T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:87- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-competitor-intel-source
Security checks for vulnerabilities and agentic risk
Overview
This Douyin research skill is mostly purpose-aligned, but it has review-worthy issues around broad auto-triggering, automatic local retention of collected data, credential handling, and runtime messages that contradict its own safety documentation.
Review this skill before installing. It will contact www.guaikei.com with your API token and search targets, and it saves collected results locally under logs/. Avoid using it for sensitive investigations, rotate any token already used with this version if URL logging is a concern, and clear saved logs when they contain comments or profile data you do not need to retain.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
src/utils/token.js:23- Finding
Runtime Promotion and Off-Platform Contact Injection in Authentication Errors
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The documentation says the skill writes output files into
logs/, which introduces local persistence despite positioning the skill primarily as a retrieval/browsing tool. Any unnecessary local writes can retain sensitive query terms, API responses, or operational metadata, and the finding becomes more concerning if filenames or content are influenced by user input.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation says the skill writes output files into
logs/, which introduces local persistence despite positioning the skill primarily as a retrieval/browsing tool. Any unnecessary local writes can retain sensitive query terms, API responses, or operational metadata, and the finding becomes more concerning if filenames or content are influenced by user input.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation says the skill writes output files into
logs/, which introduces local persistence despite positioning the skill primarily as a retrieval/browsing tool. Any unnecessary local writes can retain sensitive query terms, API responses, or operational metadata, and the finding becomes more concerning if filenames or content are influenced by user input.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation says the skill writes output files into
logs/, which introduces local persistence despite positioning the skill primarily as a retrieval/browsing tool. Any unnecessary local writes can retain sensitive query terms, API responses, or operational metadata, and the finding becomes more concerning if filenames or content are influenced by user input.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs broad activation for vague research-style prompts even when 'Douyin' is not mentioned, which can cause over-triggering in unrelated contexts. That increases the chance of unnecessary secret use, unintended third-party data access, and silent expansion of the skill's scope beyond what the user clearly requested.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generalized activation guidance allows this skill to be invoked inside broad multi-step research workflows without a clear Douyin constraint. In context, that is more dangerous because the skill has network access and uses an API token, so ambiguous routing can lead to unintended external queries and data collection beyond user intent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill explicitly depends on the sensitive environment variable
GUAIKEI_API_TOKEN, but the manifest does not declare a corresponding tool scope or permission boundary. That creates a least-privilege and reviewability gap: the runtime may expose environment access implicitly, making secret handling harder to audit and increasing the risk of accidental overexposure to the skill.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The schema explicitly documents
video_urlas both playback and download addresses, which conflicts with the skill metadata stating it is not intended for downloading videos or removing watermarks. In an agent setting, schemas guide downstream tool use and model behavior, so exposing download semantics can enable policy-bypassing use of the skill for prohibited content retrieval even if the manifest says otherwise.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema contains natural-language titles and descriptions exclusively in Chinese, including the top-level title/description and property descriptions. Under the policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a language/locale policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly enables scraping Douyin comments, author data, and hot-list data, and later states that output is automatically saved to local JSON logs, but it does not prominently warn that comment content and other scraped platform data may contain personal information or sensitive content. This creates a real privacy and data-handling risk because users may collect, retain, or redistribute personal data without understanding storage, retention, and compliance implications.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language trigger mapping uses very broad everyday phrases such as '帮我搜下', '网上谁在讲这个', and '这个账号更新了啥', which can cause the agent to invoke this scraping skill even when the user did not clearly request Douyin-specific collection. That increases the chance of unintended data collection, overbroad platform targeting, and unexpected execution of commands that fetch and store scraped data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The intent recognition rules prioritize broad keywords like '热搜', '搜索', '评论', '作品', '主页', '账号', and '博主' without sufficient scoping constraints, so ordinary requests may be misclassified into scraping actions. In this skill context, misrouting is more dangerous because the tool performs external data collection and logging, meaning an ambiguous utterance can trigger privacy-impacting collection from a third-party platform.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI persists fetched Douyin comment results to a local JSON file after displaying them, which creates a secondary copy of potentially sensitive or regulated user-generated content without explicit user consent or retention controls. In the skill context, the stated use case is search/view competitor intelligence, so silent local persistence increases privacy and data-handling risk beyond what a user would reasonably expect from a read-only lookup tool.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code writes full comment results to a local file without any notice, prompt, or confirmation in the CLI flow, so operators may unintentionally retain third-party content on shared machines, CI runners, or managed environments. Because the skill is framed as a viewing/search utility rather than an archival tool, the undisclosed persistence makes the behavior more dangerous and privacy-invasive.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI writes the full fetched Douyin results to a local JSON file after completing a read/query operation. This creates undeclared data persistence, which can expose scraped content, account data, and query history to other local users, backup systems, or downstream tooling without the operator realizing it. In the context of a competitor-intel skill, silent retention is more sensitive because collected data may include profiles and comments that users expect to inspect transiently, not store indefinitely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code saves fetched results to a local file without any user-facing warning, confirmation, or explicit output-path selection. Even if persistence is intended, doing so silently increases the risk of accidental collection, long-term retention, and local disclosure of potentially sensitive intelligence-gathering data. The skill’s read-oriented description makes this more concerning because users would reasonably expect query behavior, not hidden storage side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code constructs and sends HTTPS GET and POST requests using caller-supplied params and data, which may include user or system data. Aside from an internal retry log, there is no confirmation prompt, user-facing disclosure, or warning comment/docstring near these transmission points describing that data is sent to a remote service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This JavaScript file contains user-facing validation errors and documentation entirely in Chinese, including hardcoded error strings shown to users. The skill does not indicate any user opt-in or locale selection, which matches the policy concern for forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This manifest-style JSON file contains user-facing natural-language fields such as title and description entirely in Chinese. Because the schema does not indicate that language is configurable or limited to a justified region-specific context, it may violate a language/locale policy that requires user choice or explicit documentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JSON schema contains human-readable title and description fields only in Chinese, which can amount to a language policy violation when no user opt-in or locale justification is provided. The file gives no indication that the schema is intentionally region-specific or that alternative language support exists.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema uses Chinese-only natural-language metadata in the title and field descriptions, which can impose a specific language/locale on downstream users or tools. The file does not indicate that the schema is intended only for a Chinese-language or region-specific context, nor does it offer any language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This manifest-style JSON schema uses only Chinese natural-language strings for the title and field descriptions, which imposes a specific language on users without offering a choice or documenting that the skill is region-specific. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema uses Chinese exclusively in the title and property descriptions, which can impose a specific language/locale on downstream skill behavior or generated documentation. The file does not state that Chinese is optional, user-selected, or required for a region-specific use case, so it may violate the language-choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions for the skill interface, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking locale. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all operational instructions and parameter descriptions in Chinese, with only a parenthetical English phrase in the title. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.