T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Token Exposed Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-hotspot-radar
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it needs review because it sends a private API token in URL parameters, logs collected research data automatically, and has broader activation rules than the Douyin-only purpose requires.
Review before installing. Use a low-privilege/revocable Guaikei token, assume your keywords and Douyin URLs are sent to the Guaikei service, and periodically delete or protect the generated logs. Be cautious with ambiguous prompts because the skill may activate even when Douyin is not explicitly requested.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/request.js:51- Finding
Authentication Errors Emit Undocumented Promotional and Personal Contact Information
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill says it uses minimal permissions and 'does not write to the filesystem (except logs),' while also stating that it automatically saves outputs to
logs/with timestamps and query parameters. Undeclared or under-emphasized local persistence creates privacy and data-handling risk, especially when search keywords, account URLs, or video URLs may contain sensitive investigative context.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill says it uses minimal permissions and 'does not write to the filesystem (except logs),' while also stating that it automatically saves outputs to
logs/with timestamps and query parameters. Undeclared or under-emphasized local persistence creates privacy and data-handling risk, especially when search keywords, account URLs, or video URLs may contain sensitive investigative context.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill says it uses minimal permissions and 'does not write to the filesystem (except logs),' while also stating that it automatically saves outputs to
logs/with timestamps and query parameters. Undeclared or under-emphasized local persistence creates privacy and data-handling risk, especially when search keywords, account URLs, or video URLs may contain sensitive investigative context.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger guidance is intentionally broad: phrases like '查一下' or '帮我看看' can invoke the skill even when the user did not mention Douyin. Over-broad activation can cause unintended collection, network access, and token use in unrelated workflows, which is especially risky for a data-scraping skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill explicitly depends on the environment variable
GUAIKEI_API_TOKENbut does not declare any tool scope or permissions metadata. That omission weakens reviewability and can lead to over-broad execution assumptions, because the runtime may expose environment access without users or reviewers seeing it clearly in the manifest.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The generalized trigger condition for broad research tasks lacks clear scope boundaries, making it easy for the agent to route ambiguous multi-step requests into this skill without informed user intent. That increases the chance of unnecessary external queries and data persistence during broader investigations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that outputs are automatically written to
logs/and filenames include timestamps and query parameters, but the description does not prominently warn users about this persistence. Search terms, account URLs, and video URLs can reveal sensitive business research, investigations, or user interests, so silent logging materially increases privacy risk.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The statement "纯中文界面" indicates a fixed language constraint. The file does not offer opt-in, alternative locales, or a justified compliance reason for restricting the interface language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions throughout, including the top-level title/description and field descriptions. For a generally applicable skill asset, that imposes a specific language/locale without any opt-in or documented justification, which matches the policy-violation criteria for language or locale constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The title and property descriptions are written only in Chinese, which imposes a single language on users of the skill schema. The file does not indicate that the skill is region-specific or provide any language choice, so this is a natural-language policy concern under the locale/language rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions throughout, including the top-level title/description and every property description. Under the policy rule, forcing a specific language without user opt-in or documented region-specific justification is a natural-language locale violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest explicitly says the skill does not handle video downloading, but this response schema defines
play_addras both a playback address and a '视频下载地址' (video download address). That indicates the skill exposes download-capable output not aligned with its stated scope.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises automatic JSON log exports of scraped content but does not warn that these files may contain collected public data, user queries, identifiers, and potentially sensitive monitoring outputs retained on disk. Without retention and access guidance, users may unknowingly accumulate local datasets that increase privacy exposure, insider access risk, and regulatory handling obligations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to run commands that send search keywords, profile URLs, and video URLs to a third-party service requiring a GUAIKEI_API_TOKEN, but it does not clearly disclose that this user-supplied data is transmitted off-box to an external API. This can mislead users and downstream agents about where sensitive research targets or monitoring subjects are being sent, creating privacy, compliance, and consent risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code sends the user's search keyword and a skill token to an external API via requestApi, which is a network operation involving potentially sensitive user or system data. While the function has developer-facing docstrings, there is no confirmation prompt, user-facing log/print, or other disclosure in this file indicating that these values will be transmitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The GET request includes the token and keyword in request parameters, transmitting them to a remote API. This file does not provide any user-facing notice, confirmation, or logging that informs the user their query data and token are being sent off-box.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language comments and labels throughout the file are entirely in Chinese, with no indication that the skill supports other languages or that Chinese-only operation is an intentional, justified locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file contains multiple user-facing strings entirely in Chinese, including status, errors, and success messages. Because the skill does not offer any language/locale opt-in or explain that it is intentionally Chinese-only, it may violate the language/locale policy for natural-language behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script accesses
process.env.GUAIKEI_API_TOKENand then uses the resulting token in remote task-creation and retrieval calls. Access to sensitive credentials and outbound network use are safety-relevant operations; while the code logs fetch progress, it does not clearly disclose that an environment-stored credential is being used for external API requests.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI writes the full fetched results to a local JSON file automatically after successful execution, without any explicit notice, consent, or opt-in from the user. Because the tool handles social-media research data and may include scraped content or metadata, this creates an unexpected local persistence risk where sensitive or regulated data can remain on disk and be exposed to other local users, backups, or later compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This module performs outbound HTTPS GET and POST requests and sends URL parameters and JSON bodies, but the code contains no confirmation prompt or user-facing disclosure about transmitting data. In this file, the docstring describes the API request method generically and does not warn that supplied params/data will be sent to a remote host.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file uses Chinese-only docstrings and user-facing error/output strings throughout, such as the validation errors and formatted result messages. That imposes a specific language on users without offering any locale selection or documenting that the skill is intentionally region-specific, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON schema contains user-facing title and description strings exclusively in Chinese, which imposes a specific language on users without any opt-in or stated regional limitation. The policy allows locale constraints only when they are optional or clearly justified, which is not indicated here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The schema's human-readable title and field descriptions are entirely in Chinese, which can impose a specific language on downstream users or tools without any documented opt-in or locale justification. Under the policy rule, natural-language locale constraints should either offer choice or clearly state a justified region-specific scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The title and field descriptions are written only in Chinese, which can impose a specific language/locale on users without any opt-in or documented regional justification. This matches the policy category for language or locale constraints expressed in natural-language content.
- Content
Static analysis
No suspicious patterns detected.