Security audit

guaikei-douyin-data-getter

Security checks for vulnerabilities and agentic risk

Overview

The skill does retrieve Douyin public data as advertised, but it has review-worthy issues around broad automatic triggering, API-token handling, and runtime messages that contradict its own safety rules.

Review this skill before installing. It sends Douyin queries, target URLs, and your GUAIKEI_API_TOKEN to guaikei.com, saves successful results locally under logs, and may trigger on broad research requests unless your agent is careful. Use a scoped/rotatable token, avoid sensitive research targets in shared environments, and treat runtime support links or contact details as untrusted because the implementation contradicts its own neutral-error policy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/token.js:23
Finding: Authentication failures inject hardcoded promotional content into runtime output
Content: View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis Authentication failure paths deliberately add a service-acquisition URL or a WeChat contact to runtime output. This conflicts directly with the Skill's own security requirements in `SKILL.md:37-40`, which state that invalid-token errors must be neutral and must ...[truncated 1488 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:92
Finding: API authentication token is transmitted in URL query strings
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/request.js:27
Finding: Untrusted remote API error messages are propagated into agent-visible JSON
Content: View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis The API server controls `jsonBody.errmsg`. The Skill treats that field as a trusted local error message and exposes ...[truncated 1586 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/config/constants.js:16
Finding: Query operations retry authenticated failures up to twenty times contrary to the documented limit
Content: View full analysis
setTimeout(resolve, delay)); } } } throw lastError || new Error(`重试${maxAttempts}次后失败`); } ``` Query operations use the twenty-attempt value: ```js const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "查询任务", ); ``` The hot-list operation follows the same pattern: ```js async function getHotTask(token) { return await withRetry( async () => { const res = await getJson("/api/douyin/hot-search", { _: Date.now(), token: token, }); return res.data; }, constants.QUERY_MAX_ATTEMPTS, (attempt, err) => { utils.printError( `【获取抖音热榜重试】 ${attempt + 1}/${constants.QUERY_MAX_ATTEMPTS} 次 - ${err.message}`, ); }, ); } ``` ### Technical Analysis `SKILL.md` and `readme.md` descri ...[truncated 1605 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容检索与分析的技能，而提供的代码片段只是底层通用工具模块 src/utils/args.js，用于 CLI 参数解析和帮助文本生成。该代码没有实现任何抖音相关业务能力，也没有表现出 search、post、comment、hot 中任一项功能。虽然这类工具代码可能作为完整技能的辅助模块存在，但就该代码片段本身而言，其实际行为与声明用途存在明显偏离，属于主目的不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音数据检索与分析的技能，而实际代码片段只是一个本地日志写入辅助模块，没有体现任何 search/post/comment/hot 相关行为，也没有访问抖音内容、评论、热榜或账号数据。虽然日志功能可能是配套实现细节，但就该代码片段本身而言，其实际行为与声明的核心能力完全不一致，主要目的明显不同，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a user-facing Douyin analytics skill with multiple content-analysis capabilities. The supplied code chunk does not implement any of those behaviors; it is merely a helper that reads package.json from the local filesystem and returns the package name. While this could be a supporting utility in a larger project, based on the supplied chunk alone its actual behavior is unrelated to the declared purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly requires the GUAIKEI_API_TOKEN environment variable, but the manifest does not declare any tool scope or permission boundary for environment access. This creates a governance gap: reviewers and runtime policy cannot clearly constrain or audit the skill’s secret access, increasing the risk of unintended secret exposure or over-privileged execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Several trigger phrases and scenarios are generic enough to match ordinary conversation about research, trends, or analysis. This can lead to accidental invocation of the skill, causing unnecessary external calls and potentially exposing user queries to third-party services without sufficiently clear intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger guidance says the skill should activate even when the user does not mention Douyin, for broad requests like market research or topic exploration. Over-broad activation can cause the agent to invoke networked data-collection behavior unexpectedly, increasing the chance of data overreach, user surprise, and use of a platform-specific capability in the wrong context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The statement “纯中文界面” indicates a fixed language constraint. Under the policy, forcing a specific language without offering user choice or documenting a justified region-specific limitation is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly describes video_url as containing both playback and download addresses, which conflicts with the skill metadata stating it does not handle video publishing or downloading. In an agent ecosystem, this mismatch can enable downstream tooling or prompts to expose or rely on download functionality that the skill claims not to provide, increasing policy-bypass and misuse risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest explicitly states '不处理视频发布与下载' (does not handle video publishing or downloading). However, the response schema documents play_addr as both a playback address and a '视频下载地址', indicating the skill exposes download-capable data as part of its behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README explicitly promotes exporting scraped Douyin data to local JSON logs and the skill also supports collecting comments, which can include user-generated personal data or sensitive opinions. Storing this data by default without clear minimization, retention, access-control, or privacy warnings increases the risk of unintended disclosure, over-collection, and non-compliant handling of scraped data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's natural-language comments and API parameter descriptions are entirely in Chinese, describing a Douyin-specific skill without indicating that the language or locale is optional or region-scoped. Under the policy rule, language-specific behavior should either offer user choice or clearly document a justified locale constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI persists fetched comment data to a local JSON file without clearly disclosing that storage behavior in the skill description or obtaining user consent in this flow. Comment datasets can contain personal data, account identifiers, or sensitive business research targets, so silent retention increases privacy and data-handling risk if the host environment is shared or logs are later exfiltrated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The tool writes full comment results to a local file automatically and gives no warning or confirmation in this CLI path. In the context of a Douyin comment-analysis skill, this can unexpectedly retain user-generated content and research artifacts on disk, creating confidentiality and privacy exposure beyond the expected transient retrieval behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains user-facing natural-language strings entirely in Chinese, including status, error, and success messages. This enforces a specific language/locale without any visible user opt-in or configurable language selection, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code reads process.env.GUAIKEI_API_TOKEN, which is sensitive credential access. While the file includes internal logic and error handling, there is no visible confirmation prompt or user-facing warning in this file that the command depends on and accesses an environment-stored API token.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The command creates and fetches a remote post task via API calls and later writes the returned results to a local JSON file with log.taskWrite. Although success messages are printed, there is no explicit disclosure in the help text or comments that running the command will transmit the supplied Douyin URL to a remote service and persist the results locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments and CLI-facing strings entirely in Chinese, including error messages and help text. Under the policy rule for language/locale, forcing a specific language without user opt-in or documented justification is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file contains natural-language strings such as error messages in Chinese, and all visible user output in the shown code follows that locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not evident here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The function reports save success and write failure using Chinese-only strings, which imposes a specific language on users. The file does not show any mechanism for language selection, fallback, or documentation of a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The authentication error message is written only in Chinese and includes support instructions in that locale, with no indication of language choice or fallback. This can violate language/locale policy when the skill is not explicitly documented as China-specific or offering user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module comment and user-facing strings are entirely in Chinese, including the banner text identifying the assistant as '抖音数据智能分析助手'. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative locale or choice is offered.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema is a manifest/config-type file, so SQP-3 applies. The natural-language metadata in the title and descriptions is entirely in Chinese, which can constitute a language/locale policy violation when the skill does not offer user opt-in or explain that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title and field descriptions. For a general-purpose skill artifact, forcing a specific language without offering a user choice or documenting a locale-specific constraint can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The schema's human-readable title and description are written only in Chinese, which imposes a specific language for users or downstream tooling that surfaces this metadata. Under the language/locale policy, this is a natural-language constraint without any documented user choice or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The title and description fields, including property descriptions, are written only in Chinese, which constitutes a language/locale restriction in natural-language content. The file does not indicate that this schema is intentionally region-specific or offer any user language choice, so it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.