Security audit

guaikei-douyin-hotspot-radar

Security checks across malware telemetry and agentic risk

Overview

This Douyin research tool is coherent but needs review because it can trigger on vague requests, sends queries to a third-party API, and automatically saves collected public-platform data locally.

Review before installing. Use this only when you intend to query Douyin through guaikei.com, protect the GUAIKEI_API_TOKEN, avoid invoking it from vague requests, and regularly review or delete the logs directory because it can contain keywords, account URLs, creator data, and comments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The schema explicitly documents `play_addr` as both a playback URL and a video download address, which conflicts with the skill’s stated scope that it does not support downloading videos. Even though this file is only a schema, exposing and normalizing a download-capable field can enable downstream components or users to retrieve content in ways the manifest says are out of scope, creating policy, compliance, and misuse risk.

Vague Triggers

High

Confidence: 93% confidence
Finding: The description says the skill should apply even when the user only says vague phrases like '查一下' or '帮我看看' without naming Douyin, which creates an overly broad activation surface. In an agent environment, this can cause unintended invocation on unrelated tasks, leading to unnecessary external API calls, exposure of user queries to a third-party service, and confusion about user intent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The generalized activation rule allows triggering inside broad multi-step workflows such as 'help me research this sector' even when Douyin is not clearly requested. This increases the chance the skill will overreach its intended scope and collect or transmit data during a workflow where the user did not consent to using this specific external data source.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The statement '纯中文界面' imposes a Chinese-only interface without indicating fallback behavior or user choice. While not a classic security issue, forced locale behavior can impair user understanding of prompts, errors, or consent messages, which is risky when the skill performs external data collection and token-based API access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly promotes automatic JSON log export and storage of scraped search, author, and comment data, but it does not prominently warn that these logs may contain personal or sensitive public-platform data that persists locally. In a scraping and monitoring skill, quiet local retention increases the risk of unintended disclosure, over-collection, and mishandling of comment/account data, especially on shared systems or when logs are later redistributed.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The README instructs users to place an API token in an environment variable, but the warning about token security is buried later in the FAQ rather than presented prominently at setup time. This can lead users to expose credentials through shell history, screenshots, shared terminals, CI logs, or improperly scoped environments, resulting in unauthorized use of the paid API.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The CLI writes the full comment retrieval output to a local JSON file automatically, without explicit user consent or a clear disclosure at the write site. Because comment data can contain user-generated content and potentially sensitive metadata, this creates an unintended local data retention risk, especially on shared machines, CI runners, or multi-user environments. The skill’s purpose is to collect and inspect Douyin comments, which makes silent persistence more dangerous because the stored output is likely to include exactly the third-party data users may assume is only displayed transiently.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI persists fetched results to a local JSON file derived from the queried account URL without any explicit user notice or consent in this file. Because the results may contain scraped creator data and associated metadata, this creates a privacy and data-handling risk: sensitive or regulated data can remain on disk unexpectedly, be read by other local users/processes, or be collected later from logs/artifacts.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code reads an API token from the environment and transmits the user-supplied URL and limit to remote API helper functions, but this file provides no explicit disclosure that user input will be sent to an external service. In a skill that users may invoke casually to 'check' Douyin content, silent transmission of queries to a backend can expose user interests, target accounts, and operational metadata without informed consent.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The CLI writes full search results to a local JSON file named with the user's keyword, which can persist potentially sensitive research topics or collected content on disk without explicit notice. In the context of a search/research skill, this increases privacy risk on shared systems and can unintentionally expose user activity or retrieved data to other local users, backups, or log collection processes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.