T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Token Exposed in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-all-public-data
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it advertises, but it has credential-handling and disclosure problems users should review before installing.
Install only if you are comfortable sending Douyin keywords, profile/video URLs, and your GUAIKEI_API_TOKEN to www.guaikei.com. Treat the token as sensitive, monitor/rotate it if needed, and review or disable local logs if the research topics or collected comments are sensitive. Ambiguous requests should be confirmed before invoking the skill.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:23- Finding
Unsolicited Promotional Content in Authentication Error Paths
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims '最小权限' and says it does not write to the filesystem except logs, yet later states outputs are automatically saved to
logs/. Undisclosed local persistence in a data-collection skill can store queried topics, URLs, and returned public data on disk, creating privacy, retention, and workspace data leakage risks if operators do not expect it.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims '最小权限' and says it does not write to the filesystem except logs, yet later states outputs are automatically saved to
logs/. Undisclosed local persistence in a data-collection skill can store queried topics, URLs, and returned public data on disk, creating privacy, retention, and workspace data leakage risks if operators do not expect it.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims '最小权限' and says it does not write to the filesystem except logs, yet later states outputs are automatically saved to
logs/. Undisclosed local persistence in a data-collection skill can store queried topics, URLs, and returned public data on disk, creating privacy, retention, and workspace data leakage risks if operators do not expect it.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill explicitly depends on the environment variable
GUAIKEI_API_TOKEN, but the manifest does not declare any tool scope such aspermissionsorallowed-tools. This creates an undeclared capability boundary: reviewers and orchestrators cannot easily see that the skill requires env access, which weakens least-privilege controls and increases the chance of accidental secret exposure or overbroad execution.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generalized trigger says the skill should activate even when users do short-video research or competitor analysis without explicitly mentioning Douyin, and even inside multi-step workflows. That broad matching can cause the agent to invoke a networked data-collection skill for generic research requests unrelated to Douyin, leading to unintended external data access, unnecessary token use, and collection of data outside user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that output files are automatically saved under
logs/with timestamps and query parameters, but it does not clearly warn about the local persistence impact. In a data-collection workflow, filenames and stored payloads may reveal search keywords, account URLs, analysis targets, or sensitive business research topics to other local users, backups, or later processes.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L087 says that when the token is invalid, the skill should stop execution and 'ask the user to check the environment variable'. Earlier token-management rules at L037-L038 require only neutral error output and explicitly forbid runtime contact/website/promotional guidance. This is a direct documentation-level inconsistency about what should be emitted at runtime during auth failures.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README maps very common user phrases such as "搜索 / 搜一下 / 找" directly to data-collection commands. Because these triggers overlap with ordinary conversation and are not tightly scoped to explicit user consent for external data access, an orchestrating agent could invoke the skill when the user only meant general discussion or analysis, causing unintended third-party requests and data retrieval.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The intent-priority rules use broad keywords like "热搜 / 热点 / 榜单 / 今天什么火" and "搜索 / 搜一下 / 找 + 关键词" as deterministic routing logic. In an agent setting, this can misclassify routine language as a command to scrape or query external services, leading to unintended execution, unnecessary token use, and accidental collection of public platform data without sufficiently explicit user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all operational instructions, parameter descriptions, and examples in Chinese only. Under the language/locale policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code sends a skill token and user-supplied video URL to external API endpoints via requestApi, which is a data-transmitting network operation covered by the missing-warning rule for code files. Although the functions have developer-oriented docstrings, there is no user-facing confirmation, logging, or warning in this file indicating that these values will be sent to a remote service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The getCommentTask function issues a GET request containing the token and video URL in request parameters, which transmits user or system data to an external API. This file does not show any confirmation prompt, user-facing log, or explicit warning to the user about that transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI silently persists fetched comment data to a local JSON file, which can expose scraped content to other local users, backup systems, or downstream tooling without the operator realizing retention occurred. Even though the source data is public, bulk-collected comment datasets may contain personal data, usernames, or sensitive user-generated content, making undisclosed storage a meaningful privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code persists the full output to disk via
log.taskWrite, which is a file-write operation covered by the warning requirement for code files. While the CLI prints progress messages, there is no explicit user-facing disclosure here that results will be saved to a file, and the surrounding comments/docstring do not mention that behavior.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings throughout the CLI, including help text and runtime messages, force a specific language without offering user opt-in or documenting that the tool is intentionally Chinese-only. This can violate language/locale policy where skills must not impose a locale silently.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-facing status and error text in Chinese string literals, which forces a specific language on users without opt-in. That is a natural-language locale policy issue under the stated rule because no alternative language selection or documented regional justification is present.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The success and failure messages shown to users are also fixed to Chinese, continuing the locale restriction throughout the skill. The file does not indicate that this is a region-specific tool or provide any mechanism for language preference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The authentication error string is written only in Chinese and includes remediation guidance in that language, which imposes a locale choice on users without opt-in. The policy requires avoiding forced language/locale constraints unless the skill explicitly offers a choice or clearly documents a justified regional limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The comments and banner text are entirely in Chinese, including the visible user-facing banner string shown at runtime. For a general utility module, this indicates a fixed language choice without any opt-in, fallback, or explanation that the skill is region-specific, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language comments and error/output strings entirely in Chinese, including validation errors and formatted result messages. Under the policy rule, forcing a specific language without user opt-in or clear region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The phrase "纯中文界面" imposes a specific language/locale constraint in natural language. The file does not indicate user opt-in, alternative language support, or a documented policy justification for forcing Chinese-only behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The schema title and field descriptions are written entirely in Chinese, which imposes a specific language in the skill's natural-language interface metadata. There is no indication that the skill is China-region-specific or that users can choose another language, so this may violate a language/locale policy requiring opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The schema title and description are written only in Chinese, which imposes a specific language in the skill's natural-language interface metadata. There is no indication that the skill is region-specific or that users can opt into this locale, so this appears to violate the language/locale policy criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON schema includes user-facing title and description text exclusively in Chinese. Because the file does not indicate that the skill is region-specific or provide any opt-in for language/locale, it can violate the policy against forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language title and descriptions are written only in Chinese, which can impose a language expectation on users without any opt-in or documented locale constraint. Under the policy, locale or language restrictions should either offer user choice or be clearly justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.