T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:104- Finding
API Token Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-collect-public-outflow
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Douyin data-collection purpose, but it needs Review because it exposes the API token in request URLs, saves collected data locally by default, and contradicts its own promise about neutral auth errors.
Review before installing. Use this only if you are comfortable sending Douyin URLs, keywords, and your GUAIKEI_API_TOKEN to the Guaikei API, and with retrieved public data being saved under the skill's logs directory by default. Treat the token as potentially exposed through service logs, rotate it if needed, and delete local logs that contain comments or account metadata you do not want retained.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:24- Finding
Undisclosed Runtime Advertising in Authentication Error Paths
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (61)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
代码的实际功能比较窄：它调用 /api/douyin/post/url 和 /api/douyin/post/info，输入是抖音博主主页 URL 和作品数量 limit，输出是 data.post 数组，也就是博主已发布作品列表。相比之下，声明描述的是更广泛的抖音数据查询能力，包括某条视频评论反馈、博主热度、热搜话题等。当前代码没有显示评论、热搜、话题、热度分析等能力，因此实际行为只覆盖了声明中的一小部分，且核心能力表述存在明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
代码的主功能非常单一：获取并输出抖音热榜。虽然声明中提到“热搜话题”与热榜能力部分一致，但同时还宣称可在用户询问‘这视频底下大家咋说’、‘这博主火不火’等场景触发，意味着应支持视频评论分析或博主热度查询等能力。当前代码片段未显示这些能力，主要目的明显比声明更窄。因此描述未准确代表该代码块的实际行为，属于能力范围被高估的描述不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
描述覆盖的场景较宽，包括视频评论、博主热度、热搜话题等多类抖音数据查询；但这段代码的实际功能非常单一：解析 URL/sec_uid 和 limit，调用 post.createPostTask / post.getPostTask 获取抖音博主作品列表，并输出结果与日志。其主要目的与描述不一致，属于声明范围与实际能力错配。虽然二者都属于抖音数据获取，但描述中的核心示例和用户预期（评论、热度、热搜）并未被此代码支持。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
声明把技能表述为一个较广义的“抖音数据获取”能力，覆盖视频评论、博主热度、热搜话题等用户意图示例。但所给代码块的实际功能较窄，只是基于关键词搜索抖音视频/图文内容，并返回搜索结果，未看到评论抓取、博主分析或热搜榜单处理逻辑。因此描述范围明显大于该代码块展现的能力，存在描述与行为不一致。另有结果写日志这一未声明的辅助行为，不过这属于次要实现细节；主要不匹配点仍是声明的能力面明显宽于实际代码。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的用途是面向抖音/短视频数据查询分析的业务技能；但代码片段实际只是一个与具体业务无关的通用参数解析模块，负责处理命令行选项、布尔参数、默认值、重复参数校验、未识别选项报错和帮助文本生成。它没有体现任何抖音、短视频平台、视频评论、博主热度、热搜话题、数据抓取或分析相关行为。虽然这类工具函数可能作为更大系统的辅助组件存在，但就该代码片段本身而言，其实际行为与声明的核心目的明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向抖音/短视频数据获取与分析的技能，但提供的代码片段完全没有任何与抖音、视频、博主、热搜、数据抓取或分析相关的逻辑。相反，它执行的是本地日志文件写入，这是与声明主用途无关的能力，而且属于未声明的资源访问（文件系统写入）。虽然日志工具可能是辅助实现细节，但当前代码片段本身唯一可见功能就是文件写入，无法体现声明中的核心行为，因此应判定为描述与实际行为不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is a user-facing analytics skill for Douyin/short-video content, but the supplied code chunk does not implement any such functionality. Instead, it performs a local filesystem read of package.json to obtain the skill/package name. While this could be a supporting utility in a larger project, evaluated on this chunk alone the behavior is unrelated to the declared end-user purpose and uses local file access not implied by the description. Therefore this code chunk does not accurately represent the declared functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个较宽泛的抖音数据查询技能，可处理视频评论、博主热度、热搜话题等多种用户意图；而给定代码片段的实际行为非常单一，仅将已有结果格式化为抖音热榜输出。从主用途看，它只对应“热搜话题”子场景，不能支撑声明中的视频评论或博主热度能力。虽然这可能只是部分代码，但就该代码片段本身而言，描述范围明显大于实际行为，存在描述与实现不一致。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares use of an environment variable token but does not define any explicit tool scope or permission boundary in the manifest. That makes secret access implicit rather than auditable, increasing the chance of unintended secret exposure or overbroad execution in agent environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation rule explicitly says the skill should trigger even when the user does not mention Douyin, based on broad research or planning intent. In an agent setting, this can cause over-triggering on unrelated requests and unnecessary collection or processing of external-platform data without clear user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that collected data is automatically written to local log files, but the user warning is minimal and there is no retention, redaction, or opt-out control documented. Public-platform data can still contain personal data, identifiers, or sensitive research targets, so silent persistence increases privacy and data-handling risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The phrase "纯中文界面" indicates the skill is limited to Chinese, but the file does not provide user opt-in, language selection, or a documented justification for this locale restriction. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest frames this skill as one for obtaining data about Douyin videos, creators, and trending topics in terms of public response (for example, what people are saying under a video or whether a creator is popular). This schema instead defines CLI input for retrieving a creator homepage URL/SEC_UID and a limit on the number of works, indicating a content-list collection capability that is broader and materially different from the described public-comment/popularity use case.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest context says the skill is for obtaining Douyin public data when users ask about videos, creators, or hot topics, and explicitly says it does not provide follower-growth/agency-style advice. The package description adds '短视频营销、竞品分析...助力爆款内容策划与流量追踪', which shifts the stated purpose toward marketing strategy and competitive intelligence rather than straightforward public-data retrieval and analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The README explicitly says collected Douyin data and comments are automatically exported to local JSON logs, but it does not prominently warn that potentially sensitive public data, URLs, usernames, and comment text will be stored on disk. In an agent setting, this can lead to unintentional retention, later exfiltration, or privacy/compliance issues, especially because the skill is designed for bulk collection and analysis of social-media content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents the skill information entirely in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The changelog describes capabilities beyond the narrowly stated skill scope, including general Douyin search and bulk collection of an author's published works. This creates a scope/expectation mismatch that can enable overcollection or misuse of public-platform data, especially where users or reviewers believe the skill is limited to checking popularity or comments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This function sends a skill token and user-supplied video URL to an external API, which is a data-transmitting network operation covered by the warning requirement for code files. While the JSDoc describes parameters and errors, it does not disclose to the user that these values are transmitted off-process or to a remote service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This function performs a GET request to a remote endpoint and includes the token and video URL in request parameters, which is a network operation transmitting potentially sensitive or user-related data. The code lacks a confirmation prompt, user-facing log, or explicit warning comment explaining that these values are sent to an external service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The natural-language documentation in this file is entirely in Chinese, including operation descriptions and parameter documentation, with no indication that language selection is optional or justified by a region-specific constraint. Under the policy, forcing a specific language without user opt-in can be a locale policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI writes the full comment retrieval output, including collected Douyin comments and request metadata, to a local JSON file after printing results. In the context of a data-collection skill, undisclosed persistence increases privacy and data-handling risk because retrieved user content may remain on disk longer than expected and be accessible to other local users, backup systems, or later processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code silently saves collected comment data to a local JSON file without any explicit warning, consent flow, or visible CLI option indicating persistence. Because the skill is presented as a retrieval tool for viewing public-outflow data, this hidden storage materially changes the data-handling behavior and can create privacy, compliance, and accidental disclosure risk on the host system.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code contains multiple user-facing strings such as status messages and comments indicating the skill operates in Chinese only. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a skill for collecting public outflow data when users ask things like '看看这视频底下大家咋说' or judging whether a creator is popular, which implies comment/discussion or broader popularity analytics. This CLI's documented purpose and actual flow are specifically to '获取抖音博主作品列表' and it returns only post/task results for a user URL, a narrower and different data type than the described audience-discussion use cases.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI persists fetched results to a local JSON file automatically after execution, without explicit user consent or a retention control. In a data-collection skill, this increases the risk of unintended local disclosure, especially if results contain personal or operationally sensitive metadata and are written into shared or insecure environments.
- Content
Static analysis
No suspicious patterns detected.