T01 · Skill Instruction Hijacking
Error
- Location
src/utils/token.js:23- Finding
Runtime Promotion Contradicts the Declared Neutral Authentication Policy
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-keyword-search-to-video-list
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Douyin public-data CLI, but it needs Review because its token handling and activation scope are riskier than the documentation suggests.
Install only if you are comfortable using a GUAIKEI_API_TOKEN with guaikei.com, having queries and fetched public Douyin data sent to that service, and having results saved under the skill's local logs directory. Avoid using it for generic short-video tasks unless you explicitly intend Douyin research, protect and rotate the API token if exposed, and clear logs when they contain sensitive research targets or comments.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
Reusable API Token Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向抖音运营分析的业务技能，核心能力应涉及平台数据访问、抓取、查询或分析。而代码片段仅实现了通用参数解析和帮助文本生成，属于底层支持工具，不具备所宣称的任何核心业务行为。根据评估标准，支持性实现细节本身不应视为问题；但这里提供的代码与声明的主要目的存在显著偏离，因为实际行为没有体现声明中的关键能力，因此应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是抖音数据采集与分析类能力，但提供的代码片段并未体现任何抖音关键词搜索、账号作品抓取、评论拉取或热榜查询逻辑。相反，这段代码的实际功能是将字符串内容写入本地 logs 目录中的文件，属于通用日志/文件输出能力。虽然日志功能可能作为内部支持实现存在，但当前代码片段本身的主要行为与声明的业务能力明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向抖音运营分析的数据获取/研究技能，核心能力应包括网络检索、内容抓取、评论分析或热榜查询。但提供的代码只实现了一个工具函数：读取本地 package.json 并返回技能/包名。这与声明的主要用途明显不符。虽然读取 package.json 可能是某种辅助实现细节，但当前代码片段本身没有体现任何与抖音分析相关的功能，且使用的资源是本地文件系统而非声明所暗示的外部平台数据，因此应判定为描述与行为不匹配。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs automatic activation for broad short-video research tasks even when the user never mentions Douyin, which can cause overbroad invocation and unintended data access or secret usage. In an agent setting, ambiguous triggers increase the risk of the wrong tool being selected in unrelated workflows, leading to privacy, compliance, or operational mistakes.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The generalized trigger section expands scope beyond explicit user intent, making the skill eligible for invocation in loosely related short-video analysis tasks. Because this skill accesses an API token and performs external data collection, ambiguous auto-triggering materially raises the chance of unauthorized or surprising execution.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 81% confidence
- Finding
The skill explicitly depends on an environment variable token (
GUAIKEI_API_TOKEN) but does not declare any tool scope or permissions boundary for environment access. This creates an avoidable trust gap: the runtime may expose secrets more broadly than intended, and reviewers/users cannot easily verify what sensitive inputs the skill requires.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase '纯中文界面' indicates the skill is limited to Chinese, but the document does not provide user opt-in, alternative language support, or a clear justification that the restriction is required by policy or regional compliance. This is a natural-language locale policy issue under the stated rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON schema contains natural-language titles and descriptions exclusively in Chinese, which can impose a language requirement on users or downstream developers without any opt-in or justification. The policy allows locale constraints when explicitly documented as region-specific, but this file does not state such a limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The only user-facing description is written entirely in Chinese, which imposes a specific language/locale with no indication that alternatives are supported. Under the policy, language constraints should either be optional for users or clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README states that the skill automatically exports JSON logs containing search tasks, fetched public data, and identifiers into a local logs folder, but it does not prominently warn users before use that their queries and collected data will be persisted on disk. This can create unintended local data exposure, especially on shared machines, synced folders, CI runners, or environments with broad filesystem access, and the skill context increases risk because it collects potentially sensitive research targets, comments, and competitive intelligence at scale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This file’s natural-language content, including the module description and function documentation, is exclusively in Chinese. That can violate a language/locale policy when the skill does not offer a language choice or explain that it is intentionally region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes fetched Douyin comment data to a local JSON file automatically after successful execution, with no explicit user consent, warning, opt-in flag, or ability to disable persistence. Comment data can contain personal data, usernames, and sensitive content, so silently persisting it increases the risk of unintended retention, later disclosure, or collection by other local users/processes. In this skill context, bulk comment scraping and analysis makes the privacy exposure more significant because the data volume may be large and operational users may not realize it is being stored on disk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code includes multiple user-facing strings in Chinese, such as status messages and errors, without offering a language or locale selection. That can violate a language/locale policy when users are not given an explicit opt-in or alternative.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI saves the full fetched post results to a local JSON file after completing the request, which creates a second copy of potentially sensitive creator data on disk without an explicit user opt-in. In this skill context, the data is collected for research workflows and may include profile and content metadata; silent persistence increases the risk of unintended retention, later exfiltration, or use beyond the user-visible retrieval operation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code writes fetched results to a local file automatically and without any user-facing confirmation, even though the primary apparent behavior is to fetch and print results. This can surprise users and create privacy and compliance issues, especially in multi-step research workflows where operators may not realize creator data is being retained locally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file performs outbound HTTPS requests and sends both URL parameters and JSON request bodies, which can contain user or system data. While there is retry logging, there is no confirmation prompt, user-facing notice, or explicit warning in comments/docstrings that data will be transmitted off-host.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The sanitization regex permits Chinese characters and Latin alphanumerics but the surrounding messages and examples explicitly frame the feature around Chinese search terms, effectively constraining behavior to a specific language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON schema contains user-facing title and description fields exclusively in Chinese, such as the schema title and parameter descriptions. Because the file does not offer a language choice or document that the skill is intentionally limited to a Chinese-speaking context, it may violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema title and description are written only in Chinese, which constitutes a natural-language locale constraint in the file's user-facing metadata. There is no indication that Chinese is optional, user-selected, or required for a documented region-specific purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The schema title and description are written only in Chinese, which imposes a specific language on downstream users or tooling without offering a language choice or documenting a justified region-specific constraint. This matches the policy category for language or locale restrictions expressed in natural-language content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The schema's human-readable title and descriptions are entirely in Chinese, with no indication that language is configurable or intentionally limited to a Chinese-only audience. This can violate language/locale policy when a skill imposes a locale without opt-in or documented justification.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This is a manifest-style JSON file, so vague-trigger checks apply. The title and description describe the schema's purpose broadly, but they do not define activation constraints, explicit trigger phrases, or negative examples, which can make invocation conditions unclear in systems that rely on manifest text for routing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions (for example in the title and field descriptions) with no indication that the skill is intentionally region-specific or that other languages are supported. Under the policy, fixed locale/language constraints should either be user-selectable or clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON schema contains natural-language titles and descriptions exclusively in Chinese, which can amount to a language/locale policy issue when no user opt-in or locale justification is provided. Because the file is a schema intended to describe API output, this may limit accessibility for users expecting language neutrality or explicit locale selection.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The README instructs users to set GUAIKEI_API_TOKEN before operation, but the sensitivity of the token and the need to avoid exposing it in shell history, screenshots, shared terminals, or committed environment files is not clearly emphasized at the point of setup. While environment variables are a common mechanism, insufficient handling guidance can lead to credential leakage and unauthorized API use.
- Content
Static analysis
No suspicious patterns detected.