T01 · Skill Instruction Hijacking
Warning
- Location
src/utils/token.js:23- Finding
Authentication Error Paths Emit Undisclosed Promotional and Contact Information
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-instant-public-data
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it has review-worthy risks around broad auto-activation, API token handling, automatic data logging, and undeclared promotional runtime messages.
Review before installing. Use only when you intend to send Douyin search terms, creator URLs, video URLs, and a GUAIKEI API token to the third-party service. Avoid sensitive keywords, protect or delete generated logs, and prefer a revised version that sends tokens in an Authorization header, narrows activation to explicit Douyin requests, and removes runtime promotional/contact messages.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
src/utils/request.js:99- Finding
API Token Is Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill states that it writes output files into
logs/with names derived from timestamps and query parameters, despite positioning itself mainly as a data-query skill. Local file writes increase the attack surface because user-controlled query strings may reach filenames or stored content; if sanitization is incomplete, this can lead to path manipulation, sensitive-data persistence, or unintended retention of queried content.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are extremely broad, including common phrases like '查一下' and '帮我看看', and the skill even says it may trigger when the user did not explicitly mention Douyin. Over-broad activation can cause the agent to invoke external data collection unexpectedly, sending user queries to a third-party API and using credentials in contexts the user did not clearly authorize.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill explicitly relies on the sensitive environment variable
GUAIKEI_API_TOKEN, but the manifest does not declare any corresponding tool scope or permission boundary. This creates a least-privilege and reviewability gap: operators cannot easily tell from the manifest that the skill needs secret access, increasing the chance of over-broad execution in environments where additional secrets are present.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The generalized activation rule for multi-step research tasks is ambiguous and permits the skill to insert itself into broader workflows without a clear user request for Douyin data collection. In agent settings, this increases the risk of scope creep, unintended external API calls, and collection of platform-specific data when the user only asked for general research.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The statement "纯中文界面" indicates a mandatory language constraint. Because the file does not offer a language choice, opt-in, or a documented compliance reason for restricting language, this is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The schema title and description are written only in Chinese, which imposes a specific language on users and downstream tooling without offering any language choice. The file does not document that this schema is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions throughout, including the schema title and every property description. Under the policy rule, forcing a specific language without opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON schema contains natural-language titles and descriptions exclusively in Chinese, including the top-level title/description and per-field descriptions. For a generally scoped skill artifact, forcing a single language without documenting locale constraints or offering a language choice is a language-policy issue under the stated rules.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README explicitly states that fetched data is automatically exported to JSON logs, including search results, author works, and comments, but it does not clearly warn that these logs may contain locally stored personal or sensitive public data. In this skill context, collecting and persisting large volumes of comments and author-related metadata increases privacy and data-handling risk because users may unknowingly retain or redistribute scraped data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file’s natural-language content is entirely in Chinese, including the title and feature descriptions, with no indication that users can choose another language. Under the policy rule for language/locale, this can be a violation because it effectively forces a specific language without explicit user opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file documents commands that retrieve comment data from Douyin content, which can affect privacy expectations and involve bulk collection of user-generated data. The description provides usage syntax and examples but does not include any warning or disclosure about handling public comment data, respecting platform terms, or privacy considerations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code sends a skill token and user-provided search keyword to a remote API via requestApi, which is a privacy-relevant network operation. Although the function has technical docstrings, there is no visible user-facing warning, confirmation, or disclosure in this file that user input and token data will be transmitted externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The GET request includes the token, keyword, and filtering parameters in a remote API call, which involves transmitting potentially sensitive user or system data. The file contains no visible confirmation prompt, user-facing log, or explicit warning that these values are being sent to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code persists the full output, including request metadata and fetched comment results, by calling a file-writing helper. Although the operation is visible in code, there is no confirmation prompt or user-facing warning near the write path to disclose that data will be saved to disk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JavaScript file contains multiple natural-language strings shown to users exclusively in Chinese, including status, error, and success messages. Because the skill does not offer any language or locale opt-in and no region-specific justification is present in this file, it may violate language/locale policy requirements.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CLI writes full search output to a local JSON file named with the user's keyword, without any visible notice or consent in this file. Even when searching public Douyin data, the saved log can expose user interests, sensitive query terms, and retrieved content to other local users, backups, or downstream tooling, creating an unnecessary privacy and data-retention risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Several user-visible error strings are written only in Chinese, including the authentication failure message and support contact guidance. This forces a specific language/locale without any opt-in or documented regional constraint, which matches the policy-violation category for language choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code constructs and sends GET and POST HTTPS requests using caller-supplied params and data, which may include user or system data. While the function has an internal docstring and retry logging, there is no user-facing warning, confirmation, or visible disclosure here that data will be transmitted over the network.
- Content
Static analysis
No suspicious patterns detected.