Security audit

guaikei-douyin-comments-for-sentiment-insight

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but it handles credentials and collected data in ways users should review before installing.

Install only if you are comfortable sending Douyin keywords, target URLs, and a GUAIKEI_API_TOKEN to the provider service, and with fetched results being saved locally by default. Treat the token as sensitive, avoid broad automatic invocation, and review or clear the logs directory after use, especially when collecting comments or creator data at scale.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/token.js:23
Finding: Runtime Promotional Output Contradicts the Skill Security Manifest
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/utils/request.js:100
Finding: API Authentication Token and User Inputs Are Placed in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/config/constants.js:20
Finding: Network Retry Behavior Can Perform Up to Twenty Attempts Despite a Three-Attempt Claim
Content: View full analysis
setTimeout(resolve, delay)); } } } throw lastError || new Error(`重试${maxAttempts}次后失败`); } ``` Representative use from `src/api/search.js:115-121`: ```js const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "查询任务", ); ``` The Skill documentation states that network timeout retries stop after at most three attempts, while query operations pass a value of twenty to the generic retry function. ### Technical Analysis The implementation uses the same generic retry function for task polling and failures. Unless an error is marked `noRetry`, each failed query can result in another complete HTTPS request. Query operations permit up to twenty attempts, with exponential delay capped at 60 seconds. The code does not clearly distinguish between: - A successful response indicating that a remote task is still pending. - A transient netw ...[truncated 1381 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码片段仅实现通用命令行参数解析与帮助文本生成，包括读取 flag 值、校验必填参数、处理布尔选项和位置参数等。这类功能只是可能被其他工具复用的基础设施，不构成声明中所述的抖音数据搜索、采集或分析能力。按照评估标准，支持性实现细节本身不应视为问题；但这里提供的代码片段没有展现任何与声明用途直接对应的核心行为，因此当前代码行为与声明目的存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码片段只是一个本地日志工具函数 taskWrite，依赖 fs/path 在本地 logs 目录下创建文件并写入内容，还对文件名做了安全清洗。它没有任何与抖音平台交互、网络请求、数据抓取、搜索、评论读取、热榜查询相关的行为。虽然日志写入可作为支持性实现细节，但当前提供的代码片段本身的实际行为与声明描述的技能能力明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a Douyin scraping/research capability, but the supplied code chunk does not implement any of those behaviors. It merely accesses the local filesystem to read package.json and expose the package name. This is a materially different purpose from the declared skill behavior, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill explicitly depends on an environment variable (GUAIKEI_API_TOKEN) but does not declare any tool scope or permissions boundary for environment access. That weakens reviewability and least-privilege guarantees, making it easier for a runtime or wrapper to grant broader access than users expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill authorizes broad implicit triggering for generic 'short-video research' requests even when the user did not mention Douyin. Over-broad auto-invocation increases the chance of collecting platform data unexpectedly, causing scope creep, privacy surprises, or actions on the wrong service without clear user consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document says invalid-token handling must avoid contact or marketing output, yet another error path instructs users to 'contact customer service' when quota is exceeded. In practice, contradictory runtime guidance around auth and quota failures can lead to policy bypass, social-engineering style prompting, or accidental disclosure of support channels in execution contexts that were meant to stay neutral.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title on L004 and repeated field descriptions from L005 onward. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents play_addr as both a playback URL and a video download address, while the skill metadata says it is not applicable to downloading watermark-free videos. Even though this is only a response schema, exposing and documenting a download-capable field broadens the effective capability surface and can enable downstream agents or users to misuse the skill for content retrieval outside the declared scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README maps very common user phrases directly to executable commands, and the trigger language is broad enough that normal conversation about searching, comments, creators, or hot topics could activate the skill unexpectedly. In an agent setting, that can cause unintended collection of third-party platform data and transmission to an external service using the configured token, which is a real security and privacy risk even though the operations are read-only.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The intent-recognition priority rules use generic terms like '搜索', '评论', '作品', '账号', and '热点', which are common across many unrelated conversations and not sufficiently constrained to this specific tool. Because the skill performs external data retrieval and logging, misclassification can lead to unauthorized or surprising actions, including querying Douyin when the user did not clearly request that platform or scraping comments when they were only discussing content abstractly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explicitly enables collection of creator post lists and comment data at scale, including up to 10,000 records, but provides no privacy, consent, retention, or platform-terms guidance. In a sentiment-insight skill, this omission can normalize bulk harvesting of user-generated content and profile-linked data, increasing the risk of privacy misuse, non-compliant monitoring, or downstream profiling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language content in the file is entirely Chinese, including the module description, parameter docs, and error message text. This indicates a fixed language/locale choice with no user opt-in or documented region-specific justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI persists fetched comment data to a local JSON file after printing it, which creates an undeclared secondary data sink containing potentially sensitive user-generated content. In this skill context, comment scraping and sentiment analysis can collect large volumes of third-party text, so silent local retention increases privacy, compliance, and data exposure risk if the host environment is shared or logs are later exfiltrated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The program writes scraped comment results to a local file without obtaining explicit user confirmation or providing a prominent warning in the CLI flow. Because the skill is positioned as a data-retrieval tool, users may reasonably expect transient output only; silent persistence of third-party comments materially increases privacy and operational risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s natural-language strings and messages are consistently hard-coded in Chinese, including status, errors, and success output. Because there is no indication that the skill is region-specific or that users can opt into this locale, this appears to violate the language/locale policy for user-facing behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes searching Douyin content, fetching creator works, scraping comments, and querying hot rankings for research and analysis. This file not only retrieves post data but also persists the full result set to disk via log.taskWrite, which is a material behavior beyond simple retrieval/output and is not described in the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI persists full search output to a local file using a filename derived from the user keyword, without any explicit user consent or warning. In this skill’s context, search terms and returned Douyin results may contain sensitive research topics, personal names, or account/content data, so silent local retention increases privacy and data exposure risk on shared systems or in CI/agent environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The auth error string is written only in Chinese and directs users to contact a specific WeChat number for resolution. This imposes a language/locale expectation in user-facing text without offering an alternative language or opt-in, which matches the policy category for language or locale violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code formats all user-facing output strings in Chinese, including headings and labels, with no indication that the skill is China/Chinese-specific or that users can opt into a language. That creates a natural-language policy concern because it forces a specific locale in the skill output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L142 的“纯中文界面”表示该技能强制使用单一语言，但文档中未说明用户可选择其他语言，也未给出该限制的合规性或区域性必要理由。根据语言/locale 政策，这属于未获用户选择的语言限制。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The schema title and description are written only in Chinese, which can impose a language choice on users or downstream tooling without any opt-in or justification. Under the policy, language-specific behavior should either offer a choice or clearly document a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON schema contains natural-language titles and descriptions exclusively in Chinese, such as the title and per-field descriptions. Because the file does not state that the skill is region-specific or offer an alternative language, it may impose a specific language/locale without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON schema uses Chinese-only natural-language metadata in the title and field descriptions, which can constitute a language/locale policy violation when no user opt-in or documented region-specific scope is provided. Because the file contains only Chinese labels and no indication that the skill is intentionally limited to Chinese-speaking users, it may impose a language choice implicitly.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This is a manifest-type JSON file, so vague-trigger checks apply. The description states the skill retrieves a Douyin creator's works and explains CLI parameters, but it does not define concrete activation phrases, boundaries, or negative examples, which can leave invocation conditions ambiguous in systems that rely on manifest text for routing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema is a manifest-type file, so natural-language policy checks apply. The title and description are entirely in Chinese, and the file does not indicate that the schema is region-specific or that language selection is optional, which can violate a language/locale policy requiring user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.