Security audit

guaikei-douyin-deep-comments

Security checks for vulnerabilities and agentic risk

Overview

This Douyin analytics skill mostly matches its stated purpose, but it needs review because it handles tokens and collected data in ways that are under-scoped and contradicts its own neutral-error promise.

Install only if you are comfortable sending Douyin keywords, profile/video URLs, and your GUAIKEI_API_TOKEN to the provider service, and storing fetched public comments/profile data locally in plaintext logs. Treat the token like a password, rotate it if exposed, avoid bulk collection without checking platform and privacy obligations, and review runtime auth errors because the code can display provider contact or website text despite claiming it will not.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/token.js:23
Finding: Authentication failures inject prohibited promotional content into Agent-visible output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:102
Finding: Reusable API token is transmitted in URL query strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/utils/log.js:25
Finding: Fetched search, post, and comment data is automatically persisted in plaintext
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (49)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill states that logs are automatically written to a local logs/ directory, while the description emphasizes token safety and minimal permissions without clearly scoping filesystem use. Unnecessary local logging in a data-collection skill can capture URLs, query terms, comment content, and potentially sensitive operational context, increasing leakage risk if log content is not minimized and controlled.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill states that logs are automatically written to a local logs/ directory, while the description emphasizes token safety and minimal permissions without clearly scoping filesystem use. Unnecessary local logging in a data-collection skill can capture URLs, query terms, comment content, and potentially sensitive operational context, increasing leakage risk if log content is not minimized and controlled.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that logs are automatically written to a local logs/ directory, while the description emphasizes token safety and minimal permissions without clearly scoping filesystem use. Unnecessary local logging in a data-collection skill can capture URLs, query terms, comment content, and potentially sensitive operational context, increasing leakage risk if log content is not minimized and controlled.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill states that logs are automatically written to a local logs/ directory, while the description emphasizes token safety and minimal permissions without clearly scoping filesystem use. Unnecessary local logging in a data-collection skill can capture URLs, query terms, comment content, and potentially sensitive operational context, increasing leakage risk if log content is not minimized and controlled.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that logs are automatically written to a local logs/ directory, while the description emphasizes token safety and minimal permissions without clearly scoping filesystem use. Unnecessary local logging in a data-collection skill can capture URLs, query terms, comment content, and potentially sensitive operational context, increasing leakage risk if log content is not minimized and controlled.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill states that logs are automatically written to a local logs/ directory, while the description emphasizes token safety and minimal permissions without clearly scoping filesystem use. Unnecessary local logging in a data-collection skill can capture URLs, query terms, comment content, and potentially sensitive operational context, increasing leakage risk if log content is not minimized and controlled.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill explicitly relies on the environment variable GUAIKEI_API_TOKEN but does not declare a corresponding tool scope or permissions boundary. That creates an authorization/visibility mismatch: the runtime may expose environment access more broadly than intended, making secret handling less auditable and increasing the chance of accidental token exposure or unauthorized use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill's implicit triggers are broad enough to match generic content-research requests, which can cause accidental invocation of a Douyin scraping/data-collection workflow when the user did not clearly request that platform. Unintended invocation matters because the skill uses an API token, performs external data retrieval, and may log activity locally, so a trigger mistake can lead to unnecessary data access and token-backed actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Several trigger phrases such as broad research or trending requests are too generic to safely route execution to this skill. In an agent environment, ambiguous triggers can cause over-broad activation, leading to unintended external requests, local logging, and use of stored credentials without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest explicitly says the skill is not suitable for downloading videos or watermark removal, but this response schema defines video_url as including both playback and download addresses. Exposing download URLs expands the apparent behavior beyond comment/research use into content retrieval capability that the manifest disclaims.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest says the skill is not applicable for downloading content, but this response schema explicitly describes play_addr as both a playback address and a '视频下载地址' (video download address). That broadens the advertised behavior from search/comment/hotlist analysis into content download facilitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill description and user-facing instruction mapping are written only in Chinese, with no indication that users may interact in another language or that the locale restriction is intentional and justified. Under the language/locale policy criterion, this is a natural-language constraint that should either be optional or explicitly documented as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly promotes exporting scraped Douyin video, author, and comment data to local JSON logs but does not provide any privacy, retention, access-control, or sanitization guidance. Because comment and account data can contain personal information or sensitive public-profile data, this omission can lead users to store, reuse, or share collected data insecurely, increasing privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file documents how to retrieve large volumes of a creator's posts, including up to 10,000 items, but provides no caution about surveillance, profiling, or platform-impact concerns. In the context of an analytics skill, this lowers friction for mass collection and competitive intelligence in ways that may violate expectations or platform rules.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This documentation explicitly enables bulk retrieval of Douyin comment data without any warning about privacy, consent, rate limiting, or platform terms. Comment scraping can expose personal data, enable profiling or harassment, and increase legal/compliance risk when packaged as a ready-to-use skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code sends a skill token and user-provided video URL to an external API via requestApi, which is a network operation involving potentially sensitive data. While the function has developer-facing docstrings, there is no user-facing warning, confirmation, or visible disclosure in this file that these values are transmitted off-box.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The getCommentTask function performs a GET request that includes the token and URL in request parameters, transmitting user/system data to a remote service. The file does not include a user-facing warning, confirmation, or other disclosure that this query shares those values externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code sends a token and user-provided keyword to remote API endpoints via requestApi in both the task-creation and task-query paths. Although the functions have technical docstrings, there is no user-facing warning, confirmation, or disclosure in this file that search terms and authentication data are being transmitted over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This CLI emits user-facing error and success messages entirely in Chinese, including status text and messages in the JSON output. Because the file provides no user opt-in, language selection, or documented justification for a Chinese-only locale, it violates the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code reads process.env.GUAIKEI_API_TOKEN and then uses it in createPostTask and getPostTask, which implies credential handling and network/API communication. The file lacks an explicit warning or comment informing users that an environment token is consumed and requests are sent to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI writes the full fetched results to a local JSON file without any visible consent, opt-in, or retention control. Retrieved post metadata may include sensitive research outputs or collected content, and persisting it locally increases exposure to unintended disclosure via shared machines, backups, or later compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill silently saves result data to a local file after printing it, creating undisclosed persistence of collected data. Even if the data is not highly sensitive by design, silent storage can violate user expectations and expand the attack surface through local file access and forensic recovery.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JavaScript file contains natural-language comments and user-facing error/help messages entirely in Chinese, including thrown errors and generated help text. Because the file provides no opt-in, language selection, or documented locale restriction, it appears to enforce a specific language, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code emits user-facing error strings only in Chinese, and later also uses a Chinese success/error message. This imposes a specific language on users without any visible opt-in, fallback, or documented region-specific justification, which matches the locale-policy concern for natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The success and failure messages shown to users are hard-coded in Chinese only. Because the file provides no mechanism for language selection or documented locale restriction, this is a natural-language policy issue rather than a code-security flaw.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.