T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:93- Finding
API Token Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-author-posts
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it needs Review because it sends its API token in URL query strings and automatically saves collected Douyin data locally without opt-out or retention controls.
Install only if you are comfortable sending Douyin keywords, URLs, limits, and your Guaikei API token to www.guaikei.com. Prefer a dedicated low-privilege token, avoid running it in shared workspaces, review and delete generated logs, and invoke it only for explicit public Douyin data collection tasks.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:25- Finding
Retrieved User-Associated Data Stored Without Explicit Access Restrictions or Retention Controls
- Content
View full analysis
- Remediation
View remediation
` or `--save`. 2. Default to stdout-only behavior when no persistence option is supplied. 3. Create the log directory with mode `0o700` and result files with mode `0o600`: ```js await fs.promises.mkdir(logDirectory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); ``` 4. Verify permissions after creation where platform behavior permits, because an existing directory may retain weaker permissions. 5. Add configurable retention limits, file rotation, and automatic deletion after a documented period. 6. Minimize stored data by omitting fields not needed for the user's requested analysis, particularly stable identifiers and IP-region labels. 7. Warn users before saving user-associated datasets and clearly identify the output path. 8. Add `logs/` to `.gitignore`, packaging exclusions, backup exclusions where appropriate, and repository secret-scanning policies. 9. Provide a cleanup command that safely removes generated result files. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (41)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个面向抖音公开数据采集/分析的技能，而给出的代码仅是 src/utils/args.js 中的通用命令行参数解析与帮助文本生成功能。该代码没有网络请求、数据源访问、抖音接口调用、页面抓取、数据处理或分析行为。虽然这类参数解析器可能作为整个项目的辅助模块存在，但就当前代码块本身而言，其实际行为与声明的核心用途明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向抖音公开数据采集/分析的技能，但提供的代码片段只是本地日志写入模块，没有任何网络请求、抖音接口调用、数据抓取、搜索、评论获取或热榜查询相关逻辑。虽然日志功能可能作为辅助实现存在，但当前代码块的实际行为与声明的核心用途明显不一致；此外，它还涉及本地文件系统写入这一描述中未体现的资源访问能力。因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises multiple Douyin public-data collection and analysis capabilities. The supplied code chunk does not implement any of those behaviors; it merely reads package.json from the local filesystem to obtain the package name. While this could be a harmless helper utility within a larger skill, based on the provided chunk alone its actual behavior is materially unrelated to the declared purpose, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a skill whose purpose is collecting and analyzing Douyin public data. However, the supplied code only contains utility functions for printing a banner and colored logs. These are supporting/logging behaviors, not the declared primary functionality. Since the actual code chunk does not implement the described data-source or analysis capabilities and instead serves an unrelated utility role, the description does not accurately represent this code chunk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill requires access to the GUAIKEI_API_TOKEN environment variable but does not declare an explicit tool or permission scope limiting what runtime resources may be accessed. In an agent ecosystem, missing scope declarations weaken least-privilege controls and make it harder for the platform to constrain or audit secret exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says the skill is applicable even when the user did not mention Douyin or data, which broadens invocation beyond clear user intent. Over-broad trigger rules can cause an agent to route unrelated requests into a data-exfiltrating third-party API workflow, increasing privacy, compliance, and surprise-execution risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema contains natural-language titles and descriptions exclusively in Chinese, which effectively forces a specific language for users consuming the skill metadata. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The package description is entirely in Chinese and presents the skill as a general-purpose analysis tool, but it does not indicate that the skill is China- or Chinese-language-specific, nor does it offer users a language choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI persists fetched comment data to a local JSON file after printing results, but there is no explicit consent, warning, or opt-out for storage. Because comment data can contain personal information, usernames, text content, and other potentially sensitive public data, silent persistence increases privacy and compliance risk by leaving residual data on disk beyond the immediate user session.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code uses Chinese-only natural-language strings in comments, error messages, and success output such as '获取抖音热榜失败' and '抖音热榜任务完成'. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script sends the normalized Douyin URL, limit, and authentication token to remote functions
createPostTaskandgetPostTask, which are network operations under this rule. While the skill's purpose implies fetching remote data, this file does not explicitly warn users that their supplied target URL and associated request data are being sent to an external service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI writes the full result set to a local JSON file derived from the queried Douyin account, without any explicit consent prompt or clear disclosure in this file. Because the skill is intended for data collection and analysis, the saved file may contain scraped profile/content data that persists on disk and can be accessed later by other local users, processes, or backup systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The tool reads an API token from the environment and sends the keyword and search options to remote API endpoints, but the CLI does not make this network transmission explicit to the user at runtime. In a data-collection skill, outbound requests are expected, so the context makes this less suspicious than covert exfiltration, yet lack of disclosure can still surprise users and expose sensitive search terms or operational intent to a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists full search output to a local JSON file named with user-supplied query data, but the user-facing flow does not clearly disclose that results will be written to disk. In this skill's context, the data is public Douyin content rather than privileged backend data, which reduces severity, but undisclosed local persistence can still leak research topics, monitoring targets, or collected datasets to other local users, backups, or endpoint telemetry.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code uses Chinese-only user-facing status and error messages, such as the validation errors on these lines, without offering any language selection or documenting that the skill is intentionally Chinese-only. That creates a natural-language locale policy concern because it imposes a specific language on users by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The success and failure messages here are also hard-coded in Chinese only. Because the file provides no user opt-in or alternative locale handling, it appears to force a specific language rather than offering a documented, justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The authentication error message is written only in Chinese and includes no language choice or fallback. This is a natural-language policy issue because the skill imposes a specific locale on all users rather than offering opt-in or a documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module prints all user-facing status and warning messages exclusively in Chinese, including operational guidance and support information. For a general utility module, this forces a specific language on users without opt-in or justification, which matches the natural-language locale policy violation criteria.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The example '帮我做抖音竞品分析' is a broad business request that does not itself clearly distinguish between needing data retrieval and wanting strategic analysis only. Although the file suggests follow-up clarification, the trigger remains underspecified because it does not clearly limit activation to data-fetching scenarios.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language title and descriptions are entirely in Chinese, with no indication that the skill is China-specific or that users can choose another language. This can violate a language/locale policy when a skill implicitly forces one language without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The schema's human-readable title and field descriptions are entirely in Chinese, which imposes a specific language on users or developers consuming the skill metadata. There is no indication that this is optional, user-selectable, or justified as a region-specific tool, so it fits the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The schema title and description are written entirely in Chinese, which imposes a specific language context in user-facing natural language. The file does not indicate that Chinese is optional, selectable by the user, or required for a documented region-specific reason.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This manifest file contains user-facing natural-language titles and descriptions exclusively in Chinese, including the schema title and field descriptions. Because the file provides no opt-in, alternative locale, or justification that the skill is intended only for a Chinese-speaking audience, it may violate the language/locale policy requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema uses Chinese-only natural-language title and description text, which can impose a specific language on downstream users or tooling without indicating that the skill is region-specific or offering a language choice. The stated policy flags locale or language constraints when they are forced without opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema uses Chinese-only natural-language metadata for the title and field descriptions, but it does not state that the skill is China-specific or that language selection is optional. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue even in config or schema files.
- Content
Static analysis
No suspicious patterns detected.