guaikei-douyin-data-export-tool

• Outcome: Review
• Latest audit: Aug 25, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a Douyin public-data export tool, but its activation scope, token handling, runtime messaging, and exposed media URLs need review before installation.

Install only if you are comfortable sending Douyin queries, Douyin URLs, and a GUAIKEI_API_TOKEN to www.guaikei.com, and with results being saved automatically in the skill's logs directory. Treat ambiguous research requests carefully; prefer invoking it only when the user clearly wants Douyin data. Be aware that returned results may include media playback/download URLs even though the skill says downloading is out of scope.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares access to an environment variable token (`GUAIKEI_API_TOKEN`) and networked API usage, but does not expose a corresponding explicit permission model in the metadata. This creates a transparency and governance gap: an orchestrator or reviewer may underestimate the skill’s ability to access secrets and call external services, which can lead to unintended token exposure or unreviewed outbound data flow.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The schema explicitly documents `video_url` as both playback and download addresses, which conflicts with the skill description stating it is not applicable to downloading. That mismatch can enable downstream agents or integrators to use the skill for bulk media extraction anyway, expanding the skill from public-information analysis into content acquisition and increasing legal, policy, and abuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback URL and a video download address, which conflicts with the skill metadata stating the skill is not intended for downloading. This creates a capability/intent mismatch that can enable downstream agents or users to repurpose the skill for media retrieval beyond its declared scope, increasing policy and misuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI persists fetched comment data to a local JSON file after printing it, which creates an undocumented secondary data sink. Even if the source content is public, comments may contain personal data, and silent local retention increases privacy, compliance, and unintended disclosure risk on shared systems.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI writes the full fetched Douyin results to a local JSON file after execution, which creates persistent storage of scraped data beyond the user-visible query behavior. This increases privacy and data-handling risk because fetched content may contain personal or sensitive information and may remain on disk without the operator realizing it.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The CLI writes full search output, including queried keywords and returned results, to a local log file even though the skill is presented as a lookup/read tool. This creates unnecessary data retention on disk, which can expose user queries and collected content to other local users, later processes, or accidental disclosure, especially if results contain sensitive or regulated information.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The top-level description says to use this skill for 'any public information on Douyin' and even when the user did not explicitly mention Douyin, greatly expanding activation scope. Overbroad trigger rules can cause the agent to invoke an external data-collection skill during generic research tasks, sending user intent or query data to a third-party API without clear user consent or platform specificity.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The generalized trigger guidance explicitly allows invocation from vague multi-step workflows like 'help me research this sector' even when Douyin is not mentioned. This is dangerous because it permits hidden tool use inside broad tasks, increasing the chance of silent external queries, unnecessary data sharing, and user surprise about what platform is being searched.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Trigger phrases such as 'hot topics', 'what's trending today', or 'rankings' are highly generic and likely to appear in ordinary conversation unrelated to Douyin. This can cause accidental invocation and external API calls based on ambiguous speech, creating privacy, consent, and relevance risks even if the queried data is public.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The GET request places the token and search parameters directly into the query string. Query parameters are commonly exposed through logs, browser history, intermediary proxies, analytics, and server access logs, so putting credentials there increases the risk of unintended credential leakage and user query exposure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script writes comment results to disk without a clear user-facing warning or explicit consent, so users may believe the tool is read-only while it creates persistent artifacts. This can expose scraped data to other local users, backups, or later reuse beyond the user's expectation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code silently saves fetched results to a local file without explicit warning or confirmation in the command flow. Hidden persistence is dangerous because users may believe the tool only displays results transiently, while it actually leaves an on-disk artifact that can later be accessed, copied, or exposed.

Static analysis

No suspicious patterns detected.