T09 · Insecure Skill Coding Practices
Error
- Location
src/utils/request.js:94- Finding
Authentication Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-get-creator-posts
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but its credential handling and runtime messages have material safety and disclosure problems that should be reviewed before installation.
Install only if you are comfortable sending Douyin URLs, search terms, result limits, and your GUAIKEI_API_TOKEN to www.guaikei.com. Treat the token as sensitive because this implementation places it in request URLs. Review or patch the authentication-error messages and local logging behavior before using it in shared, regulated, or sensitive environments.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
src/utils/token.js:23- Finding
Runtime Promotional and Contact Output Contradicts the Declared Neutral Authentication Policy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, but this file-level description does not clearly scope or constrain what gets logged. Because the skill processes user queries, URLs, and uses a token-backed API, local log persistence can capture sensitive operational data and create unintended retention or leakage paths on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, but this file-level description does not clearly scope or constrain what gets logged. Because the skill processes user queries, URLs, and uses a token-backed API, local log persistence can capture sensitive operational data and create unintended retention or leakage paths on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, but this file-level description does not clearly scope or constrain what gets logged. Because the skill processes user queries, URLs, and uses a token-backed API, local log persistence can capture sensitive operational data and create unintended retention or leakage paths on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, but this file-level description does not clearly scope or constrain what gets logged. Because the skill processes user queries, URLs, and uses a token-backed API, local log persistence can capture sensitive operational data and create unintended retention or leakage paths on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, but this file-level description does not clearly scope or constrain what gets logged. Because the skill processes user queries, URLs, and uses a token-backed API, local log persistence can capture sensitive operational data and create unintended retention or leakage paths on shared hosts.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states that logs are automatically written to a local
logs/directory, but this file-level description does not clearly scope or constrain what gets logged. Because the skill processes user queries, URLs, and uses a token-backed API, local log persistence can capture sensitive operational data and create unintended retention or leakage paths on shared hosts.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger rules explicitly allow invocation even when Douyin is not named, using broad phrases like '查一下' or '帮我看看' for short-video content, creators, comments, or trends. Overbroad triggers can cause the agent to invoke this external-data skill in contexts the user did not intend, leading to unnecessary access to third-party services, data collection, logging, and possible confusion between platforms.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill explicitly depends on an environment variable (
GUAIKEI_API_TOKEN) but does not declare anypermissionsorallowed-toolsscope indicating access to environment data. This creates hidden capability surface: an orchestrator may grant broader runtime access than users or reviewers expect, reducing transparency and making secret handling harder to audit.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The implicit trigger examples remain ambiguous, especially for requests like competitor research or finding hot content without explicitly naming the platform. In an agent environment, ambiguous routing can result in the wrong skill being called, causing unintended data retrieval, unnecessary token use, and privacy or compliance issues if the request was meant for another platform or internal source.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README presents the skill name and all operating instructions exclusively in Chinese, and section 9/10 defines natural-language command mappings only for Chinese phrases. This effectively imposes a specific language/locale on users without documenting an opt-in or offering alternatives, which matches the language-policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file documents commands to fetch a Douyin creator's published works and a video's comments, which can affect user privacy and involve collection of third-party content data. The documentation provides usage details only and does not include any warning or disclosure about privacy considerations, responsible use, or platform-policy implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code sends a skill token and a video URL to remote API endpoints via requestApi, which is a network operation involving potentially sensitive user or system data. While the functions have developer-facing docstrings, there is no user-facing warning, confirmation, or visible disclosure in this file about transmitting that data externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The GET request places the authentication token in query parameters, which are more likely to be exposed through logs, proxies, browser history, analytics, or intermediary monitoring than headers or POST bodies. In a skill that processes user-supplied Douyin URLs, leakage of this token could let an attacker reuse the credential to query the backend API or perform other authorized actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI persists fetched comment data to a local JSON file after completing a read/query action, creating an undeclared secondary data sink on disk. Comment content can include personal data, sensitive opinions, or identifiers, and silent local retention increases exposure through later access, backup synchronization, or accidental disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The program writes retrieved comments to a local file without explicit user confirmation or a clear indication that query results will be retained. In the context of a skill advertised primarily as search/query functionality, silent persistence is more dangerous because users may reasonably expect ephemeral processing rather than local storage of third-party comment data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code contains user-facing natural-language strings exclusively in Chinese, including status and error messages. Under the policy rule, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings in the CLI, including flag descriptions and help text, are exclusively Chinese with no documented language selection or opt-in. That can violate language/locale policy when a skill mandates one language for all users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Several user-visible error strings are hardcoded in Chinese, including the authentication failure message and request/parse failures, without offering any language or locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This JavaScript code constructs GET query parameters and POST JSON bodies and sends them over HTTPS via
request, which can transmit user or system data to an external service. Within this file there is no confirmation prompt, user-facing notice, or comment/docstring warning users that request parameters, skill name, and payload data will be sent over the network.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-visible warnings and status messages only in Chinese via string literals. Under the language/locale policy rule, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file contains natural-language comments and multiple user-facing error/result strings entirely in Chinese, beginning with the function documentation and continuing throughout the module. Under the policy rule for language/locale, this is a potential violation because the skill does not offer a language choice or document that it is intentionally limited to a Chinese-only context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The title and description fields use Chinese-language text exclusively, which can impose a specific language on users without any opt-in or documented locale restriction. Under the policy, language constraints should either offer a choice or be clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This JSON schema includes title and description text exclusively in Chinese, such as the top-level metadata and property descriptions. Because the file does not indicate that the skill is region-specific or that Chinese is an intentional locale choice, it may impose a language constraint without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON schema contains user-facing title and description strings entirely in Chinese, but it does not document that the skill is China/Chinese-locale specific or offer a language choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The title and description are written only in Chinese, which imposes a specific language on users without any indication of opt-in or an explicit region-specific justification. Under the policy, language constraints should either provide user choice or be clearly documented as intentionally locale-bound.
- Content
Static analysis
No suspicious patterns detected.