Security audit

guaikei-douyin-records-access

Security checks across malware telemetry and agentic risk

Overview

The skill is a Douyin public-data lookup tool whose remote API use, token requirement, and saved JSON result files are mostly disclosed and aligned with its stated purpose.

Use this skill only when you want GuaiKei-backed Douyin public-data lookups. Provide only the required GUAIKEI_API_TOKEN, confirm ambiguous trend/search requests should target Douyin, and clear the logs directory if you do not want retained local copies of results.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill explicitly depends on the environment variable `GUAIKEI_API_TOKEN` and invokes Node.js commands, but the metadata does not declare corresponding permissions or capability requirements. This creates a trust and review gap: operators may enable the skill without realizing it can access secrets from the runtime environment, increasing the chance of accidental token exposure or unauthorized execution contexts.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The schema explicitly documents `video_url` as both playback and download addresses, while the skill metadata says the skill is not applicable to video downloading. That mismatch can enable downstream agents or integrators to use the skill for prohibited download workflows, expanding the skill beyond its declared scope and potentially facilitating unauthorized content acquisition.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The schema explicitly documents `play_addr` as both a playback address and a video download address, which conflicts with the skill's stated restriction that it is not intended for downloading videos. This creates a capability mismatch: downstream agents or integrators may use the field to retrieve downloadable media anyway, enabling policy bypass and potential misuse of copyrighted or restricted content.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI persists fetched comment data to a local JSON file even though its stated purpose is to query public Douyin information. Silent retention expands the data lifecycle beyond transient display, creating privacy, compliance, and data-leakage risk if comments or metadata are later accessed by other local users, processes, or log collectors.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists retrieved Douyin post data to a local JSON file after completing a read-style query, creating an undeclared data retention side effect. Even if the source data is public, writing it to disk can expose scraped datasets, comments, or account activity to other local users, backups, or downstream tooling without the operator explicitly opting in.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists both the user's search parameters and the full retrieved results to a local file. Even if the underlying content is public Douyin data, local persistence can create an unintended record of user activity, queried topics, and collected datasets without clear disclosure or retention controls, which is a privacy and data-handling risk.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This utility provides arbitrary local file-writing capability even though the skill is described as a read-only public-information access tool for Douyin content. While the filename is partially sanitized, the function still persists attacker-influenced content to disk, which expands the skill's capabilities beyond its declared scope and can enable unauthorized data retention, log planting, or abuse of local storage if exposed to untrusted inputs.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code writes arbitrary string content directly to a local file, despite the skill manifest indicating an information-access use case rather than persistence or file management. This mismatch is security-relevant because it creates a covert persistence channel for scraped data or user-supplied content, increasing the risk of unintended data storage, policy violations, and local resource abuse.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The description says to use this skill for questions about public information on Douyin and even for generic short-video questions when Douyin is not named. That broad routing can cause the agent to invoke an external data-access skill on loosely related user requests, sending user prompts or derived targets to a third-party service without clear user intent or platform specificity.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The implicit trigger examples such as competitor research, finding high-like content, or asking what's popular overlap heavily with common cross-platform research tasks. In context, this makes accidental over-collection or misrouting more likely, because ordinary research requests may be silently redirected into Douyin scraping workflows without explicit user consent or narrowing.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The natural-language trigger mappings include broad phrases such as general search verbs and colloquial requests that can match ordinary user language without strong platform scoping. This creates unintended skill activation risk, causing the agent to invoke a third-party data-access skill when the user may not have explicitly requested Douyin-related retrieval, which can lead to unnecessary data access, token use, and incorrect tool routing.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The intent recognition rules rely on ambiguous keywords like '热点', '榜单', '搜索', and '找' with insufficient contextual constraints, making misclassification likely in normal conversation. In an agent setting, this can cause overbroad autonomous tool use and external querying beyond user intent, especially because the skill metadata itself says to use this skill even when the user did not explicitly say '抖音'.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The tool sends user-supplied URLs and query parameters to a remote API using an environment token without any clear user-facing disclosure in this CLI path. In a skill marketed as reading public platform data, undisclosed outbound transmission can surprise users and may violate expectations around data handling, especially if URLs contain tracking parameters or sensitive context.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The CLI writes the full fetched comment results to a local file without any explicit warning or user consent. Even when data is publicly sourced, silent local persistence can expose collected datasets to unintended local access, backup systems, or later reuse outside the user's expectations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The program silently writes fetched post results to a local JSON file with no user-facing confirmation or consent, which can surprise users who expect a read-only query tool. Silent persistence increases the chance of unintended collection, retention, and later disclosure of scraped data through shared hosts, logs, sync services, or backups.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The tool writes search outputs to disk without an explicit user warning or consent flow. This is dangerous because users may expect transient querying of public content, but the implementation silently creates a local archive of results and query metadata that could later be exposed to other local users, backup systems, or forensic collection.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.