T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:106- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-feed-processing-pipeline
Security checks for vulnerabilities and agentic risk
Overview
This is a read-only Douyin public-data tool, but it needs review because it sends its API token in request URLs and automatically saves fetched results locally.
Install only if you are comfortable with Guaikei receiving your token plus the Douyin keywords, URLs, and IDs you request. Protect or delete the generated logs after use, avoid running sensitive research on shared or synced machines, and rotate the API token if you suspect URL logs or telemetry may have captured it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (43)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
代码片段仅是通用参数解析器（parseArgs、readValueAfterFlag、buildHelp），属于底层支持模块。它不访问抖音、不发起网络请求、不处理任何抖音数据对象，也没有实现声明中的四类核心命令或对应业务流程。因此，所给代码片段的实际行为与声明的主要用途存在明显不一致。虽然这类工具函数可能被更大技能用于实现 CLI，但就当前提供的代码而言，其实际功能只是通用命令行参数处理，而非所宣称的抖音数据调研能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是面向抖音公开数据的查询/抓取类功能，而给出的代码片段实际只是一个本地日志写入辅助模块，没有任何与抖音数据搜索、作品抓取、评论读取、热榜查看、网络请求、令牌校验或退出码处理相关的行为。虽然日志记录可能是支持性实现细节，但该片段本身的直接功能与声明的核心能力明显不一致，并且涉及未声明的本地文件系统写入能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description claims substantial Douyin data collection and query functionality across multiple commands. The supplied code chunk does not implement any of those behaviors. Instead, it performs a simple local filesystem read of package.json to obtain the package name. This is unrelated supporting code at best, but based on the supplied chunk alone, the actual behavior shown does not match the declared primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a feature-complete Douyin data collection/research skill. However, this code chunk is merely a logging/CLI presentation utility module. Its behavior is limited to emitting a banner and colored log lines, which is only incidental support code and does not substantiate the declared primary purpose. Based on this chunk alone, the implementation does not match the described capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
根据提供的代码片段，其功能是对抖音用户主页链接进行规范化处理，并对数量参数进行范围校验。这属于辅助性输入处理逻辑，而不是描述中所称的完整“4 个命令”的抖音数据采集/查询能力。代码没有展示搜索、读取评论、查看热榜、抓取作品内容本身，也没有体现声明中的退出码机制。因此，若将这段代码片段与该描述直接对应，描述未准确反映这段代码的实际行为，存在明显不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 79% confidence
- Finding
The manifest declares use of an environment variable (
GUAIKEI_API_TOKEN) but does not restrict tool scope with explicitpermissionsorallowed-tools. In agent environments, missing scope declarations can lead to overly broad execution or secret access assumptions, reducing least-privilege controls and making accidental misuse harder to prevent.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description says the trigger coverage spans nearly all Douyin data-research scenarios, which is overly broad and can cause unintended invocation. In an agent system, overbroad routing can expose tokens to tasks the user did not intend, send queries to third-party APIs unnecessarily, and increase privacy/compliance risk through excessive data externalization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The README is entirely written in Chinese and includes operational instructions and natural-language trigger mappings only in Chinese, with no indication that other languages are supported or that Chinese is a deliberate locale-specific requirement. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly states that scraped Douyin data and comments are automatically exported to JSON logs in a local
logsdirectory, but it does not warn that this may store potentially sensitive personal data, user-generated comments, account identifiers, and research artifacts on disk. In the context of a scraping/analytics skill, silent persistence increases privacy, retention, and secondary exposure risk if the host system is shared, backed up, synced, or compromised.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The function sends a token and user-supplied video URL to an external API via requestApi, which is a network operation involving potentially sensitive data. Although the code has developer docstrings, there is no user-facing confirmation, warning, or visible disclosure in this file about transmitting these values.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This function performs a GET request that includes the token and video URL in request parameters, sending user or system data over the network. The file contains no user-facing notice, confirmation, or warning that these values are transmitted when querying comment results.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI writes the full fetched comment results to a local JSON file, which can persist potentially sensitive or regulated user-generated data outside the immediate command output path. This increases exposure through unintended retention, weaker filesystem permissions, shared workspaces, backups, or later collection by other processes, especially since the file is written automatically without an explicit opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI writes full search output to a local JSON file named with the user keyword, even though the skill is presented primarily as a retrieval/search tool. This creates an undisclosed persistence channel for potentially sensitive query terms and collected data, increasing the risk of local data exposure, accidental retention, or ingestion by other processes/users on the system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Search results are silently persisted to disk without an explicit warning or user consent. In this skill context, queries and results may reveal research topics, monitored accounts, or other sensitive collection activity, so unexpected local storage meaningfully raises privacy and operational security risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file uses Chinese for docstrings, thrown error messages, and generated help text, which imposes a specific language on users and maintainers. Under the policy, locale-specific behavior should be opt-in or clearly documented as region-specific, but no such choice or justification appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill emits user-facing error text in Chinese only (and later a success message in Chinese), which imposes a specific language on users without any opt-in or documented regional scope. This matches the language/locale policy violation category because the file provides no alternative locale handling or justification for the restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
These user-visible status messages are also hard-coded in Chinese only, continuing the same forced-language behavior. Because the file does not offer language selection or state that the skill is region-specific, this is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Several error strings are hard-coded in Chinese, including the authentication failure message and request-failure text. The policy forbids forcing a specific language or locale without user opt-in, and this file does not offer any language selection or document a justified locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JavaScript file contains natural-language comments and error/output strings exclusively in Chinese, including validation errors and the formatted result message. Because the skill does not provide any user opt-in or language selection, it effectively forces a specific language, which matches the stated language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
All invocation guidance, examples, parameter explanations, and support text are presented exclusively in Chinese, with no statement that other languages are supported or that Chinese is optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title and description fields are written only in Chinese, including parameter descriptions, with no indication that the skill is China-specific or that users may choose another language. This creates a natural-language locale policy concern because the file effectively imposes a single language without documented opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema uses Chinese-only natural-language title and descriptions throughout, including the top-level metadata and property descriptions. Under the policy rule, forcing a specific language without opt-in or a documented region-specific justification is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The schema title and description are written only in Chinese, which imposes a specific language in natural-language metadata. There is no indication that the schema is intentionally region-specific or that alternative locales are supported, so this may violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON schema contains only Chinese natural-language titles and descriptions, which imposes a specific language on users without offering a choice or documenting that the skill is intentionally region- or locale-specific. The policy explicitly allows locale constraints only when they are justified or optional, which is not evident in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The schema title and description are written only in Chinese, which imposes a specific language on users or integrators consuming this skill metadata. There is no indication that the skill is region-specific or that an alternative language/locale is supported, so this appears to violate the language-choice policy.
- Content
Static analysis
No suspicious patterns detected.