guaikei-douyin-content-decision-data

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:19 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Douyin public-data research purpose, but it uses a token-backed external API with broad automatic triggers and local result logging that deserve review before installation.

Install only if you are comfortable with a third-party GUAIKEI API token being used for Douyin public-data queries and with successful searches, creator-post fetches, and comment fetches being saved locally in the skill's logs directory. Prefer explicit Douyin-scoped prompts, review or delete logs after use, and avoid using it for ambiguous general research unless you intentionally want Douyin as the data source.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly relies on the environment variable `GUAIKEI_API_TOKEN`, but the metadata shown does not declare permissions or capabilities for environment access. Undeclared secret access weakens transparency and reviewability, making it easier for a skill to consume credentials without clear operator awareness.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The schema explicitly documents `video_url` as both playback and download addresses, which conflicts with the skill manifest stating it does not support downloading videos. In a Douyin data-collection skill, this mismatch can enable or encourage downstream clients or agent logic to invoke unauthorized download behavior, creating policy, compliance, and misuse risk beyond the declared scope.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback address and a video download address, which conflicts with the skill metadata stating it does not support video downloading. In an agent setting, this mismatch can cause downstream tooling or prompt logic to expose or rely on download-capable fields, expanding the skill beyond its declared safety and policy boundary.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The CLI writes fetched creator works data to a local JSON log file after completing the request. For a skill described as retrieving public Douyin data, this adds persistence of potentially sensitive research output on disk, which can expose collected data to other local users/processes and exceeds a purely read-only/transient retrieval behavior.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The skill says it should trigger even when users ask for generic short-video research without explicitly mentioning Douyin. That broad trigger scope can cause unintended platform-specific data collection, external API use, and token-backed queries when the user did not clearly request this source.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger mappings include broad natural-language phrases such as “搜索 / 搜一下 / 找 AI 相关视频” and similar everyday wording that can match ordinary user intent too loosely. In an agent environment, this can cause unintended invocation of a data-collection skill, leading to surprise external API calls, unnecessary token use, and possible collection of third-party public data when the user did not explicitly request this platform-specific action.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The hot-list trigger rule includes very broad phrases like “今天什么火,” which are common conversational expressions and not specific enough to safely bind to a Douyin hot-list action. This increases the risk of accidental tool execution in unrelated contexts, causing unintended external requests and potentially misleading results by assuming a Douyin scope the user never asked for.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI writes fetched comment results to a local JSON file automatically, and those results may contain personal data, sensitive opinions, or large-scale scraped content. In a data-collection skill focused on Douyin comments, silent persistence increases privacy and compliance risk because users may not realize scraped data is being stored on disk beyond the terminal output.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The CLI silently writes the full result set to a local file without user confirmation or an explicit save option. Even if the source data is public, automatic local persistence can create unintended data retention, leak research targets/history, and surprise users who expected one-time console output only.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The CLI persists full search output to a local log file without any explicit notice, consent, retention control, or redaction. Search queries and returned public-data records can still contain sensitive research topics, usernames, or profiling data, and silent local persistence increases the chance of unintended disclosure on shared systems or through later log collection.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.