Security audit

guaikei-douyin-audience-voice-reader

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its Douyin public-data research purpose, but it needs Review because its routing is broad and its credential/error handling contradicts its own safety claims.

Install only if you are comfortable sending Douyin queries and targets to www.guaikei.com with a GUAIKEI_API_TOKEN, and review local logs after use. Treat ambiguous research requests carefully: ask for explicit Douyin confirmation before invoking. The publisher should move tokens out of URL query strings, remove runtime contact/promotional messages, and align retry limits with the documentation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: Authentication Token Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/utils/request.js:51
Finding: Hard-Coded Promotional Contact Information in Authentication Errors
Content: View full analysis
process.exit(exitCode), ); } ``` ### Technical Analysis `SKILL.md` explicitly requires authentication failures to use neutral wording and prohibits contact information, website links, or promotional content in runtime output. The implementation violates that policy by embedding a personal contact channel in every HTTP 401 or 403 error. The CLI handlers copy `error.message` to both diagnostic output and structured JSON. Consequently, an Agent or downstream application consuming stdout can repeat the unsolicited contact information to users. This is not a privilege-escalation vulnerability, but it is an integrity and trust issue: runtime behavior materially differs from the declared security policy, and a support or promotional message is inserted into automate ...[truncated 1046 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/config/constants.js:19
Finding: Query Operations Retry Up to Twenty Times Contrary to the Documented Limit
Content: View full analysis
setTimeout(resolve, delay)); } } } throw lastError || new Error(`Failed after ${maxAttempts} retries`); } ``` ```js // src/api/search.js const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "Query task", ); ``` The fallback error message above is translated for report readability; the retry control flow and values are unchanged. ### Technical Analysis The documentation states that network failures are retried no more than three times. Creation operations use three attempts, but query operations pass `QUERY_MAX_ATTEMPTS`, which is set to twenty. `withRetry` retries every error that does not have `noRetry` set. This includes timeouts, connection resets, general network errors, response-parsing failures, and API errors whose code is treated as retryable. The behavior is therefore error retrying ...[truncated 1418 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 从代码看，createPostTask 和 getPostTask 只调用 /api/douyin/post/url 与 /api/douyin/post/info，参数核心是博主主页 url 和 limit，处理结果时也仅返回 data.post。这与“扒博主作品”部分一致，但不足以支持声明中更广泛的用途，例如搜索抖音内容、读取评论、查看热搜或判断某话题是否在短视频平台火。虽然这可能只是技能的一部分代码，但就所给代码块而言，实际行为明显窄于声明用途，因此应判定为描述与代码行为存在不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开信息检索与分析的技能，核心能力应涉及访问或处理抖音内容、博主作品、评论或热搜信息。但实际代码仅实现了通用 CLI 参数解析器，包括读取 flag 值、处理 boolean/string 参数、检查重复/缺失参数、识别位置参数以及生成帮助文本。该代码没有任何与抖音、短视频平台、公开信息抓取、搜索、评论读取或热搜相关的行为。其主要目的与声明严重不符，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向抖音公开信息抓取/查询的技能，而提供的代码片段仅是基础错误处理工具模块。虽然这类模块可能是某个更大技能的配套实现，但就该代码片段本身而言，其实际行为与声明用途没有直接对应，主功能明显不同。因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开信息检索/读取的技能，应当体现网络访问、内容抓取或平台数据读取等行为。但实际代码仅执行本地日志写入，没有任何与抖音、短视频平台、搜索、评论、热搜或博主作品读取相关的逻辑。其主要能力和资源访问对象是本地文件系统，而非平台公开数据，因此属于明显的描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a skill for querying public information from Douyin or related short-video platforms. However, the supplied code chunk does not implement any such functionality: it imports fs and path, reads a local package.json file, parses it, and returns pkg.name. That is a local utility for obtaining the skill/package name, not a Douyin search, scraping, comment-reading, or hot-topic capability. While this may be a supporting helper within a larger skill, based on the supplied chunk alone its actual behavior is materially different from the declared purpose, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音公开信息检索的技能，而提供的代码片段只是一个底层工具函数 withRetry，用于为异步操作提供重试、指数退避和错误处理机制。该代码本身不执行任何平台访问、内容搜索、评论读取、热搜查询或账号作品抓取，因此其实际行为与声明的技能用途存在明显不一致。这不是单纯的实现细节对应，因为代码片段的可观察功能与声明的核心能力完全不同。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Generic trigger phrases like '热点趋势' or broad research wording without a firm platform constraint make invocation ambiguous and increase the chance of unintended execution. In this context, that means the agent may query an external service and process platform data not actually requested by the user, which is a real security/privacy and least-surprise problem even if the data is nominally public.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger scope is broad enough to activate the skill for generic 'research' or 'trend' tasks even when the user did not clearly request Douyin-specific collection. In an agent setting, overbroad routing can cause unintended network access, collection of third-party platform data, and user surprise or consent violations, especially because this skill handles public social-media data and uses an API token.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JSON schema contains user-facing natural-language text such as the title and descriptions only in Chinese. Because the file does not indicate that the skill is explicitly China/Chinese-locale specific or provide any language/locale opt-in, it appears to enforce a specific language by default.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The schema explicitly documents play_addr as both a playback and video download address, which conflicts with the skill metadata stating the skill is not intended for downloading. That mismatch can enable downstream agents or integrators to use the field for prohibited content downloading, expanding the skill beyond its declared scope and creating policy/compliance risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language trigger examples are broad enough to activate on common phrases like '搜索', '找', '热点', or references to videos without requiring strong Douyin-specific context. This can cause the agent to invoke the skill when the user did not intend platform scraping, leading to unintended collection of third-party public data or use of an external token-backed service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent-recognition rules prioritize generic terms such as '热搜', '搜索', '评论', '作品', and '博主' with minimal contextual constraints, and the metadata even says the skill should be used when users ask about short-video-platform popularity 'even if they didn’t say Douyin'. In an agent setting, this overbroad routing can silently redirect unrelated requests into this external scraping skill, causing unintended external requests, privacy issues around queried targets, and action/intent mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains user- and developer-facing natural-language text exclusively in Chinese, including the top-level description and all constant comments. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI writes the full comment results to a local file automatically, but does not provide an explicit user-facing warning or consent mechanism before persisting the data. In a shared workstation, CI runner, or multi-user environment, this can create unintended local disclosure and data retention risks, especially if comments contain usernames, profile references, or other personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code presents all natural-language descriptions and status/error messages in Chinese, including the main function description and runtime output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest frames this skill as reading public Douyin information such as content, creator posts, comments, and hot topics. At L075, the code retrieves a secret from process.env, which introduces credential access beyond the user-facing purpose of public-information retrieval; this may be required by backend architecture, but that need is not stated in the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CLI writes fetched results to a local JSON file automatically without explicit user consent or notice at the point of execution. Because the output may contain large amounts of scraped public-content data and request metadata, this creates an unnecessary local data-retention trail that could expose user activity, queried targets, or collected content to other local users, backup systems, or later compromise.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest presents this skill as reading public Douyin information such as content, creator posts, comments, and hot topics. In this file, the code pulls a credential from process.env to authenticate outbound API access, which introduces secret-handling capability beyond the user-visible purpose of simply reading public information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI writes full search results to a local JSON file without an explicit user opt-in at the call site. Even if the data is public, persisted query history and returned content can expose user interests, operational activity, or unexpectedly accumulate sensitive context on shared systems.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a skill for reading public Douyin-related information such as content, creator posts, comments, and hot topics, and explicitly excludes publishing/downloading workflows. This utility creates directories and writes caller-supplied content to local files, which is a persistence capability unrelated to the user-facing purpose of browsing or reading platform information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file contains user-facing status and error strings in Chinese, such as validation and write-status messages. This imposes a specific language on users without any opt-in, fallback, or indication that the skill is intentionally limited to a Chinese-speaking context, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Several thrown error messages are written only in Chinese, including the authentication guidance string and other request failures. If the organization requires language choice or avoids forcing a specific locale without opt-in, these fixed Chinese-only messages are a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-facing warning and status messages are hard-coded in Chinese in string literals. This creates a language/locale policy issue because the file provides no opt-in, fallback, or indication that the skill is intended only for Chinese-speaking users or a China-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file hard-codes all user-facing validation and error messages in Chinese, and the comments indicate the skill is designed around Chinese-language keywords and examples. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not evident in this file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.