Security audit

guaikei-douyin-authors-scrape

Security checks for vulnerabilities and agentic risk

Overview

This Douyin data skill is mostly coherent, but it should be reviewed because it handles an API token unsafely and automatically stores bulk social-media results locally.

Install only if you are comfortable sending Douyin query/link inputs and your GUAIKEI_API_TOKEN to guaikei.com, and treat generated logs as stored social-media datasets that may contain personal information. Prefer a token with limited quota, rotate it if exposed, keep logs private, and delete exports you no longer need.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:78
Finding: API Token Exposed Through URL Query Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/utils/request.js:25
Finding: Out-of-Scope Error Variable Causes Unhandled API Error Failure
Content: View full analysis
Remediation: View remediation
16) { error.noRetry = true; } reject(error); ``` Additional hardening should include: 1. Return immediately after every `resolve` or `reject` operation. 2. Validate that `errcode` has the expected type before comparing or converting it. 3. Add unit tests for: - `errcode === 0` - Nonzero `errcode <= 16` - Nonzero `errcode > 16` - Missing or malformed `errcode` 4. Add process-level tests confirming that API errors produce stable JSON output and the documented exit codes. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:19
Finding: Unbounded HTTP Response Buffering Permits Memory Exhaustion
Content: View full analysis
{ res.setEncoding("utf-8"); let body = ""; res.on("data", (chunk) => (body += chunk)); res.on("end", () => { ``` ### Technical Analysis The HTTP client appends every response chunk to the `body` string without enforcing a maximum response size. The documented API supports requests for up to 10,000 records, but the client does not establish any byte-level limit independent of record count. A remote server controls both the response length and chunk sequence. The configured request timeout does not provide an effective memory bound: a server may continuously send data within the timeout behavior, and a sufficiently large response can exhaust memory before parsing begins. String concatenation and subsequent `JSON.parse(body)` can also require multiple in-memory representations of the response. As a result, peak memory use can substantially exceed the raw response size. ### Attack Path 1. The user invokes any Skill operation that contacts `www.guaikei.com`. 2. The remote service, a compromised remote account, or compromised server infrastructure returns an abnormally large response body. 3. The client appends every received chunk to `body`. 4. No size check aborts the response. 5. Process memory usage grows until the Node.js heap limit or host memory limit is reached. 6. The process crashes or is terminated by the operating system. 7. On a resource-constrained shared host, other workloads may also be disrupted. ### Impact Assessment The issue affects availability rather than confidentiality or privilege boundaries. Potential impact includes: - Termination of the Skill process - Temporary denial of service for automated workflows - Excessive memory consumption on the host - Possible disruption of co-located processes in constrained environm ...[truncated 186 chars]
Remediation: View remediation
{ receivedBytes += Buffer.byteLength(chunk, "utf8"); if (receivedBytes > MAX_RESPONSE_BYTES) { req.destroy(); reject(new NetworkError("Response exceeded the maximum allowed size")); return; } body += chunk; }); ``` Further hardening should include: 1. Reject responses whose declared `Content-Length` exceeds the configured limit. 2. Retain the streaming byte counter because `Content-Length` may be absent or false. 3. Use endpoint-specific limits where expected payload sizes differ. 4. Consider streaming JSON parsing for large result sets. 5. Ensure an oversized-response error is marked non-retryable to prevent repeated resource consumption. 6. Add tests using chunked transfer encoding and responses both below and above the limit. 7. Set operational memory limits for the Node.js process as defense in depth. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码片段仅实现了通用参数解析与帮助信息构建：读取 flag 值、校验重复参数/未知参数/必填参数、处理布尔参数和位置参数，并生成 CLI 帮助文本。这与声明的“抖音公开数据智能获取工具”主目的明显不一致。代码中没有任何与抖音相关的 API 调用、网页抓取、评论分析、热榜查询、博主作品抓取或数据分析逻辑。虽然该代码可能作为某个更大工具的底层辅助模块存在，但就当前提供的代码片段而言，其实际行为是通用 CLI 支撑功能，而非声明的抖音数据能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述聚焦于抖音数据抓取、搜索、评论分析和热榜查询等业务能力；而实际代码仅执行本地日志文件写入，与抖音数据获取或分析功能没有直接对应关系。虽然日志记录可能是辅助实现细节，但从该独立代码片段本身看，其行为是文件系统写入，这一能力未在声明中体现，且其主要目的与声明的核心功能明显不一致。因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a user-facing Douyin data collection and analysis tool. However, the supplied code chunk merely implements a helper that synchronously reads ../../package.json from the local filesystem and returns pkg.name. This behavior does not demonstrate any of the declared Douyin-related capabilities such as querying public data, scraping creator works, analyzing comments, or fetching hot rankings. While utility code can support a larger skill, this chunk’s actual behavior is unrelated to the stated primary purpose, so it should be flagged as a mismatch for this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明的核心能力是抖音公开数据获取与分析，但提供的代码片段实际上只处理私有TOKEN的格式验证和配置检查，并在无效时显示带有营销性质的提示信息。这与抖音搜索、热榜、评论、作品抓取等能力没有直接对应关系。虽然TOKEN管理可被视为某些技能的辅助实现，但当前代码片段的实际行为与声明用途差距过大，且包含未在描述中体现的授权/推广行为，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill requires access to an environment secret (GUAIKEI_API_TOKEN) but does not declare any explicit tool scope or permission boundaries. That makes the trust boundary unclear for a third-party skill and can allow broader-than-expected secret exposure or execution authority in hosts that rely on manifest scoping for enforcement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This manifest-style JSON file contains user-facing natural-language fields such as title and description entirely in Chinese. Because the file does not document that the skill is intended only for Chinese-speaking users or offer any language choice, it imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema is a manifest/config-type file, so SQP-3 applies. The title and descriptions consistently force a specific language/locale (Chinese) and the file does not indicate that the skill is region-specific or that users can choose another language, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly promotes exporting large volumes of public Douyin video, author, and comment data to JSON logs, but provides no meaningful guidance on privacy, retention, minimization, or safe handling of potentially sensitive personal data contained in comments and profiles. Even if the data is publicly accessible, bulk collection and persistent local storage materially increase privacy and compliance risk, especially for comment content that may include personal information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The changelog and feature descriptions are primarily written in Chinese, which can impose a language requirement on users without any indication of opt-in or alternative locale support. Under the language/locale policy, this is a natural-language policy concern unless the file clearly documents that the skill is intentionally region-specific or offers a language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file documents how to collect Douyin creator posts and comment data at scale, including large limits, but provides no privacy, consent, retention, or lawful-use guidance. In a scraping/analytics skill, that omission increases the risk of misuse for profiling, monitoring, or bulk collection of user-generated data, even if the data is nominally public.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The stated purpose emphasizes obtaining public Douyin data, which suggests access to public endpoints or transparent service use. This implementation requires a secret token from GUAIKEI_API_TOKEN, adding an authentication capability not described in the manifest and not obviously necessary from the user's perspective.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The tool writes fetched comment data to a local JSON file without clear disclosure or user consent in this flow. Persisting scraped social-media data increases privacy and data-retention risk, especially on shared hosts or agent environments where local artifacts may be accessible beyond the immediate run.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Comment results are saved locally without explicit warning in this file, creating silent data persistence. In agent or multi-user environments, this can expose collected content to unintended readers, complicate compliance, and leave residual artifacts after task completion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code includes user-facing descriptions and status/error messages entirely in Chinese, such as the main function description and printed success/error outputs. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified, which is not evident in this file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest frames the skill as an intelligent tool for fetching public Douyin data, which does not by itself imply access to external credentials. This code requires GUAIKEI_API_TOKEN from the environment, meaning the skill depends on authenticated access to another service, a capability not disclosed in the stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: post.createPostTask and post.getPostTask are network-oriented API calls and send user-supplied input plus an authentication token to an external service. The file contains success/error messages, but no explicit warning in the help text or nearby comments that running the command sends data off-host.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes this skill as a tool for obtaining and analyzing public Douyin data such as author works, comments, and hot rankings. This file additionally persists the full results to disk via log.taskWrite, which is a behavior beyond the described retrieval/analysis interface and introduces local data storage not mentioned in the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code persists the full command output, including the requested URL and retrieved results, to disk via log.taskWrite. Although the file prints status messages, there is no clear user-facing disclosure here that data will be saved locally, which matters because file writes are a safety-relevant operation under the rule.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The main docstring describes argument parsing, executing a search task, outputting results, and saving logs, which suggests a local orchestration flow. However, the implementation explicitly calls search.createSearchTask(...) before fetching results, meaning it triggers creation of a remote task as a side effect not reflected in the documentation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest emphasizes retrieval of Douyin public data such as search, hot lists, comments, and author works. In this file, the command requires reading process.env.GUAIKEI_API_TOKEN, introducing credential handling that is not justified or disclosed by the stated end-user purpose of public-data querying.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI persists full search output to a local JSON file, including retrieved content and request metadata, without any explicit notice or opt-in. Even if the source data is public, saved query terms and aggregated results can reveal user interests, investigations, or monitoring activity, and the local file may be accessible to other users or later exfiltrated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code emits user-facing error messages in Chinese only, such as the filename and content validation errors. This imposes a specific language on users without opt-in or any documented justification, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The authentication failure message embeds a personal WeChat/phone contact unrelated to normal API error handling. Hard-coded out-of-band contact data can socially engineer operators into contacting an unverified individual, leaks personal information into logs/UI, and is especially suspicious in a networked skill that depends on external authentication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs outbound HTTPS requests in both POST and GET flows, including URL parameters and JSON request bodies, but provides no confirmation prompt or user-facing disclosure at the point of transmission. The existing docstring and retry error logging describe mechanics of the API call, but they do not warn users that supplied data will be sent over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing strings emitted by this code are entirely in Chinese, including warnings and status messages, with no indication that the skill is China-specific or that users can opt into another language. That creates a natural-language locale policy issue because the skill effectively forces a specific language on users without choice or justification.
Content: No source excerpt is available for this finding.