Security audit

guaikei-douyin-fetch-trending-feed

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin public-data purpose, but it needs Review because it handles an API token unsafely and contradicts its own runtime-disclosure claims.

Before installing, confirm you are comfortable sending Douyin search terms, target URLs, limits, and a Guaikei API token to www.guaikei.com. Treat the token as sensitive, rotate it if previously used with this version, and review/delete generated logs because fetched comments and account metadata can remain on disk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/api/search.js:59
Finding: API Token Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

other

Note

Location: src/utils/token.js:23
Finding: Runtime Promotional Output Contradicts the Declared Neutral Authentication Policy
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 描述将技能表述为覆盖多个抖音公开信息场景的综合能力，但该代码片段的实际功能明显更窄，只是关键词搜索相关的任务创建与结果查询。虽然“搜内容”与部分‘话题是否火’类用途可以由搜索支持，但“读评论”“热搜”“博主作品抓取”在当前代码中都没有体现，因此描述相对代码存在能力夸大/范围不符的情况。未发现剪辑、发布、下载等额外敏感能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 声明描述的是一个面向抖音公开信息的综合型技能，能力边界包括内容搜索、博主作品抓取、评论读取和热搜查看。当前代码块的实际功能明显更窄，只实现了“获取抖音博主作品列表”这一子能力：解析URL/sec_uid和limit参数，调用 post.createPostTask / post.getPostTask 获取作品结果，输出JSON，并保存到本地日志。就主目的而言，它与声明中的“扒博主作品”部分一致，但并不能支持声明中提到的搜内容、读评论、瞅热搜等能力。因此描述对该代码块存在明显过度概括。另一个未声明但实际存在的行为是把结果写入日志文件，不过这更像支持性实现细节，次要于前述能力范围不一致。综合判断为存在描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开信息检索的技能，核心能力应与内容搜索、评论读取、热搜查看等平台数据访问相关。但提供的代码并未体现任何抖音、短视频平台、内容抓取、搜索或评论处理逻辑，而只是一个与业务无关的通用 CLI 参数解析器。其主要用途与声明的技能目的完全不同，因此属于明显的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a user-facing skill for fetching public information from Douyin or similar short-video contexts. However, the supplied code chunk is only a utility module for standardized error types. While such a module could support a larger Douyin-related skill, this chunk itself does not perform the declared actions or demonstrate matching platform access, triggers, or core behavior. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开信息检索与浏览的技能，核心能力应涉及网络查询、内容抓取或平台数据读取。但提供的代码片段并未体现任何与抖音、短视频平台、搜索、评论、热搜或博主作品相关的行为，而是一个本地日志写入模块。其主要功能是向本地 logs 目录写文件，这与声明用途在核心目的和资源访问类型上都明显不一致。虽然日志记录可作为辅助实现细节，但当前代码片段唯一呈现的能力就是文件系统写入，且没有任何与声明目标相关的行为，因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill should retrieve and analyze public information from Douyin or similar short-video platforms. However, the supplied code does not implement any such functionality. It simply accesses the local filesystem, reads package.json, and returns the package name. This is a materially different purpose and uses a different resource (local files rather than Douyin/public platform data), so it is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音公开信息检索与浏览的技能，核心能力应与内容搜索、评论读取、热搜查询或账号作品分析相关。但提供的代码并未体现任何抖音平台访问、公开信息抓取、搜索、评论读取或热搜处理逻辑；它只是一个底层的通用重试辅助函数。虽然这类工具代码可能作为更大技能的支持实现存在，但就该代码片段本身而言，其实际行为与声明用途没有直接对应关系，属于主要目的明显不一致。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs broad auto-triggering for general short-video research even when the user did not mention Douyin. That can cause unintended invocation, unnecessary external data access, and over-collection relative to user intent, which is especially risky for agentic systems that should minimize scope and platform assumptions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill requires access to the environment via GUAIKEI_API_TOKEN, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: an agent may invoke the skill without clear disclosure or policy restriction around environment access, making secret handling and execution boundaries less auditable.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The phrase "纯中文界面" indicates a fixed language requirement. This is a natural-language policy concern because it forces a specific locale without documenting user opt-in or a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains natural-language title and description fields entirely in Chinese, which can impose a specific language on users or integrators without opt-in. Under the policy, forcing a specific language without user choice or documented justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The schema explicitly documents video_url as both playback and download addresses, which conflicts with the skill description stating it is not intended for downloading. This mismatch can enable downstream agents or integrators to use the skill for prohibited content retrieval, expanding the skill’s effective capability beyond its declared scope and creating policy/compliance risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents play_addr as both a playback address and a video download address, which conflicts with the skill metadata stating the skill is not for downloading videos. That mismatch can enable downstream agents or integrators to use the skill for unintended content acquisition, bypassing the stated safety boundary and increasing the risk of policy, copyright, or platform-terms violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README advertises automatic JSON log generation for searches, posts, comments, and hot-list results, but it does not clearly warn that scraped public data and user-requested content will be persisted locally under the logs directory. This can lead operators to unknowingly retain potentially sensitive or regulated data such as comment text, account identifiers, or monitoring targets, increasing privacy, compliance, and accidental disclosure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README instructs users to configure GUAIKEI_API_TOKEN and use a vendor website to obtain it, but it does not explicitly disclose that the token and associated request data are sent to an external service during operation. In a scraping/monitoring skill, this omission is risky because operators may assume processing is entirely local, leading to uninformed transmission of credentials, search terms, URLs, and collected targets to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI persists fetched comment results to a local JSON file after printing them, but this file provides no explicit notice, consent mechanism, retention control, or redaction of potentially sensitive user-generated content. In the context of scraping public social-media comments, local persistence increases privacy and data-handling risk because comment text, usernames, or metadata may remain on disk longer than the operator expects and could be exposed to other local users, backups, or later compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code includes multiple user-facing strings in Chinese, such as status messages and error text, but does not provide any visible mechanism for user language selection or opt-in. That creates a natural-language policy concern because the skill appears to force a specific language for all users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code persists the full command output, including the requested URL and fetched results, to disk via log.taskWrite. Although the skill prints progress messages, there is no clear user-facing warning here that execution will create a local file containing the retrieved data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI writes the full search output, including user queries and returned content, to a local JSON file without explicit consent, opt-in, or clear disclosure. This creates a privacy and data-retention risk because sensitive investigative queries or scraped public content may persist on disk and be accessible to other local users, backup systems, or later unintended processing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits a user-facing authentication error entirely in Chinese, including remediation guidance, which imposes a specific language on users without opt-in. Under the policy, locale or language restrictions must either offer user choice or be clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains user-facing title and description fields entirely in Chinese, including parameter descriptions. For a general-purpose skill artifact, this imposes a specific language/locale without offering user choice or documenting a justified region-specific constraint, which matches the policy-violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains natural-language titles and descriptions exclusively in Chinese, including the top-level title/description and per-field descriptions. Under the policy criteria, forcing a specific language without user opt-in or documented justification is a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The schema title and all human-readable descriptions are written in Chinese, which can impose a specific language on downstream users or tooling without any stated opt-in or locale constraint. Under the language/locale policy rule, this is a natural-language policy concern because the file provides no indication that Chinese-only output is optional or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions such as the title and property descriptions, with no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment. Under the language/locale policy, forcing a specific language without opt-in or documented justification can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains user-facing title and description text only in Chinese, and similar Chinese-only descriptions continue throughout the file. For a generally applicable skill artifact, forcing a specific language without user opt-in or an explicit region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.