Security audit

guaikei-douyin-data-funnel

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does advertised Douyin data collection, but it needs Review because its triggers are broad, it automatically stores fetched social data locally, and some runtime behavior exceeds its own stated limits.

Install only if you are comfortable sending Douyin search terms, URLs, IDs, and your GUAIKEI_API_TOKEN to the provider API, and with search/post/comment results being saved automatically in the skill's logs directory. Use it only for explicit Douyin research tasks and delete logs when the collected public social data is no longer needed.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill documentation describes use of an environment variable token and network/API access, but the finding indicates these capabilities are not formally declared in permissions metadata. Undeclared access to secrets from the environment reduces transparency and can bypass user or platform expectations about what the skill is allowed to read, especially because the token is sensitive authentication material.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented behavior does not match the observed behavior: results are written to local logs despite 'pure JSON' framing, and retry behavior is broader than advertised. This is dangerous because users may assume transient stdout-only handling while the skill persists potentially sensitive query data locally, and excessive retries can increase unintended API usage or operational impact beyond what users consented to.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI persists fetched Douyin results to a local JSON file after already printing them, which contradicts the stated 'pure JSON' behavior and creates an undisclosed data-at-rest copy. In a data-collection skill handling user, post, comment, or trend data, silent persistence increases the risk of unintended retention, later disclosure, or collection by other local processes.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI writes full search results to a local log file even though the skill is described as producing pure JSON output. Persisting potentially sensitive query terms and returned content to disk creates an unintended data-retention surface: other local users, processes, backups, or log collectors may access data that callers expected to remain ephemeral.

Vague Triggers

High

Confidence: 91% confidence
Finding: The generalized trigger allows this skill to activate for broad research requests even when the user did not mention Douyin. Overbroad activation is risky because it can cause the agent to route unrelated tasks into external data collection, prompting unnecessary network access, token use, and collection of third-party content outside the user's clear intent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README maps very broad natural-language phrases like “搜索 / 搜一下 / 找 …” directly to command execution. In an agent setting, these triggers overlap with ordinary conversation and can cause the skill to run unintentionally when a user is discussing Douyin content rather than explicitly requesting tool use. Because the commands can fetch third-party data at scale, accidental invocation can lead to unwanted external requests, quota consumption, and privacy/compliance issues.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The intent-recognition rules rely on generic keywords such as “热搜 / 热点 / 榜单 / 搜索 / 评论 / 视频” with limited scope constraints, and the document itself notes ambiguity around terms like “视频.” In an LLM-driven agent, such underspecified routing rules can misclassify normal user text and dispatch the wrong CLI, causing unintended collection of account, comment, or trend data. The skill context increases risk because each route performs external data retrieval and may process user-supplied URLs or identifiers.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The CLI persists fetched comment data to a local JSON file automatically after successful execution, but gives no clear warning, consent prompt, or opt-out before storing potentially sensitive or regulated content. In this skill’s context, the data includes user-generated comments and associated metadata from social media, so silent persistence increases privacy, compliance, and data-handling risk on shared systems or in automated pipelines.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The tool writes fetched results to a local JSON file without explicit user notice or consent, creating hidden persistence beyond the requested CLI response. Given the skill's purpose is data funneling and analysis over potentially sensitive user/content datasets, this makes the behavior more dangerous because operators may assume outputs are ephemeral while copies remain on disk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.