Security audit

guaikei-douyin-competitor-videos-and-comments

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Douyin public-data research tool that uses one API token and writes results to local logs, with some broad invocation guidance users should be aware of.

Install only if you are comfortable sending Douyin research terms, profile or video URLs, and retrieved public data through the Guaikei API using GUAIKEI_API_TOKEN. Treat generated logs as retained research data and delete or restrict them when they contain sensitive business topics or large comment exports. For generic competitor or trend requests, confirm that Douyin data is actually intended before invoking the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill requires access to the `GUAIKEI_API_TOKEN` environment variable, but no explicit permission declaration is surfaced alongside that capability. Hidden or undocumented access to secrets increases the risk that callers invoke the skill without understanding that sensitive credentials are being consumed. In this context the risk is somewhat reduced because the env var is openly described in the markdown, but the static finding is still valid if the platform expects formal permission declaration rather than prose-only disclosure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill description emphasizes public-data collection and says it does not write sensitive data to disk except logs, yet it also saves collected results to `logs/` and sends the skill name from `package.json` to an external service. That is a real behavior-description mismatch: users may not expect local persistence of queried content or extra metadata disclosure to a third party, which can create privacy, retention, and transparency issues. The context makes this more concerning because competitor research and comment analysis can include sensitive business queries or user-generated content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The schema explicitly documents `play_addr` as both a playback address and a video download address, which conflicts with the skill’s stated scope that it does not handle video downloading. This can enable downstream agents or integrators to use the skill for media extraction anyway, expanding capability beyond the declared trust boundary and potentially creating policy, compliance, or misuse risk.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger guidance says the skill should be used even when the user did not explicitly mention Douyin, which broadens invocation beyond the stated platform scope. Over-broad routing can cause unintended data transfer to this skill for generic competitor-analysis requests, exposing user queries, URLs, or research topics to an external API without sufficiently specific consent. This is not code execution, but it is a real security and privacy design issue.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The multi-step workflow trigger rule allows invocation when a task is merely 'embedded' in broader research work, without adequate scoping constraints. In agentic systems this can lead to silent expansion of the skill's use, causing external API calls and collection of public-platform data when the user asked for a more general market-analysis task. The skill context increases the risk because collected comments, account data, and search terms may reveal confidential research intent.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The natural-language mapping includes broad trigger phrases that can match ordinary user requests, increasing the chance the skill activates when the user did not specifically intend Douyin scraping. In an agent setting, this can lead to unintended collection of third-party platform data and unexpected external actions based on casual conversation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The intent-priority rule treats generic phrases such as '热点' or '今天什么火' as a direct signal to invoke the hot-list command, even though those phrases are common in normal discussion. This makes accidental invocation more likely and is more dangerous here because the skill performs real data retrieval from an external service using a configured token.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The README advertises automatic JSON log export of scraped videos, posts, and comments to a local logs directory without a prominent warning that potentially sensitive scraped data will be persisted on disk. In practice, users may unknowingly retain large amounts of third-party content and identifiers locally, creating privacy, compliance, and accidental disclosure risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.