T01 · Skill Instruction Hijacking
Error
- Location
src/utils/request.js:51- Finding
Deceptive Authentication Errors Inject Promotional Contact Information into Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-info-scraper
Security checks for vulnerabilities and agentic risk
Overview
This Douyin scraper mostly matches its purpose, but it needs Review because it handles tokens, broad triggers, and saved scraped data in ways users may not expect.
Review before installing. Use only with a dedicated, revocable Guaikei token; avoid sensitive research on shared machines; monitor and delete logs/ outputs; and confirm you have a lawful basis and provider permission before collecting or redistributing Douyin comments, profiles, or creator data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
src/utils/request.js:106- Finding
API Credential Is Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:27- Finding
Explicit API Errors Trigger Excessive and Potentially Duplicate Retries
- Content
View full analysis
{ let response; if (method === "POST") { response = await postJson(path, params, data); } else { response = await getJson(path, params); } return response; }, maxAttempts, (attempt, err) => { utils.printError( `[${actionName} retry] ${attempt + 1}/${maxAttempts} - ${err.message}`, ); }, ); } ``` The quoted log template is an English rendering of the original string; retry behavior is unchanged. `src/utils/retry.js:11-31`: ```js async function withRetry(fn, maxAttempts, errorHandler) { let lastError; for (let a ...[truncated 2936 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (44)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states that output files are automatically saved to
logs/with timestamps and query parameters, but the higher-level description does not foreground that user queries and returned data are persisted locally. For a tool handling search queries, creator URLs, and comment-analysis requests, silent logging can expose sensitive research topics, user interests, or collected data to other local users/processes.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill explicitly depends on the environment variable
GUAIKEI_API_TOKEN, but the manifest does not declare tool scope or permissions for environment access. This creates a transparency and least-privilege problem: the runtime may expose secrets without users or the platform clearly understanding that env access is required.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest says the skill should also trigger for broad requests like short-video research, competitor analysis, or viral-topic ideation even when the user does not mention Douyin. That overbroad trigger can cause unintended activation in unrelated workflows, leading the agent to send user queries or URLs to this external API and to log results without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that output files are automatically saved under
logs/, but users are not prominently warned that their queries and fetched results may be persisted locally. This creates a privacy and data-retention risk, especially for sensitive research terms, monitored accounts, or comment datasets that may contain personal data.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The text states "纯中文界面" as a fixed constraint, which is a language policy choice affecting all users. The file does not offer a language choice, opt-in, or explain why the restriction is necessary for a region-specific compliance or technical reason.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema contains user-facing natural-language strings such as the title and descriptions entirely in Chinese, and it does not indicate that Chinese is optional or limited to a region-specific context. That can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README promotes exporting scraped data and automatic local log storage but does not give a clear, prominent warning about retention, sensitivity, or downstream handling of collected comment/author/content data. In a scraping skill, this omission increases the chance that users or downstream agents persist third-party data unnecessarily, exposing potentially sensitive content through local files, reports, or accidental sharing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill defines broad natural-language triggers such as '热点', '搜索', '视频', and '今天什么火', which overlap with common conversational phrases and can cause the agent to invoke this scraping skill when the user did not clearly request Douyin data collection. In this context, mistaken invocation is more dangerous because the skill performs external data retrieval and local logging/export, so an ambiguous utterance can trigger unintended scraping and data handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents the skill interface and parameter expectations entirely in Chinese, including line L07 stating keywords must be '汉字或单词', which effectively centers a specific language/locale without any opt-in or explanation. Under the policy rule, a forced language/locale constraint should be documented as optional or justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code sends a user-provided search keyword and a skill token to a remote API when creating a search task. Although the functions are documented for developers, there is no visible confirmation prompt, user-facing log, or explicit disclosure in this file that user input and authentication data will be transmitted over the network.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code places the token and search keyword into GET query parameters, which are more likely to be exposed through logs, browser history, proxy records, analytics, and intermediary infrastructure than request bodies or headers. Because the skill handles Douyin searches, the keyword may contain sensitive user interests and the token is an authentication secret, so leakage could enable privacy exposure or unauthorized API use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The comments and descriptive strings in this file are entirely in Chinese, which indicates a language-specific skill artifact without any visible user choice, opt-in, or justification for a locale restriction. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language strings in comments and user-facing output are consistently Chinese, including error and success messages, with no indication that the user can choose another language or that the skill is restricted to a Chinese-only audience. This can violate a language/locale policy when a skill imposes a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI automatically persists fetched results to a local JSON file using a filename derived from user input, without any notice, consent, or opt-in flag. Even though the filename is sanitized, the contents may still contain sensitive or unexpected data from the queried Douyin account, creating privacy and data-retention risk on shared systems, CI runners, or agent environments where users may not realize output is being stored.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The tool silently writes search results to a local JSON file without any user-facing notice or consent. Because the output may include user search terms and scraped content, this can create a privacy issue and unintended data persistence, especially on shared systems or in environments where local files are collected by monitoring or backup tooling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file contains multiple user-visible messages in Chinese, such as the API error fallback text, timeout/network errors, and parameter validation messages. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JavaScript file uses Chinese exclusively in docstrings and error/output strings, including validation messages and the formatted result message. Under the policy rule for natural-language violations, this is a locale/language restriction with no visible opt-in, fallback, or justification that the skill is region-specific.
- Content
Static analysis
No suspicious patterns detected.