Security audit

guaikei-douyin-info-scraper

Security checks across malware telemetry and agentic risk

Overview

This Douyin scraper is mostly coherent, but it needs review because it can trigger on broad requests, sends token-backed requests to a third-party API, and saves scraped results locally by default.

Review this before installing if you use shared machines or sensitive research terms. Use it only for clearly intended Douyin public-data tasks, keep GUAIKEI_API_TOKEN private, expect keywords/URLs to be sent to guaikei.com, and regularly delete the generated logs if they contain research targets or scraped comments you do not want retained.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill explicitly depends on the GUAIKEI_API_TOKEN environment variable, but the manifest does not declare permissions or capability requirements for environment access. This creates a transparency gap: reviewers and users may not realize the skill consumes secrets from the runtime, which increases the risk of unintended secret exposure or misuse if the implementation later logs, forwards, or mishandles the token.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The metadata frames the skill as four narrow data-retrieval capabilities, but the body expands it into broad sentiment monitoring, competitor analysis, and multi-step research workflows. This scope drift can cause agents to invoke the skill in more contexts than a user or reviewer would expect, leading to over-collection of public data and unintended use in monitoring or profiling scenarios.

Intent-Code Divergence

Low

Confidence: 72% confidence
Finding: The skill says it is not suitable for other platforms, yet the trigger guidance allows activation even when the user does not explicitly mention Douyin. This inconsistency can cause accidental invocation on ambiguous requests and may steer an agent to scrape Douyin data when the user meant a different platform or broader research task.

Vague Triggers

High

Confidence: 92% confidence
Finding: The instruction to trigger on generic research requests like 'help me research this track' substantially broadens activation beyond clear user consent for Douyin scraping. In an agent setting, overly broad triggers can cause unauthorized data collection, unnecessary external API use, and silent persistence of collected results in logs without the user specifically requesting this skill.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: Several example trigger phrases, such as generic requests about 'what's hot online' or comment sentiment, overlap with everyday speech and do not uniquely identify Douyin scraping. This increases the chance of mistaken activation and collection of data from an unintended source or for an unintended purpose.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation states that outputs are automatically saved to the logs directory with timestamps and query parameters, but it does not prominently warn that scraped content and possibly sensitive search terms will be persisted locally. This creates a data-retention risk because users may expect ephemeral tool execution while the skill stores research targets, URLs, and collected public data on disk.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The natural-language trigger examples are broad enough that ordinary user phrasing like '搜一下', '最近发了什么', or '网上火啥' could invoke this skill in contexts where the user did not specifically intend Douyin scraping. That can cause over-triggering, unintended collection of third-party data, and execution of external commands/API calls with user context or configured tokens.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The intent-priority rules rely on highly generic words such as '热搜', '搜索', '找', '视频', and '博主', which are common across many unrelated requests. In an agent setting, this ambiguity can route user input to the wrong capability, causing unintended scraping actions, privacy issues, or unnecessary use of authenticated external services.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This documentation explicitly enables collection of Douyin creator posts and video comments at scale, including up to 10,000 records, but provides no guidance on privacy, lawful basis, retention, or platform Terms of Service considerations. In the context of a scraping skill, that omission increases the risk of misuse for profiling, surveillance, or bulk harvesting of user-generated content and identifiers.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The GET request places the token, video URL, and limit in query parameters, which are more likely to be exposed through proxy logs, browser/network tooling, monitoring systems, and intermediary infrastructure than request bodies or headers. In a scraping skill handling user-provided Douyin URLs and an authentication token, this increases the chance of credential leakage and disclosure of user activity or queried content.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI silently persists fetched creator-post results to a local file, which can expose browsing targets, scraped content, and potentially sensitive metadata to other local users, backup systems, or later unintended processing. In a scraping skill context, undisclosed retention increases privacy risk because users may reasonably expect one-time retrieval rather than durable storage.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code writes the full request and returned search results to a local file, including user-provided keywords and potentially sensitive scraped content, without any user-facing disclosure or consent mechanism. This creates a privacy and data-retention risk, especially on shared hosts or agent environments where logs may be accessible beyond the immediate user session.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.