Security audit

guaikei-douyin-fetch-parse-deliver-comments

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it uses a third-party token unsafely, auto-saves collected data, and may trigger on overly broad search requests.

Review before installing. Only use it when you intentionally want Douyin data sent to www.guaikei.com, treat GUAIKEI_API_TOKEN as sensitive, rotate it if exposed, and be aware that search/post/comment results are saved locally under logs by default.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/token.js:23
Finding: Runtime Promotional and Contact Messages Override the Declared Neutral Error-Handling Policy
Content: View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis The Skill documentation expressly states that invalid-token handling must be neutral and that runtime output must not include websites, contact details, or marketing language. The implementation violates that declared security boundary in two separate path ...[truncated 1968 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/utils/request.js:87
Finding: API Token and User Activity Are Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation
``` 3. Use POST request bodies for search keywords, target URLs, limits, and filters when these values do not need to be part of resource identification. 4. If polling requires a GET request, return an opaque task identifier from task creation and poll only by that identifier. Do not resend the original keyword or target URL. 5. Configure server, CDN, proxy, monitoring, and application logging to redact: - `Authorization` - Legacy `token` parameters - Search keywords - Target URLs 6. Rotate existing tokens because they may already have been retained in access logs. 7. Apply least-privilege scopes, expiration, revocation, and rate limits to API tokens. 8. Add regression tests that fail if credential names or token values appear in generated request paths. 9. Document clearly that the commands send user queries and target URLs to `www.guaikei.com`, and obtain informed user consent before transmission. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (48)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill states that it writes logs to a local logs/ directory, but that filesystem write capability is not declared in any permission/scope metadata and is not obvious from the top-level purpose. Undeclared local file output can leak queried topics, URLs, or results to disk and may violate least-privilege expectations in agent environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that it writes logs to a local logs/ directory, but that filesystem write capability is not declared in any permission/scope metadata and is not obvious from the top-level purpose. Undeclared local file output can leak queried topics, URLs, or results to disk and may violate least-privilege expectations in agent environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states that it writes logs to a local logs/ directory, but that filesystem write capability is not declared in any permission/scope metadata and is not obvious from the top-level purpose. Undeclared local file output can leak queried topics, URLs, or results to disk and may violate least-privilege expectations in agent environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states that it writes logs to a local logs/ directory, but that filesystem write capability is not declared in any permission/scope metadata and is not obvious from the top-level purpose. Undeclared local file output can leak queried topics, URLs, or results to disk and may violate least-privilege expectations in agent environments.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill says it should trigger even when the user does not mention 'Douyin' and gives broad phrases like '帮我搜下' or '网上谁在讲这个'. Overly broad routing can cause the agent to invoke this skill for generic research requests, unexpectedly sending user queries to a third-party data source and producing irrelevant or privacy-impacting results.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly depends on an environment variable (GUAIKEI_API_TOKEN) but does not declare any tool scope, permissions, or allowed-tools metadata to make that capability visible to the hosting agent. Hidden capability requirements increase the chance of unexpected secret access or accidental over-privileging during execution, especially in systems that rely on manifest metadata for sandboxing and consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The generalized activation rule lacks concrete boundaries for when non-Douyin requests should still route to this skill. Ambiguous invocation logic can mis-handle user intent, cause unnecessary external data access, and undermine user expectations about what platform is being queried.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The statement "纯中文界面" indicates a fixed language/locale behavior. Under the policy, forcing a specific language without user opt-in or a clearly justified regional constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest explicitly says the skill is not applicable to downloading videos or watermark-removal. However, the schema documents video_url as containing both playback and download addresses, which expands the skill's described behavior into download-related output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and descriptions are written entirely in Chinese, which imposes a specific language on users of this schema without any visible opt-in or explanation that the skill is intentionally region-specific. Under the policy, language constraints should either offer user choice or be clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README emphasizes automatic export of scraped search, post, and comment data into local JSON logs, but it does not give a clear privacy warning about storing potentially sensitive or personal data from comments, account activity, or search tasks. In a multi-user or agent environment, silent persistence can create unnecessary data retention and exposure risks if files are later accessed, shared, or synced.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill maps broad everyday phrases like '搜索 / 搜一下 / 找' to Douyin scraping actions, which can cause unintended activation when a user is asking for general web help rather than explicitly requesting this platform. In an agent setting, this may trigger collection of third-party platform data and use of a configured API token without sufficiently clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The intent rule treats generic phrases such as '热点', '榜单', or '今天什么火' as sufficient to invoke the hot-list scraper, even though these phrases commonly refer to news, social media, or trends on many platforms. This increases the risk of the agent running the wrong skill and retrieving external data that the user did not intend to request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The changelog title and all user-facing descriptions are written entirely in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This is a markdown file, so SQP-2 applies to missing user-facing warnings in documentation. The sections for fetching creator works and comment data describe how to pull data from Douyin URLs and IDs, but they do not include any warning about network access, data collection, privacy implications, or responsible handling of third-party content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code sends a skill token and user-provided search keyword to an external API via requestApi, which is a privacy-relevant network operation. Although the function comments describe parameters, there is no confirmation prompt, user-facing log, or explicit warning/disclosure in this file that user input and token are transmitted off-process.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This GET request transmits the skill token together with the keyword and search filters to an external endpoint. The file contains developer-oriented docstrings but no user-visible notice, confirmation, or explicit warning that these values are sent over the network.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: After fetching Douyin comments, the CLI silently persists the full results to a local JSON file. This expands the skill from transient viewing into local data retention, which can expose potentially sensitive content, create unintended audit trails, and leave retrievable artifacts on shared systems without the user's informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file writes comment results to a local JSON file without any explicit warning or disclosure in this code path. In a browse/read-oriented skill, undisclosed storage increases privacy risk because user-requested content may remain on disk unexpectedly and be accessible to other local users, backup systems, or later processes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code uses Chinese-only natural-language strings for user-facing errors and success messages throughout the skill, such as the function description and runtime output messages. That forces a specific language on users without opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest frames the skill around searching Douyin content, checking hot lists, reading comments, and seeing what a creator has posted or updated. This CLI implements full '获取抖音博主作品列表' behavior by creating and fetching a post task and returning the creator's works list, which is a distinct operational mode not clearly reflected in the manifest's named capabilities beyond a loose cue about account updates.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Natural-language strings throughout the CLI, including option descriptions and help text, are exclusively in Chinese. Under the language/locale policy rule, forcing a specific language without offering user opt-in or documenting a justified region-specific constraint is a policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes a read-oriented Douyin retrieval skill: searching videos, checking hot rankings, reading comments, and listing a creator’s posts. In contrast, this module persists caller-provided content to disk, which is not an obvious requirement of that user-facing purpose and introduces a local data retention capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code sends caller-supplied params and data over the network via POST and GET requests, including query-string parameters and JSON bodies. There is no confirmation prompt, user-visible disclosure, or warning in this file explaining that user or system data may be transmitted to a remote service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing warning and info strings only in Chinese, with no indication that the skill is Chinese-only or that users can select another language. That creates a natural-language policy concern because the skill imposes a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.