T01 · Skill Instruction Hijacking
Warning
- Location
src/utils/token.js:23- Finding
Authentication Failures Emit Hard-Coded Promotional and Contact Messages
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-discovery
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with Douyin public-data research, but it needs review because it mishandles the API token and its runtime auth errors contradict the documented safety promise.
Install only after reviewing the credential and logging behavior. Use a dedicated, revocable GUAIKEI_API_TOKEN, expect requests and query data to be sent to www.guaikei.com, treat generated logs as potentially sensitive, and delete or protect them after use. Be aware that auth-error output may include promotional contact information despite the skill documentation saying it will not.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:105- Finding
API Credential Is Transmitted in URL Query Parameters
- Content
View full analysis
``` TLS protects the request while it is in transit, but it does not prevent the complete URL from being retained at TLS termination points or ...[truncated 1540 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill declares data retrieval functions, but it also states that it writes structured logs to a local
logs/directory with filenames derived from timestamps, keywords, and parameters. Local logging of user queries and fetched metadata introduces an undeclared persistence channel that can leak sensitive research terms, URLs, or operational activity to other local users or later processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill declares data retrieval functions, but it also states that it writes structured logs to a local
logs/directory with filenames derived from timestamps, keywords, and parameters. Local logging of user queries and fetched metadata introduces an undeclared persistence channel that can leak sensitive research terms, URLs, or operational activity to other local users or later processes.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill uses an environment variable token (
GUAIKEI_API_TOKEN) but does not declare any explicit tool scope or permission boundary. This weakens least-privilege guarantees because an orchestrator may allow broader environment access than necessary, increasing the chance of unintended secret exposure or unsafe execution assumptions.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill should also activate when the user asks broad requests like '帮我看看同行' without mentioning Douyin. Overly broad implicit triggers can cause the wrong skill to activate on unrelated requests, leading to unintended external data access, unnecessary token use, or surprising behavior outside the user's actual intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The implicit trigger examples include very common phrases such as '帮我做短视频竞品调研' and '最近有什么热门话题', which are not sufficiently constrained to Douyin. This increases the risk of accidental invocation in unrelated contexts and can result in unnecessary external requests, logging, and use of privileged tokens without clear user authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The schema title and description are written only in Chinese, which constitutes a natural-language locale constraint in user-facing metadata. Because the file does not offer an alternative language or indicate that the schema is intentionally limited to a Chinese-language or region-specific audience, it may violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title and descriptions are entirely written in Chinese, which imposes a specific language/locale on users without any indication of opt-in or justification. Under the policy, language constraints should either offer user choice or be clearly documented as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language description is entirely in Chinese and presents the skill as a general-purpose analysis tool, but it does not indicate that Chinese is required, optional, or limited to a China-specific audience. Under the language/locale policy, a skill should not implicitly force a specific language without user opt-in or clear justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation advertises automatic export of scraped video, author, comment, and hot-list data into local JSON logs, but does not prominently warn that these files may contain sensitive or regulated data and persist on disk. In multi-user or shared environments, this creates a realistic risk of unintended retention, secondary disclosure, or reuse of scraped personal data beyond the user's immediate task.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README maps broad everyday phrases like '看看同行', '今天什么火', and generic '搜索/找' patterns directly to executable scraping actions. In an agent setting, this increases the chance of unintended invocation and data collection when a user's request is ambiguous, which can trigger unauthorized scraping, unnecessary external requests, or collection of competitor/comment data the user did not explicitly ask for.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation explicitly enables bulk collection of creator posts and comment data, including up to 10,000 records, but provides no guidance on privacy, consent, platform terms, or downstream handling of personal data. In a competitive-intelligence skill, this omission increases the risk of misuse for profiling, harassment, or non-compliant scraping of user-generated content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code sends a token and a Douyin profile URL to remote API endpoints via requestApi, which is a network operation involving potentially sensitive user or system data. Although there are developer-facing docstrings, this file provides no user-facing disclosure such as a confirmation prompt, visible log/print, or explicit warning that these values will be transmitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The getPostTask function performs a GET request that includes the token, URL, and limit in request parameters, sending them over the network. This file does not include any user-facing notification or confirmation about that transmission, only internal comments for developers.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
User-visible messages and descriptions in this file are entirely in Chinese, including success and error outputs, with no indication that the user can choose another language. This can violate a language/locale policy when the skill imposes a specific language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The command description and other user-facing strings in this file are hardcoded in Chinese, and there is no visible opt-in or language selection mechanism. This can violate a language/locale policy where tools must not force a specific language without user choice or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code presents its command descriptions, examples, warnings, and runtime messages only in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative locale is provided. The file does not indicate that the skill is region-specific or that Chinese is an intentional, documented constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This code sends URL parameters and JSON request bodies over HTTPS via postJson/getJson, which can transmit user or system data to a remote service. While there is retry logging for failures, there is no confirmation prompt or user-facing notice in this file explaining that outbound network transmission occurs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code emits all user-facing warning, success, and info messages in Chinese only, including the token misconfiguration warning and status message. Because this file provides no opt-in, fallback, or documented region-specific justification, it appears to impose a specific language on users, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code includes natural-language comments and end-user error/output strings in Chinese, such as validation errors and formatted result labels. Because the file does not indicate that the skill is region-specific or offer any language opt-in, it appears to force a specific language/locale, which matches the policy-violation criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The title and descriptions are written entirely in Chinese, which creates a language-specific constraint in the skill's natural-language interface metadata. The file does not indicate that this locale is optional, user-selectable, or justified as a region-specific requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This manifest-style JSON schema uses Chinese-only natural-language title and description fields throughout, with no indication that the skill is region-specific or that other language options are available. Under the language/locale policy rule, a fixed language choice without opt-in or documented justification can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language metadata in the schema is entirely in Chinese, including the title and property descriptions, with no indication that this skill is region-specific or that users can choose another language. That can violate a language/locale policy when a skill imposes a specific language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema uses Chinese-only title and description text, which is a natural-language locale constraint visible to downstream users or developers. The file does not offer any language choice or explain that the schema is intentionally region-specific, so it may violate a policy requiring language or locale opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON schema uses Chinese-only natural-language title and description text, which can amount to a language/locale policy constraint when consumed by downstream tools or users. The file does not provide any opt-in, alternative locale, or justification that the schema is intended only for a Chinese-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The file presents all instructions, trigger phrases, and intent-mapping examples exclusively in Chinese, and the natural-language command mapping assumes Chinese user utterances. This effectively imposes a language/locale constraint without explicitly offering users a choice or documenting the limitation as an opt-in behavior.
- Content
Static analysis
No suspicious patterns detected.