Security audit

guaikei-douyin-discover-extract-serve-trending

Security checks across malware telemetry and agentic risk

Overview

This skill appears to retrieve public Douyin data, but its trigger rules are too broad and can send vague user requests to an external service while saving results locally.

Install only if you are comfortable with user queries, Douyin URLs or identifiers, and public-result data being sent to guaikei.com and saved as local JSON logs. Agents should require explicit Douyin or short-video research intent before invoking this skill, especially for vague requests like “check this” or “search it,” and users should delete logs when they contain sensitive research targets.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill relies on an environment variable (`GUAIKEI_API_TOKEN`) but the metadata shown here does not declare any explicit permission or capability for env access. That creates a transparency and review gap: users and platforms may not realize the skill reads secrets from the environment, increasing the risk of unintended secret exposure or policy bypass.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The schema explicitly documents `play_addr` as a video playback and download address, which conflicts with the skill's stated scope that it does not support downloading content. This kind of mismatch can enable downstream agents or integrators to use the field for unauthorized media retrieval, increasing legal, policy, and abuse risk even if the file is only a schema.

Vague Triggers

High

Confidence: 94% confidence
Finding: The description says the skill should activate even when the user only says generic phrases like “查一下” or “帮我看看” without naming Douyin. This is dangerous because it can cause unintended invocation on ordinary requests, sending user prompts into a third-party data collection workflow the user did not clearly consent to.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The generalized activation rule explicitly extends use to broad content-research scenarios even when “Douyin” is not mentioned. In context, this increases the chance of over-collection, mistaken platform targeting, and user surprise, though the impact is somewhat limited by the skill’s stated read-only scope.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill states that logs are automatically saved under `logs/` with timestamped filenames, but the description does not prominently warn users that fetched data and query terms may be written to local files. This can expose sensitive research topics, URLs, or collected public content to other local users, backups, or downstream tooling without informed consent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger mapping explicitly states that broad, everyday phrases like “搜索 / 搜一下 / 找 …” should invoke the skill, and the metadata further says even vague requests like “查一下”“帮我看看” may apply when Douyin is not named. This creates a real risk of unintended activation, causing user prompts and target identifiers to be sent to an external service without sufficiently specific user intent.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The intent recognition rules prioritize generic terms such as ‘热搜 / 热点 / 榜单 / 今天什么火’ and ‘搜索 / 搜一下 / 找 + 关键词’, which are common across many domains and not unique to Douyin. In an agent setting, such broad classifiers can misroute unrelated user requests into this skill, leading to unnecessary third-party data transmission and surprising behavior.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README describes obtaining and using a GUAIKEI_API_TOKEN and sending keywords, profile URLs, and video URLs for processing, but it does not clearly warn that these user-supplied inputs are transmitted to an external service. In a data-retrieval skill, that omission undermines informed consent and may expose sensitive research targets, monitoring subjects, or proprietary queries to a third party.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The CLI persists fetched Douyin post data to a local JSON file automatically after successful execution, without any visible consent prompt or opt-in control in this file. Because the skill is explicitly used to research creators and collect platform content, the saved output may contain sensitive or regulated data and can remain on disk longer than the user expects, increasing exposure to other local users, malware, backup systems, or accidental disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.