T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:93- Finding
API Token Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-extract-videos-comments-hot
Security checks for vulnerabilities and agentic risk
Overview
The skill broadly matches its Douyin data-collection purpose, but it has review-worthy risks around automatic local data retention and API token handling.
Review before installing. Use this only if you are comfortable sending Douyin search terms, account/video targets, and your Guaikei API token to the Guaikei service, and with collected results being saved locally under logs by default. Avoid using it in shared, synced, CI, or sensitive research workspaces unless you control retention and token rotation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/log.js:5- Finding
Automatic Plaintext Persistence of Complete Query Results
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.slice(0, 200); } if (!safeFilename) { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` Successful comment requests persist the complete request and result object without an opt-in option: ```js const finalOutput = { status: "success", error_code: "OK", message: "获取评论任务完成", timestamp: new Date().toLocaleString(), request: { command: "comment", url: url, limit: limit, }, metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: commentTask, }; console.log(JSON.stringify(finalOutput, null, 2)); utils.printSuccess( `获取评论任务完成, 共返回 ${finalOutput.res ...[truncated 3139 chars]- Remediation
View remediation
` or `--save-results`. 3. Clearly disclose filesystem writes, retained fields, output locations, and retention behavior in `SKILL.md`. 4. When persistence is requested, create directories and files with restrictive permissions: ```js await fs.promises.mkdir(outputDirectory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); ``` 5. Avoid overwriting existing files by using exclusive creation or securely generated unique names. 6. Offer configurable retention limits and a cleanup command. 7. Permit users to exclude request metadata or other unnecessary fields from saved output. 8. Document that generated files may contain user queries and collected datasets. 9. Add tests confirming that no files are created unless persistence is explicitly requested. 10. Consider encryption at rest when saved outputs may contain sensitive research or analysis data. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (51)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding suggests the implemented behavior centers on token validation and commercial/contact guidance rather than the declared public-data retrieval functions. Undisclosed authentication handling and off-platform contact instructions increase trust risk because they introduce additional data flows and user steering not covered by the skill's stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding suggests the implemented behavior centers on token validation and commercial/contact guidance rather than the declared public-data retrieval functions. Undisclosed authentication handling and off-platform contact instructions increase trust risk because they introduce additional data flows and user steering not covered by the skill's stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding suggests the implemented behavior centers on token validation and commercial/contact guidance rather than the declared public-data retrieval functions. Undisclosed authentication handling and off-platform contact instructions increase trust risk because they introduce additional data flows and user steering not covered by the skill's stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The finding suggests the implemented behavior centers on token validation and commercial/contact guidance rather than the declared public-data retrieval functions. Undisclosed authentication handling and off-platform contact instructions increase trust risk because they introduce additional data flows and user steering not covered by the skill's stated purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **日志**：通过 `src/utils/log.js` 输出，区分 info / warn / error 三级；令牌等敏感字段自动脱敏。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill explicitly relies on the sensitive environment variable
GUAIKEI_API_TOKEN, but it does not declare any tool scope such aspermissionsorallowed-toolsto make that access explicit and constrain runtime behavior. Hidden or undeclared access to environment secrets weakens reviewability and can enable unintended secret exposure if the implementation or future changes access additional env vars.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger rule says the skill should activate even when the user does not explicitly mention Douyin, based on broad concepts like short video content, creators, comments, or trends. This overbroad routing can cause the agent to invoke a third-party data-collection skill unexpectedly, sending user queries or targets to an external service when platform intent is ambiguous.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema explicitly documents
video_urlas both playback and download addresses, which conflicts with the skill metadata stating it does not cover downloading videos. In this context, exposing download-capable URLs can enable downstream clients or users to retrieve media in ways the skill claims to avoid, weakening policy boundaries and creating compliance or misuse risk.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The schema explicitly describes
play_addras both a playback URL and a video download address, which conflicts with the skill metadata stating it does not support downloading videos. That mismatch can cause downstream agents or integrators to expose or normalize download functionality that the skill claims to exclude, creating policy-compliance and misuse risk even though this file is only documentation/schema.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly promotes automatic JSON log generation and gives filename patterns for saved search, post, and comment outputs, but it does not clearly foreground that scraped public account, video, and comment data will be persisted to local disk by default. This can create unintended local data retention and exposure risk, especially on shared machines, CI runners, synced folders, or environments where users expect transient processing only.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language mapping includes broad phrases such as '搜索 / 搜一下 / 找' and other common speech patterns that may cause the skill to trigger on loosely related user requests without sufficient platform or scope confirmation. In an agentic environment, that can lead to unintended collection of Douyin data, unnecessary API usage, and accidental handling or storage of third-party content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The intent-recognition priority rules use generic concepts like '热搜 / 热点 / 榜单 / 今天什么火' and '搜索 / 搜一下 / 找 + 关键词' without enough scope constraints, so ordinary conversational requests may be over-mapped into external scraping actions. Because this skill performs data extraction and logging, overbroad routing increases the chance of unintended API calls, collection of public comments/account data, and local persistence of results.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains all user-facing natural-language content in Chinese, including the title and changelog entries, with no indication that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in or justification is a policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file explicitly documents bulk collection of creator posts and public comments, including up to 10,000 records, but provides no guidance on lawful use, privacy expectations, retention, or handling of personal data contained in comments and profile metadata. In a skill designed for large-scale public-data extraction and analysis, this omission increases the risk of misuse, over-collection, and downstream privacy/compliance violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code sends a skill token and user-provided search keyword to an external API via requestApi, which is a safety-relevant network operation. Although the JSDoc documents parameters for developers, there is no confirmation, logging, or user-facing disclosure in this file that the token and query data will be transmitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The GET request includes the token, keyword, and filtering parameters in a network call to an external endpoint. This is a data-transmission behavior that lacks any visible user warning, confirmation, or user-oriented notice in the code shown.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CLI persists fetched comment data to a local JSON file after completing the request, but this storage behavior is not surfaced in the visible skill purpose or warned about in the file. Even though the data is described as public Douyin content, comments can still contain personal data or sensitive research targets, so undeclared retention increases privacy, compliance, and data-handling risk on the host system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code writes returned comments to a predictable local JSON file without any explicit warning or consent in this file. Silent persistence can expose scraped data to other local users, backups, sync tools, or later processing pipelines, which is especially relevant because comment text may include usernames, opinions, or other personal information despite being publicly viewable.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Comments and especially runtime user-facing strings such as error and success messages are written only in Chinese, with no indication of locale selection or user choice. This can violate a language/locale policy when a skill imposes one language by default without opt-in or documented regional justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI persists the full fetched Douyin works result set to a local JSON file after completing the request. Because the skill is presented as a retrieval/analysis tool rather than a data-retention tool, this creates an undisclosed local data copy that may expose scraped content, account metadata, and analysis outputs to other local users, backup systems, or later unintended reuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The program silently writes fetched results to a local JSON file without explicit notice or consent. This can cause unintended retention of scraped data on disk, increasing privacy, compliance, and local exposure risks, especially on shared systems or in automated environments where operators may assume output is ephemeral.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes the full search output to a local JSON file, including user-provided keywords and returned public-platform data, without obtaining explicit consent or documenting retention behavior. In a data-collection skill focused on large-scale public data extraction, this creates a real privacy and operational security risk because sensitive research terms, account targets, or collected records may persist on disk and be exposed to other local users, backups, or log aggregation systems.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code returns user-facing messages only in Chinese, including failure and authentication guidance, with no indication that the skill is Chinese-only or that users can choose their preferred language. That creates a natural-language locale policy issue because the skill effectively forces a specific language on all users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits all warning and status messages exclusively in Chinese, including operational guidance and recovery instructions. The file does not provide any user language selection or documented justification for a Chinese-only locale, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's comments and all visible user-facing validation errors are written only in Chinese, such as the messages emitted in the validator. Under the policy for natural-language constraints, forcing a specific language without user opt-in or clear region-specific justification is a policy concern.
- Content