T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:103- Finding
API Token Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-get-hot-ranking
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does the advertised Douyin data lookup, but it needs Review because it handles an API token unsafely, stores full results locally by default, and exposes download-link fields despite saying downloads are unsupported.
Before installing, be comfortable sending your Douyin search terms, creator/video URLs, and GUAIKEI_API_TOKEN to guaikei.com. Treat the token as sensitive, avoid sensitive searches on shared or synced machines, clear the generated logs directory when finished, and verify that returned playback/download URL fields fit your legal and platform-use obligations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:25- Finding
Automatic Plaintext Persistence of Complete API Results
- Content
View full analysis
- Remediation
View remediation
` or `--save`. 2. Do not write any result file when the user has not requested local storage. 3. Create directories and files with restrictive permissions: ```js await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); ``` 4. Provide configurable retention and a cleanup command or automatic expiration policy. 5. Minimize stored fields and omit unnecessary commenter or author identifiers where possible. 6. Clearly disclose automatic or optional persistence in `SKILL.md`, including the location, stored content, permissions, and retention behavior. 7. Warn users against placing the project directory in shared workspaces, public repositories, or broadly collected backup paths. 8. Add `logs/` to `.gitignore` to reduce accidental publication of generated datasets. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (38)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向抖音数据检索/抓取的技能，核心能力应涉及抖音内容访问或相关业务逻辑。但提供的代码片段只是底层通用工具库，用于解析命令行参数和生成帮助文档，没有任何抖音相关接口调用、数据抓取、搜索逻辑、评论获取、热搜获取或作品列表处理。因此，就该代码片段本身而言，其实际行为与声明用途明显不一致。虽然这段代码可能作为整个技能的辅助模块存在，但按当前要求仅比较所给描述与代码行为，应判定为不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill requires access to the sensitive environment variable
GUAIKEI_API_TOKENbut does not declare any explicit tool scope such aspermissionsorallowed-tools. That makes the trust boundary unclear and can allow broader-than-necessary runtime access, increasing the chance of accidental secret exposure or unauthorized use by the skill implementation.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation text uses very broad colloquial phrases like '想搜、想扒、想翻、想追抖音上的东西' and '抖音上这事儿啥情况', which can over-trigger in ordinary conversation. In an agent setting, that can cause the skill to run unexpectedly, sending user queries to a third-party API and consuming a sensitive token even when the user did not clearly request external data access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON schema contains user-facing title and description text only in Chinese, which can amount to a language policy violation when no user opt-in or locale justification is provided. The file does not indicate that the skill is region-specific or that alternative languages are supported.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema explicitly documents
video_urlas including both playback and download addresses, which conflicts with the skill description stating it does not provide download capability. In a scraping-oriented Douyin skill, exposing download URLs can enable users or downstream components to retrieve and redistribute content anyway, undermining declared restrictions and potentially creating policy, copyright, or abuse risk.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON schema uses Chinese titles and descriptions throughout, such as the top-level title/description and nearly every property description. Because the file does not indicate that Chinese is optional, user-selected, or justified by a region-specific scope, it appears to impose a specific language/locale in violation of the language-choice policy.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema explicitly documents
play_addras both a playback URL and a video download address, which conflicts with the skill's stated restriction that it does not provide download capability. In a scraping/search skill for Douyin content, exposing or normalizing a download field can enable downstream agents or users to retrieve media directly, undermining policy, compliance, or platform restrictions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README explicitly advertises automatic JSON log generation and positions the data for later analysis, but it does not clearly warn users that scraped public content may still contain personal or sensitive information that will be persisted locally. In a skill that collects videos, author metadata, and comments at scale, silent local retention increases the risk of unintended exposure, over-retention, or accidental sharing of collected data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README states that search, author-post, and comment data are automatically written into the logs directory with predictable filenames, but it does not clearly warn that potentially sensitive profile and comment data will remain on disk. Because this skill is designed for bulk collection and analysis, persistent local storage materially raises privacy and data-handling risk, especially on shared machines or synced workspaces.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The function sends a token and user-supplied video URL to an external API via requestApi, which is a privacy-relevant network operation. Although the JSDoc describes parameters and errors, it does not disclose to the user that these values are transmitted off-process or to a remote service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This function performs a GET request containing the token and video URL in request parameters, which transmits potentially sensitive or user-related data. The file lacks any confirmation, user-facing log, or explicit warning that this remote lookup occurs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists fetched comment data to a local JSON file automatically after successful execution, without explicit user consent, opt-in, or masking of potentially sensitive content. In this skill's context, comment data can include usernames, text content, and other metadata, so silent local retention increases privacy, compliance, and accidental disclosure risks if the host environment is shared or logs/artifacts are later collected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI persists retrieved Douyin post data to a local JSON file automatically after successful execution, without any consent prompt, opt-in flag, or visible notice before writing. Because this skill is designed to collect social-media content at scale, silently storing results can create privacy, data-retention, and local exposure risks, especially on shared systems or when the output includes metadata users did not expect to persist.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple descriptions and console messages are presented only in Chinese, and the script does not offer any language selection or fallback. That creates a natural-language policy issue when a skill enforces a locale or language without explicit user choice or documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI writes full search results and request metadata, including the user’s keyword, to a local JSON log file without any explicit consent or clear warning at runtime. In this skill’s context, users may search for sensitive topics or individuals on Douyin, so persistent local storage creates a privacy and data-retention risk if logs are later accessed by other users, malware, or backup/sync systems.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code emits user-facing status and error messages only in Chinese, such as the validation errors on L07 and L11. The file provides no indication that the skill is region-specific or that users can opt into a preferred language, which violates the natural-language locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The success and failure messages on L36-L38 are presented only in Chinese, again enforcing a single language for user-visible interaction. Without explicit documentation that this skill is intended only for Chinese-speaking users, this is a policy-relevant language constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user-facing warning and status messages in this file are entirely in Chinese, including operational guidance shown when the token is invalid. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file contains natural-language comments and error/output strings in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest-style JSON file contains user-facing title and description fields exclusively in Chinese, including parameter descriptions. The policy requires flagging language or locale constraints when a specific language is forced without user opt-in or documented justification, and no such choice or justification appears here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON schema contains human-readable title and description fields exclusively in Chinese, which imposes a specific language on users or integrators without offering an alternative or documenting a locale-specific constraint. Under the policy rule, forced language/locale in natural-language content can be a violation when there is no opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The title and description fields force a specific language/locale in natural-language metadata. Under the policy, locale-specific language should either be optional for users or clearly justified as region-specific; this file provides no such justification or alternative.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This manifest file contains all user-facing title and description text in Chinese, including the schema title and parameter descriptions. For a general-purpose skill artifact, this is a language/locale restriction without any visible opt-in, alternative locale, or documented region-specific justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and description are written only in Chinese, which imposes a specific language in the skill metadata without any indication of user opt-in or that the skill is intentionally limited to a Chinese-language or region-specific context. Under the stated policy, locale or language constraints should be explicitly justified or optional.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The setup instructions require storing a private token in the GUAIKEI_API_TOKEN environment variable, which is a credential-handling behavior relevant to user security. A brief warning about protecting the token appears much later in the FAQ, but the initial setup path does not disclose credential sensitivity where users are first told to configure it.
- Content
Static analysis
No suspicious patterns detected.