T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
{ const res = await getJson ...[truncated 2027 chars]- Remediation
View remediation
Security audit
guaikei-douyin-author-posts-to-feed-export
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but it handles an API token unsafely, has overbroad activation guidance, and contradicts its own promise about runtime promotional output.
Review before installing. Use a low-privilege or disposable GUAIKEI_API_TOKEN, assume your Douyin queries/URLs and returned public data may be sent to Guaikei and saved locally under logs/, and avoid letting the skill auto-run for vague non-Douyin trend questions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/token.js:23- Finding
Runtime Promotional and Contact Output Contradicts Declared Token-Handling Policy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
This variant specifically alleges local filesystem writes for logs that are not clearly disclosed in the high-level description. Because the skill handles search terms, URLs, and fetched public-data results, silent persistence can expose potentially sensitive user queries or collected data to other local users/processes and creates a transparency/privacy problem.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill explicitly relies on environment access via GUAIKEI_API_TOKEN, but the manifest does not declare a corresponding tool scope or permissions boundary. This creates an authorization ambiguity: a host may grant broader access than users expect, or reviewers may miss that secret-bearing environment access is required.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill says it should trigger even when users do not mention 'Douyin' explicitly, for broad content-research phrases like 'what's trending online' or 'comment sentiment.' That can cause the agent to invoke this platform-specific data-collection skill without clear user intent, sending unrelated queries or URLs into external processing and local logging unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document states that logs are automatically saved under logs/ with timestamped filenames, but it does not give a prominent user-facing warning that query terms, URLs, and fetched public-data results may be written locally. This can leak sensitive research interests, target account URLs, or collected content on shared machines and increases privacy/compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema contains user-facing natural-language fields such as the title and descriptions exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without opt-in or justification can exclude users who do not read that locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code file contains natural-language comments and documentation exclusively in Chinese, including the module description and parameter docs. Under the policy rule for language/locale, forcing a specific language without opt-in or documented locale justification can be a policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI writes fetched comment data to a local JSON file automatically after printing results, without any explicit opt-in, path restriction, or warning to the user. Comment data may contain personal or sensitive content, and persisting it to disk increases exposure through unintended retention, later access by other local users/processes, or accidental inclusion in backups and logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The program silently persists comment results to a local JSON file without an explicit user warning or consent flow. In the context of a skill that retrieves social-media comments, this increases privacy risk because users may not expect durable local storage of third-party content, and the saved file may be accessible to other software or users on the same machine.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file contains user-facing natural-language strings exclusively in Chinese, including status and error messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not evident in this file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI persists fetched Douyin author-post results to a local JSON file after completing what appears to be a query operation. That creates undisclosed data retention on disk, which can expose scraped content, queried targets, and timestamps to other local users, backups, or later processing beyond the user’s expectation of a read-only retrieval action.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code writes scraped results to a local JSON file without any user-facing consent or confirmation in this file. In the context of a skill described as retrieving recent posts, silent persistence expands the data lifecycle and can create privacy, compliance, and host-side exposure risks if the machine is shared or monitored.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JavaScript file contains natural-language comments and user-facing messages entirely in Chinese, including thrown errors and generated help text. Because the file provides CLI UX text without offering any language selection or documenting a justified locale restriction, it may violate the language/locale policy requiring user choice or explicit justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Multiple error strings in this file are presented only in Chinese, such as the API failure messages, which imposes a specific language on users without offering a choice or documenting a locale restriction. That is a natural-language policy issue because the skill does not indicate that Chinese is optional, configurable, or justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code constructs and sends outbound HTTPS GET and POST requests, including query parameters and JSON payloads, but provides no confirmation prompt or user-facing notice that user or system data may be transmitted over the network. The nearby comments describe the API behavior technically, but they do not disclose the data-transmission behavior to users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains user-facing validation errors and descriptive comments entirely in Chinese, including required input examples and error guidance. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The phrase '纯中文界面' indicates a fixed language constraint. Under the policy, forcing a specific language without user opt-in or a clearly documented and justified locale limitation is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The title and descriptions in the schema use Chinese exclusively, which can impose a language requirement on users or operators reading the skill metadata. The file does not indicate that the skill is region-specific or provide any opt-in or alternative locale, so this is a natural-language locale policy concern.
- Content
Static analysis
No suspicious patterns detected.