T09 · Insecure Skill Coding Practices
Warning
- Location
src/api/search.js:59- Finding
API Authentication Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-comment-threads
Security checks for vulnerabilities and agentic risk
Overview
This Douyin data skill is mostly purpose-aligned, but it needs review because it sends a reusable API token in URL query parameters and saves fetched result data locally by default.
Install only if you are comfortable sending Douyin keywords, target URLs or IDs, and your Guaikei API token to guaikei.com. Avoid sensitive competitor or personal-data research on shared machines unless you manage or delete the generated logs. The publisher should move the token to an authorization header, add explicit permission scope, make saving results opt-in, and narrow ambiguous trigger instructions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (43)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the underlying code performs local file writes, directory creation, and persistent logging, that is materially broader than a skill described as a lightweight data-fetching tool with stdout JSON output. Undeclared filesystem writes can expose fetched data, URLs, and possibly API-related context to disk, creating retention and data-leak risks in environments that expect read-only or ephemeral execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the underlying code performs local file writes, directory creation, and persistent logging, that is materially broader than a skill described as a lightweight data-fetching tool with stdout JSON output. Undeclared filesystem writes can expose fetched data, URLs, and possibly API-related context to disk, creating retention and data-leak risks in environments that expect read-only or ephemeral execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the underlying code performs local file writes, directory creation, and persistent logging, that is materially broader than a skill described as a lightweight data-fetching tool with stdout JSON output. Undeclared filesystem writes can expose fetched data, URLs, and possibly API-related context to disk, creating retention and data-leak risks in environments that expect read-only or ephemeral execution.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description explicitly says the skill may be used even when the user only says a broad phrase like '帮我看看同行' without mentioning Douyin. That overbroad trigger condition can cause accidental invocation in unrelated contexts, sending user queries or business-sensitive competitor analysis requests to an external third-party API without sufficiently specific user intent or platform confirmation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill requires access to the sensitive environment variable
GUAIKEI_API_TOKENbut does not declare an explicit tool scope such aspermissionsorallowed-tools. That weakens containment and makes it easier for a caller or runtime to grant broader-than-necessary capabilities, especially because the skill is designed to invoke Node scripts that consume secrets and interact with an external API.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema includes title and field descriptions exclusively in Chinese, such as the title on L04 and descriptions throughout the properties. Because this file provides user-facing natural-language documentation and does not state that the skill is China-specific or offer any language choice, it may violate the language/locale policy requiring opt-in or justified locale constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON schema uses Chinese-only natural-language title and descriptions throughout, such as the title on L04 and repeated field descriptions across the schema. Under the policy rules, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README mentions JSON logs later in the document, but the quick-start and core description do not clearly warn users up front that running the commands writes scraped Douyin data to local files under the skill directory. Because the data includes search results, account content, and comments, users may unintentionally retain potentially sensitive or regulated data on disk, creating privacy, retention, and multi-user host exposure risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill requires a third-party token and appears to send user search keywords, target Douyin URLs, and related scraping requests to an external service, but the README does not clearly disclose this data flow or its privacy implications. Users may assume all processing is local because it is presented as a simple Node.js skill, leading to unintentional disclosure of monitoring targets, research interests, or other sensitive operational data to the service provider.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This changelog uses Chinese throughout, including the title and feature descriptions, but does not indicate that the skill is region-specific or that users may choose another language. That can violate a language/locale policy when users are not given an opt-in or alternative.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains natural-language comments and an error message entirely in Chinese, including the user-visible retry output on L28. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the regional constraint is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This JavaScript file contains natural-language comments exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes fetched comment data to a local JSON file automatically after successful execution, but this file contains user-requested content that may include personal data, sensitive business research, or regulated information from comment threads. Silent persistence increases the risk of unintended data retention, local disclosure to other users/processes, and accidental inclusion in backups or source-control workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code contains multiple user-visible strings exclusively in Chinese, including status messages and errors, and does not provide any user opt-in or configuration for language selection. That creates a language/locale policy concern because the skill effectively forces a specific language on all users.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill for searching Douyin content, viewing creator works, comments, and hot topics, with no mention of handling local credentials or environment-sourced secrets. At L075 the code reads GUAIKEI_API_TOKEN from the process environment, which is a privileged capability beyond the user-facing purpose described.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists fetched results to a local JSON file without obtaining explicit user consent or offering a disable switch. Because the results may include scraped account and comment-related data, local retention can expose potentially sensitive business research or personal data to other local users, backup systems, or later unintended processing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code presents user-facing descriptions, help text, status messages, and errors exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CLI writes the full search output, including user-supplied keywords and returned results, to a local log file without making that persistence obvious in the stated skill purpose. This creates an unnecessary data-retention surface: sensitive business research terms, competitor-monitoring activity, or returned content may remain on disk and be exposed to other local users, backups, or later compromise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file's natural-language strings, including comments, error messages, and generated help text, are written exclusively in Chinese. That effectively forces a specific language/locale on users of the CLI without any opt-in or documented justification, which matches the policy's language/locale violation criterion.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes capabilities for searching videos, viewing creator works, reading comments, and checking hot rankings, and explicitly excludes operational services like publishing. This module creates directories and writes arbitrary content to local files, a capability that is not part of the stated user-facing purpose and goes beyond obvious implementation needs for comment-thread analysis.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains user-facing error strings in Chinese only, such as the validation messages on L07 and L11, and additional Chinese output on L38. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified, which is not evident in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code returns multiple user-visible error messages only in Chinese, including the authentication failure text and generic request-failure messages. The file does not offer any language selection or document a justified locale restriction, which is a natural-language policy violation under the language/locale rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module emits all user-facing status and warning messages exclusively in Chinese, including error and guidance text. For a general utility file with no documented region-specific constraint or user opt-in, this creates a language/locale policy concern because users who do not read Chinese may be unable to understand warnings or required actions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON schema contains user-facing title and description fields exclusively in Chinese, which can impose a specific language on users without any opt-in or documented locale constraint. The policy requires either offering language choice or clearly documenting a justified region-specific limitation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The schema title and description are written only in Chinese, which imposes a specific language in the skill-facing metadata without any indication of user opt-in or locale-specific scope. Under the language/locale policy, this is a natural-language policy concern because the file does not document that the skill is intended only for Chinese-speaking or region-specific use.
- Content
Static analysis
No suspicious patterns detected.