Security audit

guaikei-douyin-collection

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its Douyin data-collection purpose, but its activation rules are too broad and its runtime token-error behavior contradicts its own review-facing claims.

Review before installing. Use this only for explicit Douyin research tasks, and assume keywords, profile/video URLs, result data, and the GUAIKEI token are sent to guaikei.com. Expect successful search/post/comment runs to leave JSON files under logs, and delete them if they contain sensitive business research. Also note that the runtime code can show a website or phone contact on token errors despite the skill document saying it will not.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares use of an environment variable token (`GUAIKEI_API_TOKEN`) and executable Node.js commands, but there is no explicit permissions declaration governing access to secrets or runtime capabilities. This creates a trust gap where the platform or reviewer may underestimate what the skill can access, increasing the chance of over-broad secret exposure or unintended execution privileges.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The CLI persists full search output to a local file named with the user keyword, which can retain potentially sensitive business research terms and result data beyond the immediate command execution. In an analytics skill, silent local retention increases data exposure on shared hosts, developer machines, or CI runners, especially because neither minimization nor explicit consent is enforced at the write site.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The top-level description says the skill should be used even when the user did not mention Douyin, for broad requests like evaluating an account or checking a video's reputation. That can cause over-triggering in unrelated contexts, leading the agent to invoke external data collection unexpectedly and potentially send user-provided URLs, keywords, or analysis targets to a third-party service without clear user intent.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The implicit trigger section includes vague examples such as competitor research, high-like content discovery, and hot-topic discovery without constraining them to Douyin-specific intent. In practice, this can misroute generic marketing requests into this skill, causing unintended external queries, privacy leakage of business research terms, or collection from the wrong platform.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The natural-language trigger mapping uses broad everyday phrases like “搜索 / 搜一下 / 找 …”, “查看这个博主的所有作品 / 主页”, and “抖音今天有什么热点”, which can cause the skill to activate on ambiguous user requests that were not clearly intended for this tool. In an agent environment, this can lead to unintended collection of third-party Douyin data, unnecessary external API calls, and disclosure of user intent or queried targets to the token-backed service.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The intent recognition priority rules are too permissive and rely on generic trigger terms such as “热搜 / 热点 / 榜单 / 今天什么火” and “搜索 / 搜一下 / 找 + 关键词” without sufficient scope constraints. Because the skill description also says it should be used even when the user does not mention Douyin, these rules increase the chance of misrouting ordinary conversation into external scraping actions against Douyin-related endpoints.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI writes fetched comment data to a local JSON file derived from the target URL without clearly informing the user in this file or providing an opt-in/opt-out control. Because comment content can contain personal data, opinions, or other sensitive marketing intelligence, this creates an unexpected local persistence risk and may expose data to other local users, backups, logs, or downstream tooling.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI writes the full result set to a local JSON file without any visible consent, warning, or opt-in at the point of execution. Because the collected data can include account-level and content analysis data tied to a target Douyin profile, this creates a confidentiality and data-retention risk if the host machine is shared, monitored, or later compromised.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The code writes returned search results to a local log file without an explicit user-facing warning or a visible opt-in control at the point of execution. This can surprise users and expose search queries and collected Douyin data to other local users or later processes, though the impact is mainly privacy and data-handling risk rather than direct code execution.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.