T01 · Skill Instruction Hijacking
Error
- Location
src/utils/request.js:50- Finding
Deceptive Promotional Content Injected into Authentication Error Output
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-bulk-videos-fetch
Security checks for vulnerabilities and agentic risk
Overview
This Douyin data-collection skill mostly matches its stated purpose, but it needs Review because it contradicts its own auth-error safety promise, sends the API token in URL query strings, and stores scraped results locally by default.
Install only if you are comfortable sending Douyin search terms, target URLs, and a GUAIKEI service token to www.guaikei.com, and with result data being saved under the skill's logs directory by default. Treat the token as sensitive, rotate it if exposed, avoid running broad inferred requests, and review stored logs because they may contain creator, commenter, and media URL data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:102- Finding
API Token Exposed in URL Query Strings Across All Remote Requests
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (48)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states it writes logs to a local
logs/directory with filenames derived from timestamps and keywords, but that filesystem write capability is not surfaced in the high-level purpose statement. Hidden or under-documented local write behavior can expose scraped data, user queries, or tokens-in-errors to disk and surprise operators reviewing the skill.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states it writes logs to a local
logs/directory with filenames derived from timestamps and keywords, but that filesystem write capability is not surfaced in the high-level purpose statement. Hidden or under-documented local write behavior can expose scraped data, user queries, or tokens-in-errors to disk and surprise operators reviewing the skill.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states it writes logs to a local
logs/directory with filenames derived from timestamps and keywords, but that filesystem write capability is not surfaced in the high-level purpose statement. Hidden or under-documented local write behavior can expose scraped data, user queries, or tokens-in-errors to disk and surprise operators reviewing the skill.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill explicitly relies on the environment variable
GUAIKEI_API_TOKEN, but the manifest does not declare tool scope or permissions for environment access. Undeclared capability use weakens reviewability and can cause the skill to access sensitive runtime data outside a clearly bounded contract.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger rule says the skill should activate even when the user does not mention Douyin, for broad short-video research tasks. Over-broad activation can cause the agent to invoke a data-collection skill in the wrong context, leading to unintended external queries, unnecessary token use, and collection of platform-specific data when the user asked something more general.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The statement "纯中文界面" indicates a fixed Chinese-only interface. This is a natural-language locale restriction, and the file does not offer the user a language choice or document a justified compliance reason for enforcing Chinese only.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JSON schema uses Chinese-only title and description text, and all field descriptions in the file follow the same locale pattern. For a generally reusable skill asset, forcing a specific language without user opt-in matches the language/locale policy violation criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema explicitly documents
video_urlas both playback and download addresses, which conflicts with the stated skill scope that says it is not intended for downloading or watermark-removal. This mismatch can enable downstream agents or users to repurpose the skill for prohibited content acquisition, increasing policy and misuse risk even if no direct exploit code is present in this file.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest limits the skill to search, list, comments, and trending-query use cases and explicitly says it is not suitable for downloading. However, the response schema describes
play_addras both a playback address and a视频下载地址, which indicates the skill exposes a direct download-capable URL as part of its documented output.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The README advertises automatic JSON log export of scraped video, author, and comment data but does not prominently warn users that collected data will be stored on disk by default. Because the skill processes potentially sensitive public-profile and comment data, silent local persistence can create privacy, retention, and secondary exposure risks on shared or insecure systems.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README defines very broad natural-language trigger phrases such as common verbs like '搜索/找' plus generic nouns, which can cause the skill to activate in contexts the user did not clearly intend. In an agent setting, this increases the risk of unintended scraping actions against an external service, especially because the skill performs data collection and writes results locally.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The hotlist activation rules use broad phrases like '热点/榜单/今天什么火' with high priority and limited exclusion boundaries, making accidental invocation likely. In this skill's context, unintended activation can trigger external requests and retrieval of platform data without sufficiently specific user authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all operational guidance and parameter descriptions in Chinese, which can impose a specific language on users without opt-in. The policy allows locale constraints only when clearly justified or when the user is offered a language choice, neither of which appears here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code sends a token and video URL to external API endpoints via requestApi when creating a comment task. Although the JSDoc documents parameters for developers, there is no user-facing warning, confirmation, or visible notice in this file that user or system data will be transmitted over the network.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The getCommentTask function performs a GET request containing the token and target URL, which transmits potentially sensitive operational data to a remote service. The file contains developer comments but no user-facing disclosure, confirmation, or warning about this network activity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JavaScript file contains user-facing natural-language comments only in Chinese, including the top-level description and constant explanations. Under the policy, forcing a specific language without opt-in or justification is a natural-language locale violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI writes fetched comment data to a local JSON file after completing the query, creating unintended data persistence beyond a transient read operation. Because comment content can include usernames, profile details, and other potentially sensitive or regulated data, silent local retention increases the risk of privacy exposure, accidental redistribution, and forensic residue on shared systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool silently saves comment results to disk without explicit user consent or a prominent warning, which can surprise users who expect a query-only operation. In the context of scraping social-media comments, this increases privacy and compliance risk because collected data is retained locally even when the user only intended to inspect output interactively.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI descriptions, examples, and runtime messages are presented only in Chinese, which imposes a specific language on users without opt-in. Under the policy rule, hard-coded single-language behavior is a natural-language locale violation unless the tool explicitly offers language selection or justifies the locale restriction.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes fetched Douyin results to a local JSON file after completing a read-only fetch operation, which creates unexpected persistent storage of potentially sensitive or regulated content. This increases exposure if the host is shared, backups are collected, or the output contains personal data from creators/comments returned by the API.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JavaScript file contains user-facing natural language in comments, error messages, and help text exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code emits all validation and status messages in Chinese, including error strings and success output, without offering any language selection or indicating that this skill is intended only for Chinese-speaking users. This creates a natural-language locale policy issue because the skill effectively forces a specific language on users without opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a Douyin data retrieval skill for searching keywords, fetching creator posts, comments, and hot trends. This utility creates directories and writes caller-provided content to local files under a logs directory, which is a persistent file-write capability unrelated to the user-facing purpose of read-only platform data collection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The AuthError message is written entirely in Chinese and includes specific support instructions, which imposes a language choice without offering user selection or documenting a justified locale restriction. This matches the policy category for natural-language locale violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code performs outbound HTTPS GET and POST requests, including URL query parameters and JSON request bodies, but provides no confirmation prompt or user-facing disclosure that data will be sent to a remote service. The nearby docstring describes the API helper mechanically, but does not warn about network transmission or what user/system data may be included.
- Content
Static analysis
No suspicious patterns detected.