guaikei-douyin-fetch-trending-feed

• Outcome: Review
• Latest audit: Aug 21, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but its broad auto-triggering, automatic data logging, download-capable output fields, and runtime contact messages create enough under-scoped behavior for Review.

Install only if you are comfortable sending Douyin-related keywords, URLs, and requested limits to guaikei.com using your GUAIKEI_API_TOKEN, and with full fetched results being saved locally in logs by default. Avoid letting it auto-run for generic video or competitor-research prompts unless Douyin is clearly intended.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill explicitly depends on the environment variable `GUAIKEI_API_TOKEN`, but the metadata shown in the skill does not declare permissions or capabilities related to environment access. Undeclared secret/env access weakens transparency and policy enforcement, making it easier for a skill to consume sensitive runtime data without clear operator awareness.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The schema explicitly documents `video_url` as containing both playback and download addresses, which conflicts with the skill metadata stating the skill is not applicable to downloading. That mismatch can enable downstream agents or integrators to misuse the skill for prohibited content acquisition, expanding the skill’s effective capability beyond its declared scope and weakening policy enforcement based on metadata.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback URL and a video download address, which conflicts with the skill’s stated scope that it is not intended for downloading. Exposing a download-capable field can enable downstream agents or users to repurpose the skill for content retrieval beyond its declared use, increasing policy and misuse risk even though this file is only a schema.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The CLI persists fetched comment results to a local JSON file after retrieving them, even though the skill is described primarily as public-information retrieval. Comment data can still contain personal data or sensitive user-generated content, and undisclosed local retention expands the data exposure surface if the host environment is shared, compromised, or logs are later collected elsewhere.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI persists the full fetched Douyin results to a local JSON file even though the skill is described as a fetch/read utility. This creates an undeclared data-retention side effect: scraped content, account data, and metadata may remain on disk, be accessible to other local users/processes, or be collected by backup/sync tooling without the user's awareness.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger description says the skill should be used for any question involving public information 'on Douyin' and even for short-video competitive research when the user did not mention Douyin. This broad activation rule can cause the agent to invoke an external data-collection skill in contexts the user did not clearly intend, leading to scope creep, unnecessary token use, and possible disclosure of user queries to a third-party service.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The '泛化触发' guidance instructs activation for content research, competitor analysis, and topic planning even without any explicit Douyin context. In an agent environment, this is dangerous because it expands tool invocation beyond user-consented scope and can silently route generic research prompts to a platform-specific external collector.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The natural-language trigger examples are broad enough to match common user phrasing such as '找' or '视频', which can cause the skill to activate outside clearly scoped Douyin-public-data requests. This creates prompt-routing risk: the agent may invoke this external data-fetching skill for unrelated conversations, leading to unintended data access, unnecessary external calls, or policy bypass in multi-skill environments.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The intent-recognition rules prioritize broad keywords like '热搜', '搜索', '评论', '作品', and '视频' with insufficient scope constraints, so ordinary user requests may be misclassified as commands to access Douyin data. In an agent setting, this can cause overbroad tool invocation and exfiltration of user queries to a third-party service when the user did not clearly request Douyin-specific retrieval.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code writes the full fetched comment output to a local file without warning the user in this file or giving them a choice. Even if comments are publicly viewable on Douyin, silent local persistence can create privacy, compliance, and secondary disclosure risks beyond the expected transient retrieval behavior of the skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The tool silently writes fetched post data to a local file without any explicit warning or consent in this file. In the context of a read-oriented skill, this is risky because users may expect transient output only, while the code creates persistent artifacts that can leak through shared filesystems, logs, sync folders, or later forensic access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI persists full search results and request metadata to a local JSON file without an explicit user-facing consent step or clear disclosure at execution time. Because this skill handles user queries about public platform content, the logged keyword, parameters, and returned data may still reveal sensitive research interests, investigative activity, or business monitoring topics to other local users or later processes on the same system.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends user-supplied keywords and search filters to remote APIs to perform the search, but it does not clearly warn users that their input will leave the local environment. In this skill's context, network transmission is expected for functionality, yet lack of disclosure can still create privacy risk because keywords may expose user interests, internal monitoring subjects, or other potentially sensitive research terms.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.