Security audit

guaikei-douyin-instant-public-data

Security checks across malware telemetry and agentic risk

Overview

This is a Douyin public-data lookup tool with disclosed API-token use and local JSON exports, but users should be aware that queries and fetched public comments/profile data are saved locally.

Install only if you are comfortable sending Douyin search terms, target URLs, limits, and a GUAIKEI_API_TOKEN to Guaikei’s API. Treat the generated logs directory as sensitive because it can contain research topics, profile/video identifiers, public comments, and author metadata; delete or protect those files when they are no longer needed. Prefer invoking the skill only for explicit Douyin public-data tasks.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill requires access to the sensitive environment variable `GUAIKEI_API_TOKEN`, but the metadata does not declare permissions or clearly scope that access. This creates a transparency and governance gap: the runtime can consume secrets without an explicit permission contract, making secret exposure or misuse harder to audit.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The changelog claims capabilities beyond the stated four-in-one scope, including 'social data search' and comment analysis, which creates a scope mismatch between advertised behavior and documented intent. In a data-collection skill, undocumented or expanded scraping/analysis functionality can lead to over-collection of user or platform data, misuse by downstream agents, and weakened review controls because operators may rely on the narrower metadata description.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI persists fetched comment results to a local JSON file after printing them, which creates an undeclared secondary data sink. Even if the data is publicly viewable on the source platform, comments can contain personal information, usernames, or sensitive content, and silent local retention increases privacy, compliance, and data-handling risk beyond a simple query tool.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger phrases are very broad (`查一下`, `帮我看看`) and can match ordinary user requests that were not intended to invoke external data collection. This can cause the agent to activate the skill unexpectedly, leading to unintended network access, token use, and collection/logging of user-supplied query terms.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The generalized guidance says the skill should trigger even when Douyin is not named and when the task is embedded in a multi-step research workflow. That increases the chance of silent tool invocation during broad research tasks, causing over-collection, unintended third-party queries, and storage of sensitive business research terms in logs.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that output files are automatically saved to `logs/` with timestamps and query parameters in the filename, but the user-facing description does not clearly warn that their search terms and URLs may be persisted. Query strings can contain sensitive research topics, usernames, or video/account identifiers, creating avoidable privacy and retention risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README explicitly states that scraped Douyin data is automatically exported to local JSON logs, but it does not clearly warn users that comments, author metadata, and other collected public data will be persisted on disk. Even when the source data is public, silent retention increases privacy, compliance, and secondary exposure risk because local log files may later be copied, shared, or indexed unintentionally.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The tool saves fetched comments to a local JSON file without any user-facing warning or explicit consent, so users may believe the operation is transient when it is actually persistent. This is especially risky in a public-data search skill because users may process large volumes of comments containing personal data, and the unnoticed local archive can later be accessed or mishandled.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The CLI persists fetched Douyin results to a local JSON file derived from user input without any explicit consent, opt-out, or visibility to the caller. Even though the filename is partially sanitized, the stored content may include scraped public-profile data or metadata that can accumulate locally and create unintended data retention, privacy, and operational exposure on shared systems.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script reads an API token from the environment and sends user-supplied URL and limit values to remote API functions without making that network transmission explicit in this file's user flow. In a skill context, this can surprise users and leak queried targets or usage patterns to an external service, especially if the skill is invoked as a helper for ostensibly simple lookups.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.