T01 · Skill Instruction Hijacking
Warning
- Location
src/utils/token.js:23- Finding
Promotional Redirection and Contact Information Injected into Authentication Error Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-deep-dive-collector
Security checks for vulnerabilities and agentic risk
Overview
This Douyin public-data collector is broadly coherent, but it needs Review because it mishandles the API token, auto-saves collected data, overbroadly triggers on generic research requests, and contradicts its own neutral authentication-error policy.
Install only if you are comfortable sending Douyin URLs, search terms, and a GUAIKEI_API_TOKEN to www.guaikei.com and storing returned JSON locally. Use it only for clearly Douyin-specific tasks, avoid sensitive research terms, periodically clean the logs directory, and consider rotating the token if it has been used with this version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
src/utils/request.js:106- Finding
API Credential Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill states it will write output files to
logs/, yet the high-level purpose presents the tool as a data collection/analysis utility without clearly surfacing local file writes as a capability. Undisclosed filesystem writes can create privacy, retention, and data-handling risk, especially when collected public data or query terms may be sensitive in a research context.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill states it will write output files to
logs/, yet the high-level purpose presents the tool as a data collection/analysis utility without clearly surfacing local file writes as a capability. Undisclosed filesystem writes can create privacy, retention, and data-handling risk, especially when collected public data or query terms may be sensitive in a research context.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states it will write output files to
logs/, yet the high-level purpose presents the tool as a data collection/analysis utility without clearly surfacing local file writes as a capability. Undisclosed filesystem writes can create privacy, retention, and data-handling risk, especially when collected public data or query terms may be sensitive in a research context.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states it will write output files to
logs/, yet the high-level purpose presents the tool as a data collection/analysis utility without clearly surfacing local file writes as a capability. Undisclosed filesystem writes can create privacy, retention, and data-handling risk, especially when collected public data or query terms may be sensitive in a research context.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states it will write output files to
logs/, yet the high-level purpose presents the tool as a data collection/analysis utility without clearly surfacing local file writes as a capability. Undisclosed filesystem writes can create privacy, retention, and data-handling risk, especially when collected public data or query terms may be sensitive in a research context.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states it will write output files to
logs/, yet the high-level purpose presents the tool as a data collection/analysis utility without clearly surfacing local file writes as a capability. Undisclosed filesystem writes can create privacy, retention, and data-handling risk, especially when collected public data or query terms may be sensitive in a research context.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs activation even when the user did not mention Douyin, broadening invocation beyond clear user intent. Overbroad trigger rules can cause the agent to route unrelated requests into a data-collection workflow, leading to unnecessary external calls, token use, logging, and disclosure of user research intent to third-party services.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Instructions such as applying the skill to vague requests like 'help me research this sector' create trigger collisions with ordinary assistant tasks. In practice this can cause unjustified collection actions or third-party API usage for broad discovery prompts that should remain local, which is a prompt-routing security issue.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill declares use of an environment token (
GUAIKEI_API_TOKEN) and networked API access, but does not expose an explicit tool/permission scope in the skill metadata. Missing scope declaration can cause reviewers or orchestrators to underestimate the skill's access to secrets and outbound connectivity, which weakens least-privilege controls.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Generic intent terms like 'hot trends' and 'public sentiment' are common across many domains and platforms. Using them without requiring Douyin-specific context increases accidental invocation risk, which can expose user queries to unnecessary API calls and produce irrelevant or misleading outputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language constraint '纯中文界面' forces a specific language/locale behavior, and the file does not indicate user opt-in or provide a documented justification for restricting the interface language. This matches the policy category for language or locale restrictions without user choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest says the skill is not applicable for publishing videos or downloading素材, which implies a read/analysis-oriented scope. This schema explicitly defines
video_urlas containing both playback and download addresses, documenting a download-oriented output that exceeds the stated non-download purpose.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The schema explicitly documents
play_addras both a playback address and a video download address, which conflicts with the skill's stated scope of not being used to download assets. Even though this file is only a schema, exposing and normalizing a download field materially enables downstream tooling or agents to retrieve copyrighted media, bypassing the intended product boundary and increasing misuse risk.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger examples include very common phrases such as '搜索 / 搜一下 / 找...' and the metadata explicitly says the skill should be used even when the user does not mention '抖音'. This creates an overbroad activation surface where ordinary requests about searching, trends, comments, or competitor analysis may invoke this data-collection skill unintentionally, causing unnecessary external data access and possible privacy/compliance issues.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The intent-recognition priority rules use broad keywords like '热搜 / 热点 / 榜单 / 今天什么火' and '搜索 / 搜一下 / 找 + 关键词' without requiring any Douyin-specific context. Because the skill performs external collection actions, these generic rules can misroute common conversational requests into this skill, leading to unintended scraping, token-backed API usage, and collection of third-party data the user did not specifically request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The changelog content is entirely written in Chinese, which effectively forces a specific language for users reading the skill documentation. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose, so this appears to violate the language/locale choice policy.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This section explicitly documents bulk collection of Douyin comment data but provides no warning about privacy, personal data exposure, or compliance considerations. Comments can contain usernames, contact details, health/political views, or other sensitive personal data, so normalizing collection without guardrails increases the risk of misuse, over-collection, and downstream privacy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The function sends a token and user-provided video URL to an external API via requestApi, which is a data-transmitting network operation covered by the warning requirement for code files. Although the JSDoc describes parameters and errors, it does not disclose to the user that these values are sent over the network or warn about the external API interaction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This function performs a GET request that includes the token and video URL in request parameters, which is a network transmission of potentially sensitive or user-linked data. The file contains no visible confirmation, warning, or user-facing notice explaining that this query sends those values to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code sends the user-provided search keyword and a skill token to an external API via requestApi, which is a network operation involving potentially sensitive user or system data. Although the functions are documented for developers, there is no user-facing disclosure, confirmation, or warning in this file about transmitting that data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI writes fetched Douyin comment data to a local JSON file automatically, without obtaining user consent or clearly warning that comments and associated metadata will be persisted on disk. Because comment data may contain personal information, sensitive opinions, or research targets, this creates a privacy and data-retention risk if files are left on shared systems, synced folders, or developer machines.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple user-visible strings such as error and success messages are written only in Chinese, and the file provides no locale selection or opt-in. This can violate language/locale policy when users are not given a choice of output language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code reads
process.env.GUAIKEI_API_TOKENand uses it to create and fetch a remote post task, which implies transmission of user-supplied URL data to an external service. While the file logs progress, it does not clearly disclose that a credential is being used and that input data is sent over the network.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The command persists the full output to
${startTime}_${url}_post.json, which is a file write affecting local user data storage. Although the operation may support the tool's purpose, this file does not provide a visible disclosure in help text, comments, or user-facing output that results will be saved locally.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing strings at L25-L30 force Chinese output, which is a natural-language locale policy concern under the rule for all file types. There is no indication that the skill offers multilingual support, user opt-in, or that the Chinese-only behavior is required for a documented region-specific purpose.
- Content
Static analysis
No suspicious patterns detected.