T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-data-funnel
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Douyin public-data purpose, but Review is warranted because its credential handling, broad activation guidance, and auth-error messaging create material user risk.
Review before installing. Use a dedicated, revocable GUAIKEI_API_TOKEN with limited quota, assume supplied Douyin URLs/keywords and result data go to guaikei.com, and check or delete local logs after use because they may contain public user identifiers, comments, and monitored topics. Be aware the skill may trigger for broad research unless constrained to explicit Douyin tasks.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:23- Finding
Authentication Failures Emit Undisclosed Promotional Contact Information
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (53)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Claiming pure JSON output while generating Markdown or human-readable status text is a material interface mismatch for automation. In security-sensitive pipelines, parsers may fail open, mis-handle error states, or log unintended content, especially when behavior differs from declared expectations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill explicitly depends on an environment variable (
GUAIKEI_API_TOKEN) and network access, but the manifest does not declare an explicit tool scope such aspermissionsorallowed-tools. This weakens least-privilege controls and makes the runtime capabilities less auditable, increasing the chance that the skill can access sensitive environment data beyond what reviewers expect.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generalized trigger says the skill should activate for broad, unspecified research tasks even when the user does not explicitly mention Douyin. Over-broad triggering can cause the agent to invoke data-collection behavior unexpectedly, increasing the risk of unauthorized external queries, privacy issues, and scope creep in multi-step workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
L157 states '纯中文界面', which imposes a specific language/locale requirement. The file does not indicate user opt-in, alternative language support, or a clearly documented policy reason that would justify forcing Chinese for all users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This JSON schema contains user-facing title and description fields entirely in Chinese, including field descriptions, which imposes a specific language/locale in natural-language content. The file does not indicate that Chinese is optional, configurable, or required for a documented region-specific purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README states that collected Douyin data and task results are automatically exported as JSON logs into a local
logsdirectory, but it does not clearly warn that the stored content may include potentially sensitive data such as user identifiers, comments, or monitoring results. In this skill context, that omission increases the risk of unintended retention, accidental sharing, or secondary misuse of scraped public data, especially when used for competitor monitoring or public-opinion analysis at scale.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The natural-language text in the file is entirely in Chinese, including module and function descriptions, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata promises '输出纯 JSON', but this CLI mixes machine-readable JSON with banners, status lines, help text, and success/error messaging, and also persists outputs to disk. In automation pipelines, this can break downstream parsers, cause accidental data disclosure through unexpected console/log channels, and violate caller assumptions about output handling.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI writes fetched comment data to a local JSON file even though its stated role is data retrieval and JSON output. Persisting potentially sensitive or regulated user-generated content to disk expands the data exposure surface, leaves residual artifacts, and may surprise operators who expected transient processing only.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Comment results are silently written to a local file without a clear warning in this file, creating an unexpected secondary sink for potentially sensitive content. This is dangerous in shared environments, CI runners, or agent sandboxes where local artifacts may be indexed, uploaded, or exposed to other users/processes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's user-facing strings, comments, and status messages are consistently in Chinese, and there is no indication that the user can select another language or that the skill is intentionally limited to a Chinese-only audience. This creates a natural-language policy concern because the skill effectively enforces a specific language without opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The script reads an API token from the environment and then sends the normalized URL and limit to remote API methods
createPostTaskandgetPostTask. Although network access is central to the tool's function, this file does not explicitly warn the user that their provided target URL and authenticated request data will be sent to an external service.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI persists fetched Douyin results to a local JSON file after already emitting them to stdout, which contradicts the stated pure-JSON/output-only behavior and creates an undeclared secondary data sink. If results contain sensitive competitive intelligence, user/profile data, or monitored content, they may remain on disk longer than expected and be exposed to other local users, backup systems, or later exfiltration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill writes full result data to a local file without any explicit in-file warning or opt-in, creating unexpected persistence of potentially sensitive scraped/query data. This increases privacy and data-governance risk because users may believe the command only returns JSON to stdout while the tool silently leaves recoverable artifacts on disk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill metadata promises pure JSON output, but the CLI prints banners and status lines before and after the JSON result. In agent pipelines that expect machine-readable JSON, this can break parsers, cause downstream mis-execution, or let untrusted text be mixed into data channels that higher-level tools may treat as structured output.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI writes search results to a local log file using a filename derived from user-controlled keyword data, while the stated purpose is only to query and return data. This creates unnecessary data persistence that may leak sensitive searches or collected results to disk, and the keyword-derived filename can also introduce file-handling risks if sanitization is incomplete.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a Douyin data query skill that provides pure JSON output for analytics use cases. This file implements filesystem-based logging and emits console success/error text, which is behavior outside a strictly JSON-only data output contract.
- Content
Static analysis
No suspicious patterns detected.