Security audit

guaikei-douyin-keyword-index-ranker

Security checks for vulnerabilities and agentic risk

Overview

The skill does perform the advertised Douyin research tasks, but it handles API credentials and activation scope in ways users should review before installing.

Install only if you are comfortable using a third-party guaikei.com API for Douyin research. Treat GUAIKEI_API_TOKEN as a credential, avoid sending sensitive research targets unless intended, review or delete the generated logs directory after use, and prefer explicit Douyin-scoped prompts so the skill is not invoked for generic trend research.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/token.js:23
Finding: Promotional Output Injected into Authentication Error Handling
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/api/search.js:59
Finding: API Credential Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/config/constants.js:19
Finding: Query Operations Retry Up to Twenty Times Contrary to the Declared Limit
Content: View full analysis
{ const res = await getJson("/api/douyin/hot-search", { _: Date.now(), token: token, }); return res.data; }, constants.QUERY_MAX_ATTEMPTS, (attempt, err) => { utils.printError( `【获取抖音热榜重试】 ${attempt + 1}/${constants.QUERY_MAX_ATTEMPTS} 次 - ${err.message}`, ); }, ); } ``` `src/utils/retry.js:11-30`: ```js async function withRetry(fn, maxAttempts, errorHandler) { let lastError; for (let attempt = 0; attempt < maxAttempts; attempt++) { try { return await fn(attempt); } catch (error) { lastError = error; if (error && error.noRetry) { throw error; } if (errorHandler) errorHandler(attempt, error); if (attempt < maxAttempts - 1) { const delay = Math.min( Math.pow(2, attempt) * constants.RETRY_INTERVAL, 60000, ); await new Promise((resolve) => setTimeout(resolve, delay)); } } } throw lastError || new Error(`重试${maxAttempts}次后失败`); } ``` ### Technical Analysis The documentation states that network failures should stop after three attempts. However, query operations use `QUERY_MAX_ATTEMPTS`, which is configured as twenty. The generic retry helper applies this value to all retryable failures and uses exponential backoff capped at sixty seconds. The code does not distinguish between deliberate ...[truncated 1449 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A strong description-behavior mismatch exists: the skill advertises external Douyin data collection workflows, while the available evidence suggests only local package or CLI-related behavior. Such deception or inaccuracy can cause unsafe routing, overbroad trust, and unnecessary exposure of credentials or user data to a component that is not doing what it claims.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A strong description-behavior mismatch exists: the skill advertises external Douyin data collection workflows, while the available evidence suggests only local package or CLI-related behavior. Such deception or inaccuracy can cause unsafe routing, overbroad trust, and unnecessary exposure of credentials or user data to a component that is not doing what it claims.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A strong description-behavior mismatch exists: the skill advertises external Douyin data collection workflows, while the available evidence suggests only local package or CLI-related behavior. Such deception or inaccuracy can cause unsafe routing, overbroad trust, and unnecessary exposure of credentials or user data to a component that is not doing what it claims.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description includes broad generalized triggers that can activate on common research or content-planning requests even when the user did not ask for Douyin-specific data collection. This can cause the skill to be invoked unexpectedly, expanding data access and secret use beyond user intent and increasing the chance of unauthorized scraping-related actions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs activation for ambiguous multi-step workflows, even when Douyin is not mentioned. In a delegated-agent setting, this is dangerous because it encourages opportunistic invocation, potentially causing unrequested external queries, use of API tokens, and collection of third-party data without informed user confirmation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares use of an environment variable token but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where the runtime may grant broader access than reviewers or users expect, especially since the skill is designed to consume secrets from the environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The statement '纯中文界面' imposes a specific language on users, but the file does not offer opt-in, alternatives, or a clear policy justification for restricting the skill to Chinese. This can violate organizational language-choice expectations for skills unless the locale limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the schema title and every property description. Because the file provides no indication that Chinese is optional, user-selected, or required for a documented region-specific purpose, it appears to impose a specific language/locale unilaterally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explains obtaining and configuring an API token but does not clearly warn that user queries, keywords, and target Douyin URLs are sent to a third-party external service. This is a privacy/transparency issue: users may reasonably assume local processing from the 'Node.js 一键运行' framing while sensitive research targets, investigation subjects, or query intent are actually transmitted off-system.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill defines invocation examples using very broad everyday phrases such as '搜索 / 搜一下 / 找 …', which can be matched in ordinary conversation and trigger the skill without an explicit user request to use Douyin tooling. Because this skill sends queries to an external service and may fetch third-party URLs/content, overbroad triggers increase the risk of unintended data disclosure and accidental external actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The hotlist triggers include ambiguous phrases like '今天什么火' and '热点/榜单', which can appear in general brainstorming or news discussions unrelated to Douyin. In context, this makes the agent more likely to invoke the skill unintentionally and disclose user intent or context to the external API without clear consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The intent recognition priority rules rely on generic keywords like '热搜', '搜索', '评论', '作品', and '账号' without sufficient platform or task-bound constraints. Since the skill metadata explicitly says it should be used even when the user did not directly say '抖音', these broad rules materially increase the chance of misrouting unrelated user requests into an external scraping/search workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all user-facing instructions and parameter descriptions exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This function sends the user's search keyword and a token to an external API via requestApi, which is a privacy-relevant network operation. While the comments describe parameters, there is no confirmation prompt, user-facing log, or explicit disclosure in the code that user input and credentials are being transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This request sends the token along with keyword and filtering parameters over the network to retrieve search results. The operation is safety-relevant because it transmits user-provided query data and credentials, but the code contains no visible warning, prompt, or disclosure to the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The code reads process.env.GUAIKEI_API_TOKEN and then uses it to create and retrieve a remote comment task, which implies outbound network requests involving the provided URL and parameters. Although success/error messages exist, they do not clearly disclose the use of environment credentials and remote transmission of request data to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI writes full comment results to a local JSON file automatically after fetching them, without any explicit consent, opt-in flag, redaction, or retention control. Because comment data can include user-generated content and potentially identifying information, this creates a privacy and data-handling risk if the host machine is shared, monitored, or the output directory is later exfiltrated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's natural-language strings, including comments and runtime messages such as error and success output, are entirely hard-coded in Chinese. This enforces a specific language experience without offering the user any locale selection or documenting that the skill is intentionally region/language-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code reads GUAIKEI_API_TOKEN from the environment and passes it, along with the user-supplied Douyin URL and limit, into post.createPostTask and post.getPostTask, which are network-oriented API calls by naming and usage. Although the skill's purpose implies remote fetching, there is no explicit disclosure in this file that user input and credentials are sent to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI persists the full fetched results to a local JSON file via log.taskWrite without obtaining user consent or clearly documenting that scraped Douyin data will be stored on disk. Because the results may contain creator/content metadata and the filename is derived from user input, this creates an unnecessary data-retention surface and can expose sensitive research data to other local users, backups, or later compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill silently writes fetched results to a local file after completing the task, but there is no user-facing warning or confirmation that disk persistence will occur. Silent persistence is risky in an analysis-oriented skill because users may assume results are ephemeral, while the saved file can retain potentially sensitive competitive-intelligence or comment data beyond the session.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file contains multiple user-visible error strings in Chinese only, including authentication and network failures. This enforces a specific language/locale for end-user communication without offering a language choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments and runtime messages entirely in Chinese, including the warning and status output shown to users. Under the policy, forcing a specific language without user opt-in or documented justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JavaScript file contains natural-language comments and user-visible error/output strings exclusively in Chinese, including validation errors and formatted result messages. Because the skill does not indicate that it is region-specific or offer any language/locale opt-in, it appears to enforce a specific language by default, which matches the policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest-style JSON file contains user-facing title and description strings entirely in Chinese, including parameter descriptions. Because the file does not indicate that the skill is region-specific or provide an opt-in or alternative language, it can violate the policy against forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.