validation and retry logging, but it does not provide any user-facing disclosure, confirmation, or comment warning that user or system data may be transmitted over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The schema title and description are written entirely in Chinese, which imposes a specific language on users and integrators without any indication of optional locale support or a documented regional restriction. Under the policy, fixed language behavior without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON schema includes title and field descriptions exclusively in Chinese, which can impose a specific language on downstream users or developers without any opt-in or documented locale limitation. Under the language/locale policy rule, that is a natural-language policy concern because the file does not state that the schema is intentionally China/Chinese-only.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.