Security audit

guaikei-douyin-content-research

Security checks for vulnerabilities and agentic risk

Overview

This Douyin research skill is mostly coherent, but it needs review because it sends an API token in URL parameters and saves retrieved data locally by default.

Install only if you are comfortable sending Douyin research queries and your Guaikei API token to guaikei.com. Treat the generated logs directory as sensitive, delete or protect saved JSON files after use, and avoid using this on shared machines or in repositories until token handling and opt-in storage are improved.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:103
Finding: API Token Exposed in URL Query Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/utils/log.js:5
Finding: Automatic Plaintext Persistence of Retrieved Douyin Data
Content: View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.slice(0, 200); } if (!safeFilename) { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` ```js // src/douyin/search-cli.js:258-261 await log.taskWrite( `${startTime}_${keyword}_${sort}_${time}_${duration}_${content}_search.json`, JSON.stringify(finalOutput, null, 2), ); ``` Equivalent calls automatically save successful post and comment results in `src/douyin/post-cli.js` and `src/douyin/comment-cli.js`. ### Technical Analysis Successful search, post, and comment operations automatically serialize their complete result objects to plaintext files under the project’s `logs` directory. The stored results may include comment contents, account identifiers, profile URLs, nicknames, and IP-region fields returned by the API. The files are created without an explicit restrictive mode, so their effective permiss ...[truncated 1529 chars]
Remediation: View remediation
` or `--save`. 2. If storage is enabled, create directories and files with restrictive permissions: ```js await fs.promises.mkdir(outputDirectory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { mode: 0o600, flag: "wx", }); ``` 3. Verify that the selected output path remains inside an approved directory after canonicalization. 4. Provide retention controls, including automatic expiration or a documented cleanup command. 5. Add `logs/` to `.gitignore` to reduce accidental commits. 6. Minimize stored fields and allow users to redact account identifiers, profile URLs, IP-region data, and comment text when those values are unnecessary. 7. Clearly disclose automatic or optional persistence in `SKILL.md`, including the directory, retained data types, permissions, and deletion procedure. 8. Avoid silently treating write failures as harmless when the user explicitly requests output persistence; return a structured warning or error instead. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音数据研究的业务技能，但代码片段仅是基础的 CLI 参数解析与帮助文本生成模块，属于通用支撑工具，不直接访问抖音、也不执行任何搜索、抓取、分析或趋势查询。按照评估标准，若代码的主要目的与声明能力 materially different，则应判定为不匹配。这里代码没有展示任何与声明核心功能相符的行为，因此属于明显不匹配，而不是可忽略的实现细节。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音数据调研与分析的技能，核心能力应涉及搜索、抓取、评论分析和热榜查询。但提供的代码片段并未体现任何与抖音平台交互、数据抓取、评论分析或趋势查询相关的行为，而是一个通用的本地日志写入模块。虽然日志记录可作为辅助实现细节存在，但该片段的实际功能与声明的业务能力完全不一致，且展示了未声明的本地文件写入能力。因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音数据检索与分析的技能，核心能力应涉及短视频平台内容搜索、账号作品抓取、评论分析或热点榜单查询。而提供的代码片段只是一个工具函数：定位到 package.json，读取文件内容，并返回包名。该行为既不体现任何抖音相关数据访问，也不体现内容调研、对标分析、评论洞察或趋势追踪能力。虽然读取 package.json 可能属于内部辅助实现，但就当前代码片段本身来看，其实际功能与声明目的明显不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是面向抖音数据调研的业务能力，但实际代码片段没有体现任何抖音搜索、作品抓取、评论分析或热榜查询功能，而是一个与鉴权配置相关的辅助模块。虽然令牌管理可作为底层支撑实现细节，但就该代码片段本身而言，其实际行为与声明的核心能力明显不一致，且额外包含引导用户购买/获取私有TOKEN的提示，这也未在声明中体现。因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest explicitly says the skill should trigger even when the user does not mention Douyin, as long as the task vaguely involves short-video data. That broad routing rule can cause the agent to invoke a third-party data-access skill on ambiguous requests, sending user queries to an external service without sufficiently specific user intent or platform confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This manifest-style JSON file contains user-facing natural-language strings such as the title and property descriptions entirely in Chinese. Because the file does not indicate that the skill is region-specific or provide any user language choice, it appears to impose a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, which imposes a specific language/locale in the skill artifact. Under the policy, locale constraints should either be optional for the user or clearly documented as region-specific and justified; this file provides neither.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents play_addr as both a playback URL and a video download address, which conflicts with the skill metadata stating it does not provide download capability. This mismatch can enable downstream agents or integrators to treat the field as approved for downloading, increasing the risk of policy bypass, copyright misuse, or unauthorized content acquisition.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README explicitly states that collected Douyin data is automatically exported to local JSON log files, but it does not prominently warn that those files may contain scraped public content, comments, account identifiers, or other potentially sensitive research data that persists on disk. In a content-research skill that collects data in bulk, silent persistence increases the chance of unintended retention, local disclosure, or later misuse, especially on shared workstations or repositories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all operational instructions, parameter descriptions, and examples exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest frames the skill as providing Douyin content research functions such as searching, account analysis, comment insight, and hotlist querying. In this file, after retrieving comments, the tool also writes the full result payload to disk via log.taskWrite, which is a behavior beyond the user-visible read/query scope described in the manifest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code contains multiple natural-language strings shown to users entirely in Chinese, including the function description and success/error messages. The file does not indicate that the skill is region-specific or provide any user opt-in for language/locale, which can violate language-choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script reads process.env.GUAIKEI_API_TOKEN and uses it to create and fetch remote post tasks, which involves both sensitive credential access and network transmission. While the code logs progress of fetching posts, it does not clearly disclose to the user in this file that an API token will be read from the environment and used for outbound authenticated requests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI writes fetched Douyin results to a local JSON file automatically after completing the query. This creates an undisclosed local persistence channel for potentially sensitive research data, increasing the risk of data leakage on shared hosts, CI runners, or multi-user environments. In the context of a research-only skill, silent storage is more dangerous because users may reasonably expect transient query behavior rather than durable retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The program writes returned content data to disk without any user confirmation, warning, or explicit output-path selection. Silent file writes can expose queried account data, comments, or analysis artifacts to other local users, backup systems, and forensic recovery, especially when the user only intended to inspect results in the terminal.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI writes the full search output, including user query parameters and returned results, to a local JSON file without any explicit user consent or disclosure. In a research tool context, this creates unintended data persistence that can expose sensitive search terms or collected content to other local users, backups, or later compromise of the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Search results are persisted locally with no user-facing warning, despite the skill presenting itself as a query/research utility rather than a storage tool. Silent retention increases privacy risk because users may reasonably expect ephemeral processing, while the saved JSON may contain sensitive keywords, metadata, and collected third-party content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Multiple user-visible error strings are written only in Chinese, including request failures, timeout/network errors, and the authentication message. This imposes a specific language/locale on all users without any visible language selection or opt-in, which matches the policy's language/locale violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing warning and status messages are entirely in Chinese, including promotional text and recovery instructions. This imposes a specific language on users without opt-in or any documented region-specific rationale, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains user-facing natural-language strings exclusively in Chinese, including validation errors and formatted result messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 70% confidence
Finding: The skill instructions, examples, and user-facing guidance are entirely in Chinese, which can amount to a language/locale constraint. There is no explicit opt-in, alternative language option, or statement that the skill is region- or language-specific by design.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The human-readable title and description fields are entirely in Chinese, which can impose a specific language expectation on users or downstream tooling that surfaces these strings. The file does not indicate that this is a region-specific skill or provide any opt-in or alternative locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The schema title and description are written only in Chinese, which can constitute a language/locale policy issue when no user opt-in or justification is provided. Nothing in this file indicates that the skill is intentionally region-specific or that users can choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This JSON schema includes its title and field descriptions entirely in Chinese, which imposes a specific language/locale on downstream users and tooling. Under the policy criteria, locale-specific language should either be optional, user-selectable, or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.