Security audit

guaikei-douyin-data-export-tool

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated Douyin public-data export purpose, but it has review-worthy risks around broad activation, credential handling, remote error text, promotional auth-failure output, and automatic local data retention.

Install only if you are comfortable sending Douyin search terms, profile/video URLs, and a Guaikei API token to the provider service, and review or patch the token-in-query, remote-error-message, and auth-failure contact behavior first. Treat exported logs as retained datasets that may include personal information from public comments, and delete or protect them after use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/request.js:33
Finding: Unsanitized Remote API Error Messages Reach Agent-Visible Output
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: src/utils/request.js:51
Finding: Hardcoded Promotional Contact Information Is Emitted on Authentication Failure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/api/search.js:58
Finding: API Authentication Token Is Transmitted in URL Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (48)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: 声明描述的是一个覆盖多类抖音公开信息查询的综合技能，但提供的代码片段只涉及关键词搜索：创建搜索任务、查询搜索结果，以及对结果附加作者主页链接和时间字符串。没有看到评论读取、热搜读取、按博主作品列表抓取等核心能力实现。因此代码行为明显比声明范围窄，声明未准确代表该代码块的实际功能。虽然后续其他代码文件可能补足功能，但就该 supplied code chunk 而言，存在描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开信息查询的技能，预期应体现搜索、内容抓取、评论/热搜读取等平台数据访问行为。但提供的代码仅实现了与业务无关的基础设施：通用 CLI 参数解析、flag/位置参数处理、必填校验和帮助文本生成。代码中没有任何抖音相关逻辑、公开信息访问、搜索、评论读取、热搜查询或账号内容分析功能。因此该代码片段的实际行为与声明用途存在明显不匹配，且其主要目的完全不同。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该代码片段只是一个统一错误处理工具文件，定义了若干错误类，未体现任何与抖音或短视频平台数据访问、搜索、读取公开信息相关的行为。虽然错误处理可以作为技能内部的支持实现细节，但在只提供这一代码片段的情况下，其实际行为与声明的核心功能明显不一致，因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开信息检索/阅读的技能，但实际代码仅执行本地日志文件写入，没有任何与抖音、短视频平台、公开信息抓取、评论读取、热搜查询或账号内容分析相关的行为。其主要能力和资源访问对象是本地文件系统，而非网络平台数据，因此属于明显的描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill should retrieve public information from Douyin/short-video platforms, including content search, creator post inspection, comment reading, and hot-topic lookup. The supplied code does none of that. It merely uses fs/path to locate package.json, reads it from the local filesystem, parses it, and returns pkg.name. This is a materially different purpose and accesses a resource (local package metadata) unrelated to the declared functionality. This is not just a supporting detail of the claimed behavior; it is the only behavior shown, so the description and code are mismatched.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code chunk's primary function is a low-level helper: retrying async operations with exponential backoff, honoring a noRetry flag, and invoking an optional error handler. That is a supporting utility, not behavior matching the declared purpose of fetching and analyzing public information from Douyin or similar short-video platforms. Because the supplied code does not implement any of the declared externally visible capabilities and instead serves an unrelated infrastructure role, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill's trigger conditions are overly broad, including vague requests about 'short-video platform' popularity or competitor research even when the user did not explicitly ask for Douyin. This can cause the agent to invoke external data-collection behavior outside user intent, increasing the risk of unnecessary network access, unwanted data gathering, and scope creep in multi-step tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generalized trigger guidance explicitly instructs activation inside broad multi-step research workflows without sufficient scoping constraints. In an agent setting, this can lead to silent escalation from a generic research request into targeted social-media scraping or API usage the user did not specifically authorize.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest states that outputs are automatically saved into a logs/ directory with timestamps and query parameters, but it does not prominently warn users that collected data will be persisted locally. This creates privacy and data-governance risk because search terms, URLs, comments, or other collected public data may be retained unexpectedly and exposed to later users or processes on the host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The line '纯中文界面，国内服务器可用' imposes a language/locale constraint in natural language. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified; here, the Chinese-only interface is stated without opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The schema title and description are written only in Chinese, which imposes a specific language in natural-language metadata without any opt-in or justification. Under the policy, locale or language constraints should either be optional for users or clearly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON schema contains natural-language title and description text exclusively in Chinese, which can impose a fixed language/locale on users or downstream tooling. The file does not indicate that the skill is region-specific or provide any opt-in or alternative language support.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest explicitly says the skill is not applicable to video downloading, but this response schema defines video_url as containing both playback and download addresses. That indicates the skill may expose downloadable video links, which exceeds the stated non-download scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest explicitly says the skill is not applicable to video downloading, but this response schema documents play_addr as both a playback address and a video download address. Exposing download-oriented output broadens the behavior beyond the stated read/search-only use case.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill promotes collecting and exporting Douyin comment data for analysis without a clear privacy notice that comment text may include personal, sensitive, or harmful content. Even if the data is publicly accessible, bulk collection and structured export materially increase privacy and compliance risk by making large-scale analysis and redistribution easier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README explicitly says the tool auto-generates JSON logs for exported data, but it does not clearly warn that scraped public content and comments may still contain personal or sensitive information that will be stored on disk. This can lead to unintended local retention, over-sharing, or secondary misuse of collected data, especially in team or marketing workflows where logs may be copied or uploaded elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly supports bulk collection of Douyin comment data but provides no warning, limitation, or handling guidance for potentially privacy-sensitive user-generated content. In this skill context, scraping public comments at scale can facilitate profiling, dataset building, or downstream misuse of personal data, making the omission materially risky even if the source is publicly accessible.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code sends a skill token and user-provided search keyword to a remote API via requestApi, which is a network operation involving potentially sensitive user or system data. Although the functions have developer docstrings, there is no user-facing confirmation, warning, or visible disclosure in this file that such data will be transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The GET request includes the token, keyword, and other search parameters in a remote API call. For code files, network transmission of user or system data should have some form of user disclosure, but this file only contains developer-oriented comments and no user-visible warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI writes fetched Douyin comment data to a local JSON file automatically, but this file contains user-requested content that may include personal data, sensitive opinions, or regulated content from third parties. Silent persistence increases the risk of unintended disclosure through shared machines, backup systems, logs, or later exfiltration, especially because the skill is explicitly designed to scrape and export platform data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file contains natural-language descriptions and user-visible messages in Chinese, indicating the skill is designed to communicate in a single language only. The file does not provide any opt-in, fallback, or justification that the skill is intentionally limited to a Chinese-language or region-specific audience.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI persists the full fetched Douyin results to a local JSON file after printing them, creating an undisclosed secondary data store. Even if the source content is public, bulk collection plus local retention increases privacy, compliance, and data exposure risk because scraped data may contain usernames, comments, or other metadata that outlives the user’s immediate request and can be accessed by other local users or later processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file silently writes fetched results to a local JSON file without any user-facing warning in the command flow. That behavior violates least surprise and can expose collected platform data to unintended readers on the host, especially in shared environments, CI runners, or agent sandboxes where artifacts may be retained or uploaded automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code presents command descriptions, examples, warnings, and runtime messages entirely in Chinese, which imposes a specific language on users. The file does not offer any language selection, opt-in, or justification that this skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.