T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:106- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-records-access
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Douyin public-data purpose, but it needs review because it saves collected social data by default and has weak token/error handling.
Review before installing. Use only with a token you are comfortable sending to the vendor API, avoid using it for ambiguous non-Douyin requests, and treat generated logs as stored social-media data that may contain comments, user identifiers, URLs, and query history. Delete logs when no longer needed and do not rely on the skill's no-download wording to prevent media URL exposure.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:23- Finding
Promotional and Contact Information Injected into Runtime Authentication Errors
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill declares social-media data retrieval, but also states that logs are automatically persisted under a local logs/ directory. Local file writes expand the skill's effective capability and can retain queried URLs, comments, keywords, or operational metadata longer than expected, creating privacy and data-handling risk if not explicitly scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill declares social-media data retrieval, but also states that logs are automatically persisted under a local logs/ directory. Local file writes expand the skill's effective capability and can retain queried URLs, comments, keywords, or operational metadata longer than expected, creating privacy and data-handling risk if not explicitly scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill declares social-media data retrieval, but also states that logs are automatically persisted under a local logs/ directory. Local file writes expand the skill's effective capability and can retain queried URLs, comments, keywords, or operational metadata longer than expected, creating privacy and data-handling risk if not explicitly scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill declares social-media data retrieval, but also states that logs are automatically persisted under a local logs/ directory. Local file writes expand the skill's effective capability and can retain queried URLs, comments, keywords, or operational metadata longer than expected, creating privacy and data-handling risk if not explicitly scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill declares social-media data retrieval, but also states that logs are automatically persisted under a local logs/ directory. Local file writes expand the skill's effective capability and can retain queried URLs, comments, keywords, or operational metadata longer than expected, creating privacy and data-handling risk if not explicitly scoped.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill declares use of an environment variable token but does not declare any explicit tool scope or permissions boundary. That makes secret access implicit rather than reviewable, increasing the risk of unintended token exposure or broader execution than operators expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says to use the skill even when the user did not mention Douyin, for broad short-video or competitor-research requests. Overbroad implicit triggers can cause the agent to invoke external data access in contexts the user did not clearly request, leading to unintended data collection, platform confusion, or policy bypass through ambiguous phrasing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Examples like generic research or 'recently what's popular' overlap with common user intents that may not require this specific platform-access skill. Such broad examples increase accidental invocation risk and can expand collection of public social data beyond user expectation, especially in an agentic environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The schema explicitly documents
video_urlas both playback and download addresses, which conflicts with the skill metadata stating it is not intended for downloading. In a skill focused on accessing Douyin public content, exposing download URLs materially enables content extraction and redistribution beyond the declared scope, increasing policy, copyright, and misuse risk.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The schema explicitly exposes
play_addras a video playback/download address, which conflicts with the skill’s stated scope that it is not for downloading content. Even though this file is only a schema, documenting and normalizing a download-capable field makes it easier for downstream components or users to repurpose the skill for prohibited media retrieval, creating policy and abuse risk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promotes collection of public Douyin videos, author data, comments, and automatic JSON log export, but the warning about local storage is weak and buried. Users may unknowingly persist potentially sensitive scraped content, including comment text and account identifiers, to disk where it can be retained, shared, or exposed beyond the original analysis purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file contains multiple user-facing strings in Chinese, including status and error messages, and does not provide any user opt-in or configuration for language selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's CLI descriptions, help examples, and runtime messages are presented in Chinese only, with no indication that users can select another language or locale. This can violate language/locale policy when a skill forces a specific language without user opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI writes fetched Douyin results to a local JSON file after completing what is described as a read-oriented public-information access task. This creates a persistence side effect that may surprise users, leave scraped data on disk, and increase data exposure if the host is shared or logs/artifacts are collected elsewhere.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill for retrieving public Douyin information such as search results, creator posts, comments, and hot topics. In this file, the code pulls a credential from
process.env.GUAIKEI_API_TOKEN, which introduces secret handling beyond the manifest’s stated public-information retrieval purpose.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes the full search output to a log file, creating local retention of retrieved data beyond the stated retrieval-only purpose. Even if the source data is public, persisted logs can accumulate sensitive query histories, account profiling information, or comments/metadata and expand exposure to other local users, backup systems, or later unintended processing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code embeds a user-facing authentication error entirely in Chinese, including instructions to contact a WeChat number. For a general-purpose request utility, this imposes a specific language/locale on users without offering a choice or documenting a region-specific constraint, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The sanitizer only permits Chinese characters, ASCII letters/digits, and a small punctuation set, while all user-facing validation messages and examples are written in Chinese. This creates a locale constraint in natural-language behavior without offering a language choice or documenting that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and description fields specify the skill metadata exclusively in Chinese, which can constitute a language/locale policy issue when no opt-in, alternative language, or region-specific justification is provided. Because this is natural-language content in a JSON file, it falls under the all-file-types policy check.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title and field descriptions. Because the file does not document that the skill is China-specific or offer any language/locale choice, it may violate a language/locale policy requiring user opt-in or explicit justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON schema contains human-facing metadata entirely in Chinese, including the title and description. For a general-purpose skill artifact, that can constitute a language-policy issue because it imposes a specific language without any documented opt-in or justification for a Chinese-only audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The schema title and description are written entirely in Chinese, which imposes a specific language in user-facing metadata without any opt-in or documented locale limitation. Under the language/locale policy check, this is a natural-language policy concern because the file does not indicate that the skill is China-specific or that other language options are available.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This JSON manifest/schema uses only Chinese natural-language titles and descriptions for the API response schema. Under the stated policy, a fixed language can be a locale-policy issue when no opt-in, choice, or region-specific justification is provided in the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This manifest-format JSON schema uses only Chinese natural-language titles and descriptions for the skill interface. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title at L004 and many field descriptions, which can impose a specific language/locale on downstream tooling or users. There is no indication that Chinese is optional, user-selected, or justified as a region-specific schema.
- Content
Static analysis
No suspicious patterns detected.