guaikei-douyin-collect-public-outflow

• Outcome: Review
• Latest audit: Aug 21, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

The skill appears to do its advertised Douyin public-data collection, but it needs Review because it can bulk collect, transmit, and persist social data with overbroad triggers and some runtime behavior that conflicts with its safety notes.

Install only if you are comfortable sending Douyin search terms, creator/video URLs, limits, and a GUAIKEI_API_TOKEN to www.guaikei.com, and with retrieved public data being saved locally in logs by default. Use it only for public Douyin data you are allowed to collect, and be aware the runtime may show Guaikei website/contact messages despite the safety notes saying it will not.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill explicitly relies on an environment variable (`GUAIKEI_API_TOKEN`) but the metadata does not declare any corresponding permission or capability boundary. This creates an undeclared secret dependency, which weakens reviewability and can cause the runtime to grant broader access than users or platform operators expect.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The changelog advertises capabilities broader than the skill metadata, including general Douyin search and bulk retrieval of an author's published works. This creates a scope-mismatch risk: reviewers, users, or downstream agents may authorize or invoke functionality that was not clearly declared, reducing transparency and increasing the chance of unreviewed data collection behavior.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The phrase '竞品账号内容批量抓取' indicates bulk scraping of competitor account content, which is more aggressive than the user-facing analytics use case described in the skill metadata. Bulk extraction increases abuse potential, such as large-scale profiling, unauthorized dataset building, or bypassing expected platform and user-consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI persists the fetched comment dataset to a local JSON file via `log.taskWrite(...)` after completing a retrieval operation. Because the skill’s described purpose is to fetch Douyin public comment data, silently creating a local artifact expands data handling beyond retrieval and can retain potentially sensitive or regulated data on disk without the user’s awareness, increasing exposure to later access or leakage.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger guidance says the skill should activate even when the user does not mention Douyin, based on generic short-video research intent. Overbroad triggering can cause unintended invocation, sending user queries into a third-party data collection workflow without sufficiently clear platform scoping or user intent confirmation.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The top-level description includes broad, everyday phrases that can match ordinary conversation and trigger the skill too aggressively. This increases the risk of unintended data access, mistaken tool routing, and disclosure of user prompts to an external service when the user did not clearly ask for Douyin data collection.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill defines broad natural-language triggers such as '搜索 / 搜一下 / 找 + 关键词' and common phrases like '今天什么火', which can overlap with ordinary user conversation and cause unintended invocation. In this context, unintended execution is more sensitive because the skill performs external data collection and writes results to local JSON logs, potentially causing unnecessary scraping, token usage, and local data retention without clear user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README advertises automatic JSON log/output generation and later states files are saved under the skill's logs directory, but it does not prominently warn that scraped public data, comments, and account information will be persisted locally by default. This increases privacy and operational risk because users may trigger collection expecting transient output while the skill silently creates retained datasets on disk that could later be exposed, shared, or mishandled.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code writes all retrieved comment results to a local JSON file without any explicit notice or consent path in this file. Even if the comments are public, aggregating and retaining them locally changes the privacy and security posture of the skill, creating a durable copy that other local users, backup systems, or unrelated processes may access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI writes the full result set, including the requested Douyin URL and collected post data, to a local JSON file automatically without clearly warning the user or requiring opt-in. This can create unintended retention of potentially sensitive operational data on disk, where it may later be accessed by other local users, backup systems, or unrelated processes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The program sends user-supplied URL and limit values to remote API functions to create and retrieve a task, but the file does not clearly disclose that these inputs will be transmitted off-host. In a data-collection skill, undisclosed network transmission can violate user expectations and expose queried targets or analyst intent to a third-party service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI persists the full search output to disk, including the searched keyword and returned results, but does not clearly warn the user that this data will be stored locally. In this skill context, users may search for sensitive topics, creators, or monitoring targets, so silent persistence can create privacy and operational-security exposure if logs are later accessed by other users or processes on the same system.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The command sends user-supplied keywords and filter parameters to an external search service using an API token, but the script does not clearly disclose that this data leaves the local environment. For a data-collection skill focused on Douyin/public-opinion analysis, user queries may reveal investigation targets, business interests, or sensitive monitoring activity, so undisclosed transmission creates privacy and confidentiality risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.