Security audit
Security checks for vulnerabilities and agentic risk
The skill largely matches its Douyin public-data purpose, but it needs Review because it handles an API token unsafely, can trigger on overly broad requests, and saves collected data locally by default.
Install only if you are comfortable sending Douyin queries, target URLs, and your GUAIKEI_API_TOKEN to guaikei.com. Treat the token as potentially exposed because it is placed in request URLs, and avoid using this skill for sensitive investigations unless logs are controlled or cleaned up. Prefer explicit Douyin-only prompts so the skill is not invoked for generic research requests.
src/utils/request.js:104API Token Transmitted in URL Query Parameters
src/utils/token.js:23Runtime Promotional Output Contradicts the Declared Neutral-Error Policy
src/utils/request.js:21Unbounded Buffering of Remote HTTP Responses
声明描述的是一个面向抖音公开数据检索与分析的技能，但提供的代码片段仅实现了通用参数解析与帮助文本生成。这类代码可作为底层支持组件，但就该代码块本身而言，其实际行为与声明的核心能力没有直接对应关系。根据评估标准，支持性实现细节本可不单独判为不匹配；但这里代码块完全没有展示任何与抖音、公开数据抓取、搜索、评论、热榜或相关资源访问有关的行为，主要目的与声明明显不同，因此应判定为描述与行为不匹配。
声明描述的是面向抖音公开数据检索与分析的能力，但实际代码片段仅是一个日志写入模块，没有任何抖音搜索、评论读取、热榜查询或网络抓取逻辑。虽然日志功能可能是辅助实现细节，但这里提供的代码实际暴露了文件系统写入这一声明中未提及的能力，而且其当前行为与声明的主要用途完全不一致。因此应判定为描述与代码行为不匹配。
The declared description presents a Douyin public-data retrieval skill with multiple platform-facing analysis capabilities. However, the supplied code chunk is merely a local utility that reads package.json from disk and returns the package name. This is materially different from the declared primary purpose and does not evidence any of the advertised Douyin-related behavior. While this may be a supporting helper in a larger codebase, based on the supplied chunk alone, the actual behavior does not match the declared functionality.
The skill declares use of an environment variable token but does not define an explicit tool/permission scope. That creates ambiguity about what runtime capabilities the skill is allowed to access and weakens least-privilege controls, especially around secret access.
The trigger conditions are broad enough to activate on generic research requests even when the user did not ask for Douyin specifically. Over-broad activation can route unrelated tasks into a data-collection skill, causing unnecessary external queries, scope creep, and unintended handling of user requests.
Examples such as generic analysis phrases overlap heavily with ordinary assistant requests, increasing the chance of unintended invocation. In a skill that can access external data and tokens, accidental triggering expands data exposure and can produce results from the wrong platform or context.
The schema explicitly documents video_url as including both playback and download addresses, which conflicts with the skill's stated restriction that it is not for downloading videos. This mismatch can enable downstream agents or integrators to treat downloading as a supported capability, increasing the risk of policy bypass, copyright misuse, or collection of content in ways the skill claims to prohibit.
The schema explicitly documents play_addr as both a playback URL and a video download address, which conflicts with the skill's stated restriction that it is not for downloading videos. That mismatch can enable downstream agents or integrators to expose or rely on download functionality that the manifest says is out of scope, increasing policy bypass and misuse risk.
The README advertises automatic JSON log generation and later describes filenames for saved search, post, and comment outputs, but it does not prominently warn that scraped public data and comment content will be written to local disk by default. This creates a data-handling risk because users or downstream agents may unknowingly persist potentially sensitive personal data, increasing exposure through local compromise, backup sync, or accidental sharing.
The natural-language trigger examples are broad enough that ordinary requests like '找 AI 相关视频' or '今天什么火' could activate the skill unintentionally when a user did not explicitly intend to use Douyin scraping. In an agent setting, this can cause unintended collection of third-party data, unexpected external API usage, and accidental storage of scraped results to disk.
The intent-recognition rules prioritize very generic keywords such as '热搜', '热点', '榜单', '搜索', and '找', which overlap heavily with common speech and many unrelated tasks. In a multi-skill agent, this increases the chance of misrouting benign user requests into a scraping workflow, leading to unintended external requests, token usage, and retention of public comments or account data.
The changelog content and title are entirely in Chinese, which can amount to a language-policy issue if the skill is expected to be generally usable across users without forced locale assumptions. There is no indication in this file that Chinese is optional, user-selected, or required for a justified region-specific use case.
This markdown file documents commands for retrieving a creator's works and up to 10,000 comments, which can affect privacy expectations and involve bulk data collection. Under the markdown-specific warning criterion, the description lacks any caution or disclosure about handling user-generated content, respecting platform rules, or safeguarding collected data.
The CLI writes fetched comment data to a local JSON file after printing results, creating an undisclosed persistence channel for user-requested data. In the context of a read/query skill that explicitly says it is not for downloading or exporting platform data, silent local retention increases privacy, compliance, and data-handling risk if comments contain personal information or the host environment is shared.
This code uses Chinese-only natural-language strings in comments, user-facing error messages, and success output, but does not provide any user opt-in or alternative locale handling. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.
The manifest describes a skill for querying public Douyin data such as videos, creator posts, comments, and trending rankings. This file additionally depends on a secret credential from process.env, which is not mentioned in the stated purpose and introduces a credential-access capability beyond the user-facing data lookup intent.
The CLI writes fetched results to a local JSON file after completing the request, which creates persistent storage of scraped public-data results without any notice or opt-in in this file. Even if the source data is public, local persistence can accumulate sensitive profiling data, leak through shared workspaces, backups, or later compromise, and exceeds a strictly transient read/search expectation.
This file silently saves fetched post data to disk without explicit warning, consent, or a visible configuration toggle. Silent data retention is risky because users may assume a read-only lookup tool leaves no local traces, while the saved JSON may contain URLs, post metadata, and derived monitoring data that can be accessed by other local users or processes.
The CLI writes the full search output, including query terms and returned public-data results, to a local JSON file without explicit user consent or a documented retention policy. Even if the data is public, local persistence expands exposure by creating a secondary data store that may be readable by other local users, backup systems, or unrelated processes.
The code emits user-facing error messages in Chinese only (e.g. at L07 and L11), which imposes a specific language on users. Under the policy, locale or language must not be forced unless the skill offers user choice or clearly documents a justified regional constraint.
This string hard-codes a Chinese response and directs users to a specific WeChat contact, which imposes a language/locale choice on all users regardless of their preferences. The policy allows locale constraints only when explicitly justified or offered as an opt-in, which is not present here.
This code constructs all user-facing text in Chinese, including headings and labels, with no indication that the skill is intentionally limited to a Chinese-speaking audience or that users can choose another language. That creates a natural-language policy issue under the locale/language rule because the skill implicitly forces a specific language without opt-in.
This JavaScript file contains natural-language comments and user-facing error/output strings exclusively in Chinese, indicating the skill enforces a specific language/locale. Under the policy, forcing a language without user opt-in or documented justification is a natural-language policy violation.
The environment section states "纯中文界面", which imposes a specific language/locale in the skill description. There is no user opt-in, alternative language option, or documented justification that the tool is region-specific for compliance reasons.
The natural-language metadata in the schema is entirely Chinese, including the title and field descriptions. This imposes a specific language on users or downstream tools without any visible opt-in, alternative locale, or explanation that the skill is intended only for a Chinese-language context.
No suspicious patterns detected.