Security audit

guaikei-douyin-collect-public-data

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin public-data purpose, but it needs review because its activation scope is broad, it sends the API token in request URLs, and it automatically saves collected data locally.

Install only if you are comfortable sending Douyin keywords, target URLs, and your Guaikei API token to guaikei.com, and with search/post/comment results being saved locally under logs. Prefer using it only for explicit Douyin data requests, rotate the token if it has already been used in URL-query form, and periodically delete or protect generated log files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:93
Finding: API Credential Exposed in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/utils/log.js:5
Finding: Collected Data Is Automatically Persisted Without Explicit Retention Controls
Content: View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.slice(0, 200); } if (!safeFilename) { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(`Result saved to ${outputFilename}`); } catch (error) { utils.printError(`Log write failed: ${error.message}`); } } ``` `src/douyin/search-cli.js:258-261`: ```js await log.taskWrite( `${startTime}_${keyword}_${sort}_${time}_${duration}_${content}_search.json`, JSON.stringify(finalOutput, null, 2), ); ``` `src/douyin/post-cli.js:154-163`: ```js url = url.replace(/[^a-zA-Z0-9_-]/g, ""); url = url.replace("httpswwwdouyincomuser", ""); url = url.replace("httpsvdouyincom", ""); await log.taskWrite( `${startTime}_${url}_post.json`, JSON.stringify(finalOutput, null, 2), ); ``` ### Technical Analysis Successful search, post, and comment operations automatically serialize the complete output and write it into the project-level `logs/` ...[truncated 2076 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是面向抖音运营/调研场景的数据获取与分析技能，而提供的代码仅实现了与业务无关的底层命令行参数解析器。它没有访问抖音资源、没有执行搜索/抓取/评论分析/热榜获取，也没有体现与声明触发条件相关的业务逻辑。因此代码实际行为与声明用途存在明显且实质性的偏差。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是面向抖音内容搜索、作品抓取、评论分析和热榜追踪的数据能力；而实际代码并未体现任何抖音搜索、内容抓取、评论读取、热点获取或分析逻辑。相反，它执行的是本地日志文件写入这一通用辅助功能，并访问文件系统资源。虽然日志功能可能是配套实现细节，但在仅提供这一代码片段的情况下，其实际行为与声明的核心能力明显不一致，且体现了未声明的本地文件写入能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a content/research skill focused on Douyin data operations. The supplied code chunk does not implement any of those behaviors; it is merely a helper that reads package.json from disk and returns the package name. While this may be an internal utility, based on the supplied chunk alone the actual behavior is unrelated to the declared primary purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码片段只是一个基础设施级的重试工具，不访问抖音、不处理搜索/作品/评论/热榜数据，也没有任何与运营分析直接相关的业务逻辑。虽然重试函数可能作为更大系统的辅助实现细节存在，但就该“技能的描述”与“所给代码片段实际行为”对比，二者主功能明显不一致，因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音内容搜索、作品分析、评论洞察和热榜追踪的业务技能；而提供的代码片段实际上是一个底层 token 管理模块。其主要行为是验证 GUAIKEI_API_TOKEN 是否符合格式要求，并在无效时打印推广性质的信息，引导用户访问网站或添加客服微信获取私有 token。该代码既没有执行任何抖音数据搜索/抓取/分析操作，也没有体现与声明四类触发任务直接相关的实现。虽然令牌管理可视为支撑性实现细节，但这里给出的代码片段的实际主功能与声明用途明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音运营/调研场景的数据分析技能，核心能力应涉及抖音内容、用户、评论或热榜数据的获取与分析。但这段代码只是辅助性的日志/横幅输出工具，没有任何网络请求、数据抓取、搜索、分析或抖音资源访问逻辑。虽然横幅文本提到“抖音数据智能分析助手”，但实际行为仅是打印文字，无法支撑声明的主要用途。因此该代码片段与声明用途存在明显不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest explicitly says the skill should trigger even when the user did not mention Douyin, which is an overly broad activation rule for a data-exfiltrating/API-calling skill. This can cause the agent to route unrelated user requests into a third-party data service, increasing the risk of unnecessary external requests, privacy leakage, and user-intent hijacking.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The manifest declares access to a sensitive environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege guarantees and makes it harder for the host to constrain what the skill may access, especially if the runtime or future code additions expand behavior beyond the documented API use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This JSON schema contains user-facing natural-language metadata entirely in Chinese, including the title and field descriptions. Per the policy, forcing a specific language without opt-in or documented regional justification is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON schema uses Chinese natural-language titles and descriptions throughout, including the top-level title/description and multiple property descriptions. Because the file provides no indication that the skill is explicitly region-specific or that users may opt into this locale, it can violate the policy against forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This README is entirely in Chinese and presents usage/instruction conventions only in Chinese, without indicating that users may choose another language or that the skill is intentionally limited to a Chinese-only audience for a documented reason.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README states that collected data is automatically exported to local log files, and elsewhere indicates those logs can contain comment content, account identifiers, and other structured public data. Even if the source data is public, persistent local storage increases the risk of unintended retention, reuse, or disclosure on shared machines, especially without a prominent warning, retention guidance, or opt-in behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI saves fetched comment data to a local JSON file after completing a read operation, creating persistent storage of user-generated content that may contain personal data or sensitive text. In the stated skill context of public-data collection and comment analysis, local retention is plausible functionality, but doing it implicitly without clear disclosure or consent expands data handling beyond transient read-only processing and increases privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script writes fetched comments to a local file without any explicit warning, confirmation, or user-controlled output path, which can surprise users and silently retain potentially sensitive or regulated content. Because the skill is framed as reading public comments for analysis, undisclosed persistence makes the behavior more dangerous from a privacy and compliance standpoint even if the source data is public.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code persists the full output, including request metadata and fetched results, to disk via log.taskWrite, but the file does not present any explicit user-facing warning that local storage will occur. For a code-file warning check, this is a file write affecting user data without an in-file disclosure such as a prompt, print statement, or explanatory comment near the operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JavaScript file contains user-facing descriptions, help text, and status/error messages entirely in Chinese, which imposes a specific language on users. The file does not offer any language selection, opt-in, or justification that the skill is intended only for a Chinese-language or region-specific context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code constructs and sends POST requests containing URL parameters and JSON body data to a remote host via https.request, but there is no confirmation prompt, user-facing notice, or explicit warning in the local comments/docstrings that user or system data may be transmitted off-box. For a code file, network calls that may transmit data should have some form of disclosure unless the warning exists elsewhere in skill documentation or the behavior is clearly part of the skill's stated purpose, which is not established in this file alone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-visible strings in this module are exclusively in Chinese, including warnings and status messages shown during token validation. For a general utility module, forcing a single language without user opt-in or documented locale justification is a natural-language policy issue under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JavaScript file presents all user-facing validation errors, comments, and formatted output in Chinese only, including messages at L011-L025, L059-L077, and the formatted result text at L084-L108. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JSON schema includes user-facing title and description fields entirely in Chinese, which can impose a language requirement on users or downstream tools without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option, matching the policy concern for forced language/locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema contains user-facing natural-language titles and descriptions exclusively in Chinese, such as the title and field descriptions. Under the language/locale policy rule, forcing a single language without opt-in or documented regional justification can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This manifest file contains user-facing natural-language fields entirely in Chinese, including the title and parameter descriptions. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the regional constraint is explicit and justified, which is not indicated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema uses only Chinese natural-language titles and descriptions for the skill inputs, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains human-readable title and description strings exclusively in Chinese, including the top-level metadata and property descriptions. Under the policy rule for natural-language violations, forcing a specific language without offering a choice or documenting a justified locale constraint is a reportable issue.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest frames this as a public-data collection and analysis skill for search, creator works, comments, and hot trends. However, the response schema exposes direct playback/download and music media URLs (play_addr, music_play_url), which go beyond analytical metadata and suggest media retrieval capability not clearly stated in the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.