T09 · Insecure Skill Coding Practices
Warning
- Location
src/api/search.js:101- Finding
API Token Exposed in HTTPS Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-full-scan-posts
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its Douyin data-lookup purpose, but it handles its API token unsafely and its runtime authentication errors contradict the stated neutral-error policy.
Review before installing. Use a low-privilege, revocable GUAIKEI_API_TOKEN, assume searches and Douyin URLs are sent to www.guaikei.com, and be aware that result JSON files are saved locally by default. The publisher should move authentication out of query strings, remove runtime contact/promotional messages, narrow triggers, and add log opt-out or retention controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:23- Finding
Runtime Authentication Errors Contain Prohibited Promotional and Contact Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (51)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, which introduces filesystem write behavior not prominently bounded by the declared capability model. Even if intended for debugging, local logging can capture user queries, URLs, API responses, or error details, potentially leading to retention of sensitive data or accidental disclosure on shared hosts.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill explicitly depends on an environment variable (
GUAIKEI_API_TOKEN) but does not declare any tool scope such aspermissionsorallowed-tools. That creates a least-privilege gap: the runtime may grant broader access than necessary, making secret access implicit rather than auditable and increasing the chance of unintended secret exposure or misuse.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The implicit triggers include broad phrases like '帮我做短视频竞品调研', '找减肥类高赞内容', and '最近什么热门', which can overlap with many ordinary requests and cause the skill to activate outside clearly intended scope. Over-triggering a data-collection skill is risky because it may initiate external queries, consume quota, log user input, or access the API token when a narrower or different skill should have handled the request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This manifest-style JSON file contains natural-language title and description fields exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a language/locale policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill defines trigger phrases such as '搜索 / 搜一下 / 找 + 关键词' and related colloquial examples broadly enough that normal conversation about Douyin content could invoke the skill unintentionally. In an agent setting, overbroad activation can cause unauthorized external data retrieval, unexpected token-backed API usage, and leakage of user intent to a third-party service even when the user did not mean to run this skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The intent recognition priority uses generic words like '热搜', '搜索', '评论', and '视频' that commonly appear in ordinary discussion, increasing the chance of accidental skill execution. Because this skill performs external lookups and may consume a configured API token, false-positive triggering can lead to unnecessary data access, quota consumption, and unintended transmission of user queries to the vendor backend.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function sends a user-provided Douyin video URL and requested comment limit to an external API endpoint, which can expose user activity and potentially sensitive content metadata to a third party. Even if this is functionally required, the code shows no consent, minimization, or disclosure mechanism, so users may be unaware that their queried content is being transmitted off-platform.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The task query transmits the authentication token together with the video URL and limit to a remote API, increasing sensitivity beyond ordinary content lookup. If the remote endpoint, logs, or intermediaries are compromised, the token could be abused for unauthorized API access or correlation of user activity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code sends a skill token and user-supplied search keyword to remote API endpoints via requestApi in both task creation and task query flows. While the functions are documented for developers, there is no user-facing prompt, warning, or disclosure in this file indicating that user input and authentication data will be transmitted over the network.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code file contains natural-language comments entirely in Chinese, which implies a fixed language choice for maintainers or operators without any opt-in or documented region-specific justification. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI persists fetched comment data to a local JSON file after already printing the full results, creating an additional storage side effect that is not apparent from the skill's user-facing description. Comment content may contain personal data or sensitive opinions, and writing it to disk increases exposure through residual local files, later collection, or accidental disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code silently writes the retrieved comment results to a local file without a user-facing warning at the point of write, so users may reasonably believe the tool only fetches/displays data. Silent persistence is risky because it leaves behind a durable copy of potentially sensitive third-party content that can be accessed by other local users, backups, or later processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The command reads an API token from the environment and sends network requests using the provided Douyin URL and limit through
createPostTaskandgetPostTask. While the command's purpose suggests fetching remote data, this file does not explicitly warn users that their supplied URL and token-authenticated requests will be sent to an external service.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists the full fetched Douyin post results to a local JSON file after completing the user-facing action. This creates undisclosed secondary data retention of potentially sensitive browsing/query output, which can expose user activity or collected content to other local users, backup systems, or later compromise without any clear need communicated in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code writes the complete command output to a local file via log.taskWrite without any user-facing warning or consent flow in this file. Silent local persistence increases privacy and compliance risk because users may reasonably expect a retrieval skill to only display results, not retain them on disk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The CLI does more than transiently search and print results: it later persists the full output, including the user's search keyword and returned content, to a local JSON file. In a search skill, that creates undisclosed data retention and can expose sensitive interests, queries, or scraped content to other local users, backup systems, or later processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code writes the complete search output to a local JSON file without an explicit warning or consent flow, creating silent persistence of user queries and results. This is risky because search terms and returned content may be sensitive, and local file retention broadens exposure beyond the immediate command execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains user-facing error text in Chinese only, such as 请求失败, without offering a language choice. Per the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified.
- Content
Static analysis
No suspicious patterns detected.