guaikei-douyin-content-research

• Outcome: Review
• Latest audit: Aug 18, 2026 · 2:05 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a read-only Douyin research tool, but it needs Review because it automatically stores fetched social data locally and exposes media URLs despite saying it does not provide downloads.

Install only if you are comfortable sending Douyin research inputs and your GUAIKEI_API_TOKEN to guaikei.com. Treat generated logs as retained social-media data: keep them out of repos and shared folders, delete them when no longer needed, and avoid using the skill for private, non-Douyin, or ambiguous short-video requests. Be aware that returned media URL fields may be usable beyond analysis even though the skill says it does not support downloads.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The documented behavior claims stdout-only JSON and positions the tool as a bounded research utility, but the finding indicates results are also written to a local `logs` directory. Silent persistence of fetched data can retain potentially sensitive URLs, comments, account identifiers, and analysis targets longer than users expect, creating confidentiality and compliance risk; the user-search capability mismatch also increases the chance of misleading or unintended operation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The schema explicitly documents `video_url` as containing both playback and download addresses, which conflicts with the skill manifest's stated prohibition on download capability. In an agent ecosystem, schemas shape downstream behavior; exposing download URLs can enable clients or agents to implement de facto downloading even if the natural-language manifest says not to.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback address and a video download address, which contradicts the skill's stated restriction that it does not provide download capability. In a Douyin research skill, exposing or normalizing a downloadable media URL can enable downstream consumers to use the skill for content acquisition rather than analysis, expanding the skill beyond its declared and likely policy-approved scope.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The CLI persists fetched comment results to a local JSON file after completing a read-oriented research task. Because comments may contain personal data, sensitive opinions, or regulated content, silently retaining them on disk increases data exposure risk through unintended disclosure, later reuse, or collection by other local processes.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The CLI saves the full fetched Douyin post results to a local JSON file after completing the query. In a research-only skill, this creates an unnecessary persistence channel for potentially sensitive or regulated scraped data, increasing the risk of unintended retention, disclosure to other local users/processes, or policy drift from 'query only' behavior into data collection/storage behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger rule says the skill should activate for short-video data tasks even when the user does not mention Douyin, which is an overly broad routing policy. This can cause data to be sent to a third-party Douyin API for queries about other platforms or for ambiguous requests, leading to unintended external disclosure and incorrect tool use.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes automatic JSON log export for search results, author data, and comments, but does not clearly warn that scraped data will be persisted to local files. Because this skill handles potentially sensitive public-profile and comment data at scale, silent local retention increases the risk of unintended disclosure on shared machines, backups, or repos.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to place the GUAIKEI_API_TOKEN in an environment variable but does not warn about exposure through shell history, shared terminals, process inspection, CI logs, screenshots, or inherited environments. This can lead to credential leakage and unauthorized API use, especially because the token is required for all skill operations.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The code writes full comment results to a local JSON file without an explicit warning or user consent in this execution path. Even if intended for convenience or auditability, silent persistence can surprise users and expose scraped comment data to other users, backups, or endpoint monitoring tools.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The program writes query results to a local JSON file without any user-facing warning or consent in this file. Silent persistence of collected Douyin data can surprise users, violate least-astonishment expectations, and expose stored data to later access by other tools, users, or processes on the same system.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.