Security audit

guaikei-douyin-data-catalog

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it should be reviewed because it can run for overly broad requests, saves retrieved data locally by default, and its runtime token-error messages contradict its own safety claims.

Install only if you intend agents to query Douyin public data through the Guaikei API and are comfortable with the token and request details being sent to that service. Review or narrow the activation rules so generic research requests ask for confirmation first, and treat the logs directory as potentially sensitive because it can retain searches, creator data, and comments.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The CLI writes the full search output, including the user's keyword and returned results, to a local JSON file without any visible consent or retention control. In a data-retrieval skill, this creates an unexpected persistence channel that can expose sensitive research topics or retrieved content to other local users, backups, or log collection systems.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description says the skill should be used even when the user has not mentioned Douyin, based on broad intents like competitor analysis or 'what's hot.' This can cause unintended activation for generic research requests, leading the agent to pull data from the wrong source, make networked calls the user did not specifically request, or over-collect external data in contexts where Douyin is irrelevant.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The implicit trigger examples remain very generic ('竞品调研', '高赞内容', '热门话题') and do not sufficiently distinguish Douyin-specific requests from broad content or marketing analysis. In an agent setting, this increases the chance of misrouting user intent, unnecessary external querying, and disclosure of third-party platform data when the user may have wanted a different platform or a non-platform-specific answer.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README states that fetched Douyin data is automatically exported to local JSON logs, but it does not prominently warn that those logs may contain user-generated content, author identifiers, or comment data that can persist on disk and be redistributed unintentionally. In this skill context, the risk is elevated because the stated use cases include comment analysis and competitor monitoring, which can lead to accumulation of potentially sensitive or regulated data without clear retention or access guidance.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The natural-language trigger examples use very broad phrases such as requests for competitor analysis or checking what is hot in an industry, which can cause the skill to activate even when the user did not explicitly intend Douyin data collection. That is dangerous because it increases the chance of surprise execution, unnecessary third-party queries, and unintended collection/storage of platform data under ambiguous user intent.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The intent-recognition rule maps generic phrases like '热点', '榜单', or '今天什么火' directly to the Douyin hot-list command, even though those phrases commonly appear in ordinary conversation unrelated to Douyin. In this skill's context, that broad matching increases the likelihood of accidental invocation and unintended requests to the external service, with follow-on logging of returned data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The changelog explicitly adds bulk retrieval of creator posts and video comments, which are forms of large-scale data collection that can implicate privacy, consent, and platform-terms compliance. In the context of a Douyin analytics skill intended for competitor research and trend mining, the absence of any warning or constraints makes misuse more likely and normalizes scraping of user-generated content without safeguards.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The CLI persists full comment retrieval results to a local JSON file by default, without any consent prompt, opt-in flag, or visible disclosure tied to data retention. Because comment data can contain personal or sensitive user-generated content, this creates a privacy and data-handling risk: users may not realize the tool leaves recoverable local copies on disk that could later be accessed, exfiltrated, or improperly retained.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The CLI persists fetched Douyin post results to a local JSON file automatically, with no user warning, consent prompt, or documented opt-out in this code path. Because the data may include creator/content metadata and potentially sensitive research outputs, silent local persistence can expose data to other local users, backups, logs, or later exfiltration on shared or managed systems.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Search results are silently persisted to disk even though the tool presents itself as a search/analysis utility rather than a storage mechanism. Because the saved JSON can contain user queries and potentially sensitive business intelligence or comment data, this increases privacy and confidentiality risk, especially on shared machines or environments with endpoint backup/monitoring.

Static analysis

No suspicious patterns detected.