T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:85- Finding
API Token Exposed in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-data-grabber
Security checks for vulnerabilities and agentic risk
Overview
This Douyin public-data skill is mostly coherent, but it needs review because it mishandles the API token and emits undisclosed promotional contact text during authentication failures.
Install only if you are comfortable sending Douyin URLs, keywords, and your GUAIKEI API token to the guaikei.com service and having collected results saved locally under logs/. Treat the token as sensitive, rotate it if exposed, and review or delete saved JSON outputs that contain comments or user identifiers.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
other
Warning
- Location
src/utils/request.js:50- Finding
Runtime Authentication Error Injects an Undisclosed Promotional Contact
- Content
View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis `SKILL.md` explicitly states that invalid-token errors must be neutral and that contact information, external links, and promotional content must not be emitted during execution. The implementation contradicts that security declaration by hardcoding a WeChat contact in the HTTP 401/403 error path. The CLI then copies `error.message` directly into stderr and the JSON response on stdout. Consequently, downstream agents and automated consumers receive and may repeat the promotional message. This is not session-level instruction hijacking because i ...[truncated 1305 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/retry.js:12- Finding
Query Operations Can Retry Up to Twenty Times Despite a Documented Three-Attempt Limit
- Content
View full analysis
setTimeout(resolve, delay)); } } } throw lastError || new Error(`Operation failed after ${maxAttempts} retries`); } ``` The hot-list operation passes the twenty-attempt setting directly to this wrapper: ```js async function getHotTask(token) { return await withRetry( async () => { const res = await getJson("/api/douyin/hot-search", { _: Date.now(), token: token, }); return res.data; }, constants.QUERY_MAX_ATTEMPTS, (attempt, err) => { utils.printError( `Hot-list retry ${attempt + 1}/${constants.QUERY_MAX_ATTEMPTS}: ${err.message}`, ); }, ); } ``` The same query-attempt constant is also used by the search, comment, and post result-retrieval operations. ### Technical Analysis The documentation states that network failures should stop after no more than three attempts. The implementation instead allows query operations to make up to twenty attempts. Delays begin at two seconds, grow exponentially, and are capped at sixty seconds per dela ...[truncated 1577 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (41)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
该代码片段仅包含
parseArgs、readValueAfterFlag和buildHelp等通用参数解析/帮助文本生成功能，属于基础支持工具。它不访问任何抖音相关资源，也不执行搜索、抓取、分析或热点查询。按照评估标准，虽然支持性实现细节本身不一定构成问题，但这里提供的代码片段的实际行为与声明的核心目的相差过大：声明描述的是一个面向抖音内容运营与竞品/评论/热点分析的技能，而代码仅是无业务语义的 CLI 工具模块。因此应判定为描述与行为不匹配。- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是面向抖音数据采集与分析的业务能力，而提供的代码片段只是一个通用日志写入辅助模块，没有任何抖音关键词搜索、账号作品抓取、评论拉取或热榜查询相关逻辑。虽然日志功能可能作为内部支持实现存在，但该代码片段本身的主要行为与声明的技能用途明显不一致，并且涉及未声明的本地文件系统写入能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向抖音数据采集与运营分析的技能，核心能力应涉及外部平台数据查询或处理。但提供的代码片段仅通过 fs/path 读取本地 package.json 并返回 name 字段，没有体现任何抖音相关功能、网络请求、数据抓取、评论分析或热榜查询逻辑。虽然这可能是某个辅助函数，但就该代码片段本身而言，其实际行为与声明用途明显不一致，因此应判定为存在描述与行为不匹配。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill should trigger even when the user does not explicitly mention Douyin, for broad categories like topic research or competitor analysis. That overbroad activation boundary can cause the agent to invoke external data collection unexpectedly, leading to unintended network access, token use, and collection of third-party platform data outside the user’s clear request.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generalized trigger guidance for multi-step research tasks is ambiguous and encourages implicit activation during broad research requests. In an agent setting, ambiguous auto-invocation is dangerous because it can silently expand scope from analysis to external scraping/API calls, which may surprise users and violate least astonishment or data-use expectations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill explicitly relies on the environment variable
GUAIKEI_API_TOKEN, but the manifest does not declare any tool scope or permission boundary for environment access. This creates a capability mismatch: the runtime may expose secrets more broadly than intended, and reviewers cannot verify least-privilege constraints from the skill definition alone.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON schema is a manifest/config-type file, so SQP-3 applies. The title and descriptions throughout the schema are written exclusively in Chinese, which imposes a specific language/locale on downstream user-facing documentation or tooling without any opt-in or stated regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON schema contains user-facing natural-language titles and descriptions exclusively in Chinese, such as the title and property descriptions. Under the language/locale policy, forcing a specific language without opt-in or documented justification is a policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The README is entirely written in Chinese and the natural-language instruction mapping and intent rules are defined only for Chinese phrases, implying operation is constrained to a specific language/locale. The file does not offer an opt-in language choice or document the locale restriction as a justified region-specific requirement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README states that scraped Douyin data is automatically exported to JSON log files, including comments and account-related outputs, but it does not provide clear privacy, retention, access-control, or sanitization guidance. Because the skill is specifically designed for bulk collection of public social-media data, these logs can accumulate personal data or sensitive content and be mishandled, shared, or retained longer than intended.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI persists fetched Douyin comment data to a local JSON file after printing results, even though the visible skill description emphasizes retrieval and analysis rather than local storage. Comment content may contain personal data, usernames, or sensitive business research artifacts, so silently retaining it on disk increases privacy and data-handling risk, especially on shared machines or multi-tenant environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code contains user-facing natural-language strings exclusively in Chinese, including status, error, and success messages. Under the policy rule for language/locale, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code writes the full task output to a local JSON file via
log.taskWrite, but there is no nearby user-facing warning, confirmation, or explanatory comment that results will be persisted to disk. Because the output includes request details and fetched results, users may not realize their queried data is being stored locally.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI writes full search output to a local log file using a filename derived from user-controlled keyword input, without an explicit warning or consent at the write site. In this skill's context, results may contain sensitive research queries or collected platform data, creating a privacy and data-retention risk if logs are stored insecurely, shared, or harvested from disk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code emits all validation and status messages in Chinese, including error strings and success output. For a general utility file, this hard-codes a specific language without any visible user opt-in or documented locale limitation, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing strings at L25-L30 are exclusively in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is region-specific. This matches the language/locale policy violation category because the file contains natural-language output that does not offer a language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language strings in the schema are entirely in Chinese, including the title and parameter descriptions, with no indication that the skill is region-specific or that users can choose another language. This creates a locale/language policy concern because the file imposes a specific language without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON schema contains user-facing natural-language titles and descriptions only in Chinese, such as the title and property descriptions. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The schema title and field descriptions are written entirely in Chinese, which imposes a specific language/locale in natural-language metadata. Because the file does not indicate that this is a China-specific or Chinese-only skill, and it offers no user opt-in or language choice, this is a natural-language policy concern under the locale/language rule.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON schema uses only Chinese natural-language titles and descriptions for the skill inputs, which can amount to a language/locale policy constraint if users are not given an explicit choice. There is no indication in the schema that the skill is region-specific or that the language restriction is intentional and documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This manifest-format file contains user-facing title and description strings entirely in Chinese, with no indication that the skill is region-specific or that another language is optional. Under the policy rule, forcing a specific language/locale without documented opt-in or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file uses Chinese throughout, which can impose a language constraint on users without any stated opt-in or justification. Under the natural-language policy rule, forcing a specific language without user choice can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all user-facing instructions and parameter descriptions in Chinese only. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 64% confidence
- Finding
Natural-language comments and parameter descriptions in the file are written exclusively in Chinese, including module and function descriptions. If these strings are surfaced to users or maintainers in a broader multilingual context, this can constitute a language policy issue because no language choice or justification is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The functions createCommentTask and getCommentTask send a token and video URL to external API endpoints via requestApi. Although the code has developer-facing docstrings, there is no visible confirmation prompt, user-facing disclosure, or warning in this file that user data and credentials are being transmitted over the network.
- Content
Static analysis
No suspicious patterns detected.