Security audit

guaikei-douyin-competitor-analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it should be reviewed because it sends tokens and research inputs to a third-party API and saves collected results locally by default.

Install only if you are comfortable sending Douyin keywords, target URLs, and your GUAIKEI_API_TOKEN to guaikei.com. Treat generated logs as retained research data, especially for comments and competitor analysis, and delete or protect the logs directory as needed. Avoid using the skill for generic content research unless you explicitly want Douyin data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:99
Finding: API Credential Exposed in URL Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (44)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音数据搜索与分析的技能，但提供的代码片段并未执行任何抖音相关操作，也未体现网络请求、平台访问、数据抓取、评论分析、热榜查询或竞品分析等功能。其主要用途是通用的 CLI 参数解析和帮助信息生成，属于与声明用途明显不同的基础工具代码。虽然这类工具代码可能作为更大系统的配套组件存在，但就该代码片段本身而言，其行为与声明功能不一致，应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是面向抖音数据搜索、抓取和分析的技能能力，而提供的代码片段并未体现任何抖音搜索、热榜、评论、博主作品抓取或分析逻辑。相反，它执行的是本地日志文件写入这一通用文件系统操作。虽然日志记录可作为辅助实现细节存在，但在当前仅有的代码片段中，实际行为与声明的主要用途明显不一致，且涉及未声明的本地文件写入能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的核心能力是抖音数据搜索、抓取与分析，但提供的代码片段实际只处理 API token 的格式校验和错误提示，属于访问控制/授权辅助逻辑，而非抖音分析功能本身。尤其是代码还包含未在描述中提及的商业化引导内容（获取私有TOKEN、客服微信、网站）。虽然 token 管理可算作通用支撑模块，但当前代码片段与声明的业务功能完全不对应，无法体现所宣称的抖音能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill requires access to the environment variable GUAIKEI_API_TOKEN but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization-boundary weakness: the skill can depend on secret-bearing environment access without clearly constraining or documenting that capability, increasing the risk of unintended secret exposure or over-privileged execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill says it should also be used when users request content research without explicitly naming Douyin, which broadens activation beyond a clearly bounded intent. Over-broad routing can cause unintended data disclosure to a third-party API, accidental invocation on unrelated requests, or collection of platform-specific data when the user did not consent to that tool choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The schema explicitly documents video_url as both playback and download addresses, which conflicts with the manifest claim that the skill is not intended for downloading videos. That mismatch can enable downstream agents or integrators to use the skill for prohibited content retrieval, weakening policy boundaries and creating compliance and abuse risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents play_addr as both a playback address and a video download address, which conflicts with the skill's stated restriction that it is not for downloading videos. Even though this file is only a schema, documenting and normalizing a download-capable field can enable downstream clients or agents to retrieve media in ways the skill claims not to support, weakening policy boundaries and increasing misuse risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes bulk collection of public Douyin videos, author data, comments, and heat-list data, and later notes JSON log export, but the early skill description does not clearly warn users that third-party content and comments will be collected and stored locally. That omission can lead operators to collect personal or sensitive third-party data without informed consent, increasing privacy, compliance, and misuse risk. In this context, the skill is specifically designed for competitor analysis and comment harvesting at scale, which makes the lack of up-front disclosure more dangerous than in a generic data-processing tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The changelog and feature descriptions are primarily written in Chinese, but the file does not state that the skill is limited to Chinese-speaking users or offer any language choice. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The function sends the provided token and video URL to an external API via requestApi, which is a data-transmitting operation covered by the missing-warning rule for code files. Although there are developer docstrings, there is no confirmation prompt, user-facing log/print, or explicit disclosure to the user that these values will be transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This function performs a GET request to an external API and includes token, URL, and limit in the request parameters. The code contains no visible confirmation prompt or user-facing disclosure that this information is being sent off-system, which matches the rule's concern for undisclosed network transmission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code file contains natural-language comments and documentation exclusively in Chinese, including the module description and parameter docs. Under the policy rule, forcing a single language without opt-in or explicit justification is a locale/language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI persists fetched Douyin comment results to a local JSON file even though the skill is described as a read/query analysis tool. Comments can contain personal data, usernames, or sensitive content, and silently writing them to disk creates an unnecessary data-retention surface that may expose data to other local users, backup systems, or later unintended processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code writes full comment results to a local JSON file without an explicit warning or consent at the write site, so users may reasonably believe the tool only queries and prints results. This silent side effect increases privacy and compliance risk because collected comments are retained on disk beyond the immediate session.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Natural-language strings throughout the file, including comments and runtime messages, are written only in Chinese. This can violate language/locale policy when a skill forces a specific language without opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI transmits the user-supplied Douyin URL and query parameters to remote API functions without clearly warning the user that their input will be sent off-host. For a scraping/analysis skill, network transmission is expected, but lack of disclosure can still create privacy and compliance issues when analyzing sensitive targets or internal research workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI silently persists the full fetched results to a local JSON file, which can expose scraped content and associated metadata beyond the user’s immediate request. In a data-collection skill, undisclosed retention increases privacy and data-handling risk, especially on shared systems or when the output contains sensitive competitor-monitoring data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script writes fetched results to a local JSON file without any clear user-facing notice, which creates an unexpected data-at-rest footprint. On multi-user machines or automated pipelines, this can leak collected datasets, research targets, or other potentially sensitive operational information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI persists the full search output and request parameters, including user-supplied keywords, to a local file without any explicit consent, warning, retention control, or redaction. In this skill context, search terms and collected competitor-analysis data may reveal sensitive business research, monitoring targets, or private investigative interests, so silent local persistence creates a privacy and data-exposure risk if the host is shared or logs are later exfiltrated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This file contains natural-language comments, help text, and error messages exclusively in Chinese, including the generated CLI help and runtime errors. That can violate the language/locale policy because the skill imposes a specific language on users without any opt-in, fallback, or indication that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code emits user-facing error messages in Chinese (for example at L07 and L11), and additional success/error output later in the file is also Chinese-only. This creates a language policy issue if the skill is expected to operate generally, because it does not provide user opt-in or any documented locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code returns a fixed Chinese-language authentication error message and includes a WeChat contact number as the prescribed resolution path. That imposes a specific language/locale on users without offering an alternative or documenting that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module emits all user-facing status and warning messages exclusively in Chinese, including error, info, and success output. This creates a language/locale policy concern because the skill does not provide any user opt-in, alternative locale, or documented justification for restricting messaging to Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JavaScript file contains docstrings and user-visible error/output strings exclusively in Chinese, such as validation errors and formatted result labels. Under the language/locale policy rule, forcing a specific language without opt-in or documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill content, examples, and operational guidance are presented entirely in Chinese, which effectively imposes a language expectation on users and downstream agents. There is no stated opt-in, multilingual alternative, or justification that this skill is intentionally limited to Chinese-language use.
Content: No source excerpt is available for this finding.