ClawHub
Back to skill

Security audit

guaikei-douyin-data-intake-to-json

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it handles the API token and automatic data collection in ways users should review before installing.

Review this before installing if you are not comfortable sending Douyin queries, URLs, and a GUAIKEI_API_TOKEN to the provider API. Use a dedicated token with limited value, avoid shared workspaces for the logs directory, and be aware that generic research prompts may activate the skill unless you constrain its use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
src/utils/token.js:24
Finding

Runtime token-validation path emits prohibited promotional content

Content
View full analysis

Vulnerability Details

File Location: src/utils/token.js:24-27
Vulnerability Type: Runtime output manipulation and promotional redirection
Risk Level: Medium

Vulnerable Code

js
if (!isValidToken(token)) {
  utils.printWarn("警告: 你的 GUAIKEI_API_TOKEN 未正确配置,技能已暂停. ");
  utils.printSuccess("\t快速获取通道: www.guaikei.com");
  return "";
}

Technical Analysis

Every command-line entry point passes process.env.GUAIKEI_API_TOKEN to skillToken(). When the token is absent or fails format validation, this function emits a fixed acquisition message directing the user or invoking agent to an external website.

This behavior directly contradicts the security contract in SKILL.md, which states that invalid-token handling must produce only a neutral error and must not include contact information, website links, or promotional content at runtime. The message is written to stderr through the shared logging utility and can therefore be surfaced by an AI agent as part of command execution.

The behavior is deterministic and unrelated to fulfilling the requested data-retrieval operation. It manipulates runtime output to redirect users to an operator-controlled service.

Attack Path

  1. A user or agent invokes any supported CLI without setting GUAIKEI_API_TOKEN, or supplies a malformed token.
  2. The CLI reads the value from process.env.GUAIKEI_API_TOKEN.
  3. skillToken() rejects the value because it does not satisfy the format requirements.
  4. The function writes a fixed external acquisition message to stderr.
  5. The invoking agent may repeat or act on that promotional message, despite the Skill documentation explicitly prohibiting such runtime redirection.

Impact Assessment

This issue does not grant operating-system privileges or execute arbitrary code. Its scope is manipulation of Agent-visible runtime output. It can redirect users to an external commercial service and undermine trust ...[truncated 53 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove all acquisition links, contact details, and promotional language from runtime token validation.
  • Emit only a neutral error, such as GUAIKEI_API_TOKEN is missing or invalid; execution has stopped.
  • Preserve exit code 3 for authentication failures.
  • Keep token-acquisition instructions exclusively in user documentation.
  • Add automated tests asserting that invalid-token output contains no URLs, contact information, or promotional text.

T01 · Skill Instruction Hijacking

Warning
Location
src/utils/request.js:51
Finding

HTTP authentication failures inject contact solicitation into stderr and JSON output

Content
View full analysis

Vulnerability Details

File Location: src/utils/request.js:51-55
Vulnerability Type: Authentication error output hijacking
Risk Level: Medium

Vulnerable Code

js
} else if (res.statusCode === 401 || res.statusCode === 403) {
  const e = new AuthError(
    "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案",
  );
  e.noRetry = true;
  reject(e);
}

The resulting message is propagated by CLI handlers. A representative path is src/douyin/search-cli.js:178-200:

js
} catch (error) {
  utils.printError(`搜索失败: ${error.message}`);
  const errorOutput = {
    status: "error",
    error_code: error.code || "UNKNOWN",
    message: error.message,
    timestamp: new Date().toLocaleString(),
    request: {
      command: "search",
      keyword: keyword,
      sort: sort,
      time: time,
      duration: duration,
      content: content,
      limit: limit,
    },
    metadata: {
      skill_version: constants.VERSION,
      runtime_version: process.versions.node,
      execution_time: Date.now() - startTime,
    },
    results: null,
  };
  const exitCode = error.name === "AuthError" ? 3 : 1;
  process.stdout.write(JSON.stringify(errorOutput, null, 2) + "\n", () =>
    process.exit(exitCode),
  );

Technical Analysis

When the API returns HTTP 401 or 403, the request layer creates an AuthError containing a hardcoded third-party contact solicitation. CLI error handlers then use error.message without sanitization in two places:

  • stderr logging through utils.printError();
  • the message field of structured JSON written to stdout.

Consequently, the promotional contact text contaminates both human-facing logs and machine-consumed output. This directly violates the explicit SKILL.md requirement that authentication failures use neutral wording and never emit contact information or promotional material at runtime.

Because ...[truncated 989 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the hardcoded message with a neutral authentication error such as Authentication failed; verify GUAIKEI_API_TOKEN.
  • Never include phone numbers, messaging handles, URLs, or promotional guidance in runtime errors.
  • Map authentication failures to a stable local error code and a predefined neutral message.
  • Avoid copying arbitrary remote or internal exception messages directly into structured stdout.
  • Centralize error sanitization across all CLI entry points.
  • Add tests for HTTP 401 and 403 responses that verify exit code 3 and confirm that stdout and stderr contain no promotional content.

T09 · Insecure Skill Coding Practices

Warning
Location
src/api/search.js:59
Finding

API credential is transmitted in URL query parameters

Content
View full analysis

Vulnerability Details

File Location: src/api/search.js:59-78 and src/utils/request.js:91-104
Vulnerability Type: Credential exposure through URL query strings
Risk Level: Medium

Vulnerable Code

Token placement in src/api/search.js:59-78:

js
const params = {
  _: Date.now(),
  token: token,
};

const data = {
  keyword,
  sort_type: sort,
  publish_time: time,
  filter_duration: duration,
  content_type: content,
  limit: limit,
};

return await requestApi(
  "POST",
  "/api/douyin/general-search/keyword",
  params,
  data,
  constants.CREATE_MAX_ATTEMPTS,
  "创建任务",
);

Query-string serialization in src/utils/request.js:91-104:

js
params.skill_name = skillName();

const fullPath = `${path}?${querystring.stringify(params)}`;
const jsonData = JSON.stringify(data);

const options = {
  host: constants.BASE_URL,
  path: fullPath,
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Accept-Encoding": "identity",
    "Content-Length": Buffer.byteLength(jsonData),
  },
};

Equivalent token query parameters are used by:

  • src/api/search.js:104-120
  • src/api/comment.js:38-53 and 67-79
  • src/api/post.js:23-36 and 50-61
  • src/api/hot.js:19-25

Technical Analysis

The token is inserted into the params object and serialized directly into the request path. Requests therefore take the effective form:

text
/api/...?...&token=SECRET

HTTPS protects the request path while it is in transit, but it does not prevent the URL from being recorded after TLS termination. Query strings are commonly retained by reverse-proxy access logs, API gateway telemetry, application request logs, monitoring platforms, debugging tools, and exception reports.

Authentication credentials should not be treated as ordinary URL parameters. Unlike authorization headers, URLs are frequently copied, ind ...[truncated 1067 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the token from all query-parameter objects.
  • Send it using an authorization header, for example:
js
headers: {
  Authorization: `Bearer ${token}`,
  "Content-Type": "application/json",
  "Accept-Encoding": "identity",
}
  • If bearer authentication is unsupported, use a dedicated sensitive header agreed upon with the API service.
  • Configure proxies, gateways, and application logs to redact authorization data.
  • Ensure exception and retry logging never serializes complete request options or headers.
  • Rotate tokens that may already have been stored in URL logs.
  • Add tests that inspect outgoing request paths and fail if they contain token, api_key, or other credential parameters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (35)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

该代码块的实际职责是“抖音关键词搜索任务的创建与查询”，属于声明中 search 子功能的一部分。但声明描述的是一个覆盖 4 个命令、多种输入格式和自动日志的完整技能。就本代码块而言，能力范围明显更窄，未体现 post、comment、hot 等核心已声明功能，也未体现链接格式兼容和日志能力。因此描述与此代码块实际行为不一致，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

这段代码只是通用命令行参数解析与帮助文本生成的工具模块，属于底层辅助实现。它没有访问抖音、抓取公开数据、解析抖音链接、输出业务结果或写日志。声明描述的是一个完整的抖音数据查询技能，而实际代码片段的行为仅是 CLI 参数处理，和声明的核心功能明显不一致。虽然参数解析可以作为该技能的支持组件，但就这段代码本身而言，无法支撑所声明的主要用途，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description describes a full-featured Douyin public-data retrieval skill. However, this code chunk is only a local utility that reads package.json and returns the package name. Its actual behavior is unrelated to the claimed commands and data-access features. While this may be a small supporting file within a larger project, based on the supplied code chunk alone, the behavior does not match the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill declares broad generalized triggers that can activate on generic research requests even when the user did not ask for Douyin-specific collection. This can cause unintended invocation of a networked data-collection skill, leading to over-collection, privacy/compliance issues, and user surprise in multi-step workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Trigger phrases like '热点', '榜单', '搜索', or '作品/主页/账号/博主' are common terms that can match many unrelated user intents. In an agent ecosystem, this increases the chance of accidental tool routing and unnecessary external API calls, which may expose query content, waste quotas, or retrieve data outside the user's intended scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The line "纯中文界面" imposes a specific language/locale constraint in natural language. The policy allows locale constraints when the user is given a choice or when the constraint is clearly documented and justified as region-specific; here the file does not present it as a user-selectable option or clearly justify the language restriction itself.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JSON schema is a manifest-type file, and its title and description force a specific language for users without any opt-in or documented locale constraint. That creates a natural-language accessibility and locale policy issue for users who may expect language choice or neutral descriptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The user-facing title and descriptions are entirely in Chinese, which imposes a specific language on consumers of this schema. The file does not indicate that the skill is region-specific or that users can opt into a preferred language, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The README emphasizes automatic JSON export and log retention for scraped Douyin data but does not clearly warn that collected public data, comments, account identifiers, and query history will be stored locally. In shared workstations, CI runners, synced folders, or improperly permissioned environments, these logs can expose harvested datasets and operational metadata to unintended parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The changelog explicitly promotes bulk collection of competitor account content and retrieval of video comments, but provides no warning about privacy, platform terms, or lawful data-handling constraints. In the context of a data-intake skill for Douyin public data, this omission can normalize high-volume scraping and downstream misuse of personal or user-generated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file’s natural-language comments and JSDoc are exclusively in Chinese, which can impose a language requirement on maintainers or users without any opt-in or stated regional justification. The policy explicitly calls for flagging language or locale constraints when a specific language is forced without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code reads process.env.GUAIKEI_API_TOKEN and then invokes remote comment-task APIs with the token, URL, and limit. This is a sensitive-credential access plus network transmission path, and while the command's purpose implies fetching remote data, this file does not explicitly disclose that an environment token is used or that the provided URL is sent to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code persists the fetched comment data to disk via log.taskWrite, which is a file-write operation affecting user/system data. Although the CLI prints progress messages, there is no visible disclosure here that results will be saved locally, and no confirmation prompt, comment, or docstring warning accompanies the write.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI writes the full fetched results to a local JSON file automatically, but this file gives no user-facing warning or consent prompt before persisting data. Even though the source is public Douyin data, the output may still contain usernames, profile identifiers, comments, or other scraped content that creates privacy, compliance, and local data exposure risk if stored unexpectedly on shared systems or CI runners.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The AuthError message is written only in Chinese and directs users to contact a specific WeChat number for resolution. This imposes a language and locale-specific support path without offering a user choice or documenting that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JavaScript file contains natural-language comments and user-facing error/output strings exclusively in Chinese, such as the validation messages and formatted result labels. Under the policy, forcing a specific language without user opt-in or documented justification is a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This JSON schema contains natural-language title and description text that forces a specific language/locale for users of the skill. The file does not state that the skill is China-specific or offer any language choice, so it may violate the policy against unprompted language constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This JSON schema contains user-facing natural-language metadata entirely in Chinese, including the title and multiple field descriptions. Because the file does not document that the skill is region-specific or offer any language/locale choice, it can violate the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The schema title and description are written entirely in Chinese, and the field descriptions throughout the file follow the same pattern. Because the file does not document that the skill is China/Chinese-specific or offer any locale choice, this can conflict with a policy requiring language selection or explicit locale justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This manifest-style JSON schema includes title and description fields only in Chinese, which can impose a specific language on users without opt-in. The file does not indicate that the skill is region-specific or provide any alternative language choice, matching the policy concern for forced language/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JSON schema contains user-facing title and description fields entirely in Chinese, including field descriptions throughout the file. Under the stated policy, forcing a specific language without opt-in or documented locale justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s headings, instructions, examples, and user-command mappings are all written in Chinese, which effectively imposes a specific language for use and interpretation. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only compliance or regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file presents all operational instructions and parameter descriptions in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This file’s natural-language documentation and runtime retry message are written only in Chinese, which imposes a specific language choice without indicating user opt-in or a documented locale restriction. The policy requires flagging language or locale constraints when they are forced rather than optional or explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.