T01 · Skill Instruction Hijacking
Error
- Location
src/utils/token.js:23- Finding
Undisclosed Promotional Content Injected into Authentication Error Output
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-intelligence
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Douyin public-data purpose, but its runtime contradicts its own safety claims by showing promotional/contact information on token errors and handles API tokens less safely than expected.
Review before installing. The skill appears designed for public Douyin research, but it sends your queries and target URLs to guaikei.com, stores fetched results locally, and currently exposes onboarding/contact text during token failures despite claiming it will not. Avoid using it for confidential competitor research unless you accept those data flows and rotate the API token if logs or infrastructure access are a concern.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
src/config/constants.js:20- Finding
Query Failures Can Trigger Twenty Attempts Despite a Three-Retry Policy
- Content
View full analysis
setTimeout(resolve, delay)); } } } throw lastError || new Error(`重试${maxAttempts}次后失败`); } ``` Representative use from `src/api/search.js:115-123`: ```js const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "查询任务", ); ``` ### Technical Analysis The retry helper treats all errors without `noRetry` as retryable. Query operations pass `QUERY_MAX_ATTEMPTS`, which is configured as 20. This means a persistent timeout, connection reset, response parsing failure, or retryable API error can cause as many as 20 network attempts. The exponential backoff starts at two seconds and is capped at 60 seconds per delay. As a result, one CLI invocation can remain active for several minutes and repeatedly contact the service. This contradicts the documented behavior stating that network failures stop after no more than three attempts. The cod ...[truncated 1495 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The finding notes local filesystem access not reflected in the description. Undisclosed file reads/writes reduce transparency and can surprise operators; in an agent skill, hidden persistence is more dangerous because users may assume an ephemeral data flow while the skill archives or inspects local files.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The finding notes local filesystem access not reflected in the description. Undisclosed file reads/writes reduce transparency and can surprise operators; in an agent skill, hidden persistence is more dangerous because users may assume an ephemeral data flow while the skill archives or inspects local files.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The finding notes local filesystem access not reflected in the description. Undisclosed file reads/writes reduce transparency and can surprise operators; in an agent skill, hidden persistence is more dangerous because users may assume an ephemeral data flow while the skill archives or inspects local files.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding notes local filesystem access not reflected in the description. Undisclosed file reads/writes reduce transparency and can surprise operators; in an agent skill, hidden persistence is more dangerous because users may assume an ephemeral data flow while the skill archives or inspects local files.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding notes local filesystem access not reflected in the description. Undisclosed file reads/writes reduce transparency and can surprise operators; in an agent skill, hidden persistence is more dangerous because users may assume an ephemeral data flow while the skill archives or inspects local files.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding notes local filesystem access not reflected in the description. Undisclosed file reads/writes reduce transparency and can surprise operators; in an agent skill, hidden persistence is more dangerous because users may assume an ephemeral data flow while the skill archives or inspects local files.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The finding notes local filesystem access not reflected in the description. Undisclosed file reads/writes reduce transparency and can surprise operators; in an agent skill, hidden persistence is more dangerous because users may assume an ephemeral data flow while the skill archives or inspects local files.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill declares access to an environment variable token (
GUAIKEI_API_TOKEN) but does not declare any explicit tool scope such aspermissionsorallowed-tools. That creates a governance gap: the runtime may grant broader capabilities than reviewers or users can infer from the manifest, especially around secret access.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states that logs are automatically archived to
logs/with timestamps, keywords, parameters, and type, but does not present this as a clear user warning in the main description. In this context, competitor names, search terms, account URLs, and fetched comment data can reveal sensitive research intent and may include personal data, so undisclosed retention materially increases privacy and confidentiality risk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promotes automatic JSON log export of scraped Douyin data but does not clearly warn users up front that collected public data will be written to local files. In this skill’s context, the exported data may include comments, account identifiers, and analysis targets, creating privacy, retention, and inadvertent disclosure risks on shared machines or synced workspaces.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README requires users to configure an external API token and send search terms, account URLs, and video URLs to the guaikei service, but it does not clearly disclose that these inputs are transmitted off-box to a third party. In a competitive-intelligence and sentiment-analysis workflow, those queries and target identifiers may themselves be sensitive business information, so lack of notice can lead to unintentional exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file uses Chinese-only natural-language documentation and user-facing action labels such as "创建任务" and "查询任务", which indicates a language constraint without user opt-in. Under the stated policy, forcing a specific language is a natural-language policy violation unless the locale restriction is explicitly justified or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains user-facing natural-language strings exclusively in Chinese, including status, error, and success messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not evident in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes the full fetched results to a local JSON file automatically, without any user consent, opt-in flag, or warning about persistence. Because this skill collects Douyin intelligence data that may include account content and potentially comment-derived user data, silent local retention increases the risk of unintended disclosure through shared workstations, backups, logs, or later exfiltration by other processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI writes the full search output to a local JSON file, and that output includes user-supplied query terms plus potentially sensitive collected data from Douyin results. Because this persistence happens automatically and without clear consent or minimization, it can leak research activity, scraped content, or operational metadata to other local users, backups, or downstream tooling that reads the log directory.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code embeds a user-facing authentication error entirely in Chinese and instructs the user to contact a WeChat number for resolution. That imposes a specific language and communication channel on all users without offering a language or locale choice, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file uses Chinese-only natural-language comments and runtime messages such as the warning and info strings, with no indication that the skill is region-specific or that users can opt into another language. That creates a language/locale policy concern because the skill implicitly enforces a specific language in user-facing output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JavaScript file contains natural-language comments and user-facing error/output strings exclusively in Chinese, including validation errors and formatted result messages. Under the policy rule, forcing a specific language without user opt-in or documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The statement '纯中文界面' indicates a fixed language/locale constraint. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the restriction is clearly justified as region-specific or users are offered a choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest-style JSON file uses Chinese-only natural-language title and description fields for the schema and its parameters. That imposes a specific language on users or integrators without offering an alternative locale or documenting that the skill is intentionally region-specific, which matches the language/locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The title and description are written only in Chinese, which can constitute a language/locale policy issue when a skill forces a specific language without user opt-in or documented regional scope. The file does not indicate that this schema is limited to a Chinese-language or region-specific deployment, nor does it offer any language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and description fields use Chinese-language text, and there is no accompanying indication that the skill is region-specific or that users can opt into this locale. Under the language/locale policy rule, hard-coding a specific language without documented choice or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The title and field descriptions are written only in Chinese, which can amount to an implicit language policy for users or maintainers interacting with this schema. The file does not indicate that the skill is region-specific or that another language option is available, so the locale constraint is not clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON schema uses natural-language metadata exclusively in Chinese for the schema title and description, and the same pattern continues throughout field descriptions. Because the file does not document that the skill is China-specific or offer any language/locale opt-in, it may violate the policy against forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions for the command-line parameters, which can constitute a language/locale policy issue when no user opt-in or regional justification is provided. The file contains multiple user-facing strings and does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
Static analysis
No suspicious patterns detected.