Security audit

guaikei-douyin-machine-readable-data

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its Douyin data-analysis purpose, but needs review because it mishandles the API token, contradicts its own no-contact runtime policy, and retains collected data locally by default.

Review before installing. Use only for intended Douyin public-data workflows, avoid sensitive research targets unless third-party transmission is acceptable, rotate any token that may have appeared in URL logs, and clean or restrict the generated logs/ directory. Treat runtime contact prompts as untrusted because they conflict with the skill's own instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:96
Finding: API token transmitted in URL query strings
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/request.js:51
Finding: Authentication failures expose prohibited promotional contact information
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/utils/log.js:27
Finding: Complete search, post, and comment datasets are automatically retained in plaintext
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that logs are automatically saved under logs/, which means it performs local filesystem writes not clearly declared as a capability boundary. Even if intended for observability, writing request parameters, URLs, errors, or API responses to disk can leak sensitive operational data and persist user activity beyond expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that logs are automatically saved under logs/, which means it performs local filesystem writes not clearly declared as a capability boundary. Even if intended for observability, writing request parameters, URLs, errors, or API responses to disk can leak sensitive operational data and persist user activity beyond expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states that logs are automatically saved under logs/, which means it performs local filesystem writes not clearly declared as a capability boundary. Even if intended for observability, writing request parameters, URLs, errors, or API responses to disk can leak sensitive operational data and persist user activity beyond expectations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly relies on an environment variable (GUAIKEI_API_TOKEN) but does not declare any tool scope or permissions boundary for environment access. That creates an undeclared capability gap: the runtime may expose secrets more broadly than intended, and reviewers/users cannot accurately assess what secret access the skill needs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says the skill should be used even when the user did not mention Douyin, for broad requests like competitor analysis or 'what is trending'. Overly broad implicit triggers can cause the agent to invoke external data collection unexpectedly, leading to scope creep, privacy surprises, and actions on the wrong platform/context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The implicit trigger examples remain broad and insufficiently constrained, especially around generic short-video research, hot topics, and competitor analysis. In an agent setting, that can cause unintended invocation, unnecessary external queries, and collection of third-party content/comments when the user did not specifically ask for Douyin data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest says the skill does not handle video publishing or downloading, but this schema explicitly describes video_url as both a playback address and a download address. Even though this is a schema file rather than executable code, its inline documentation communicates that download URLs are part of the skill's supported output, which conflicts with the declared intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON schema uses Chinese-only natural-language title and descriptions, which imposes a specific language/locale on users without any visible opt-in or justification. The policy specifically calls out language or locale constraints as violations when the skill does not offer user choice or document a region-specific need.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON schema contains natural-language title and description fields exclusively in Chinese, including the top-level title/description and per-field descriptions. Because the file does not offer a language option or explain a justified locale restriction, it can violate a language/locale policy requiring user choice or explicit opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents play_addr as both a playback address and a video download address, which contradicts the skill metadata claiming it does not handle video download. This mismatch can enable downstream agents or users to discover and use a download-capable field, creating policy-bypass and unauthorized content acquisition risk in a Douyin-focused scraping/analysis skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README states that scraped results are automatically exported to JSON logs, but it does not prominently warn users that potentially sensitive query history, account targets, comments, and derived analysis data will be stored locally on disk. In shared workstations, CI runners, synced folders, or improperly secured environments, this can lead to unintended disclosure or retention of collected data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation requires users to obtain and configure a GUAIKEI_API_TOKEN, but it does not clearly disclose that search terms, target account URLs, video URLs, comment queries, and related metadata are sent to an external service for processing. This creates a transparency and data-governance risk because operators may unknowingly transmit internal research targets or sensitive monitoring subjects to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document explicitly instructs users how to fetch Douyin creator post histories and comment data at scale, but provides no notice about privacy expectations, lawful basis, platform terms, retention, or safeguards for personal data contained in comments and profile metadata. In this skill context—competitive analysis, hot-topic tracking, and comment mining—the omission increases the risk that operators will collect and process personal or sensitive user-generated data without appropriate constraints.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI persists fetched Douyin comment data to a local JSON file automatically after successful execution, even though the visible user interaction is framed as retrieval/analysis. Comments can contain personal data, account identifiers, or sensitive business intelligence, so silent local retention increases privacy and data-handling risk, especially on shared systems or ephemeral environments where users may not expect artifacts to remain on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code writes fetched comment results to disk without any confirmation, warning, or prior disclosure in this file, which can surprise users and create unintended data retention. In a skill dedicated to scraping/analyzing social-media comments, this is more dangerous because the collected content is precisely the kind of user-generated data that may be sensitive, regulated, or subject to internal handling restrictions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI writes the full fetched Douyin results to a local JSON file automatically, without any opt-in, warning, or control over persistence. Because the results may contain scraped account data and potentially sensitive comment or profile-related information, this creates an unnecessary data retention risk on shared systems, CI runners, or developer workstations where other users or processes could later access the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The CLI writes the full search output, including user-provided keywords and returned content, to a local JSON file by default without an explicit user-facing notice or consent. This creates a privacy and data-retention risk because sensitive research terms or collected platform data may persist on disk, be readable by other local users/processes, or be unintentionally committed or exfiltrated later.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple user-visible error strings in this file are hardcoded in Chinese, including authentication and network failure messages. This imposes a specific language/locale without any opt-in or documented locale constraint, which matches the language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file contains multiple natural-language strings exclusively in Chinese, beginning with comments and continuing through all user-visible error messages and formatted output. Because the skill forces a specific language without any visible opt-in or documented locale justification in this file, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions for the command-line parameters. Because the file provides no indication that the skill is region-specific or that users may choose another language, it may violate the language/locale policy requiring opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The title and property descriptions are written entirely in Chinese, which imposes a specific language on users or integrators without any indication that the schema is region-specific or that alternative locales are supported. Under the policy, language constraints should be optional or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON schema contains user-facing natural-language strings entirely in Chinese, including the title and multiple descriptions, without any indication that the skill is region-specific or that alternate locales are supported. Under the stated policy, forcing a specific language without opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest/schema file contains user-facing title and description fields entirely in Chinese, which imposes a specific language on users without any opt-in or explanation. Under the policy, locale or language constraints should either provide user choice or be clearly documented as region-specific and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The schema's human-readable title and field descriptions are written entirely in Chinese, which imposes a specific language on downstream users or developers. There is no accompanying indication that the skill is China-specific or that alternative language/localization options are available, so this can conflict with a language-choice policy.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This manifest file describes the skill in broad capability terms such as keyword search, content scraping, hot-list retrieval, and competitor analysis, but it does not define specific trigger phrases, boundaries, or exclusion conditions. In a manifest context, this can make invocation criteria ambiguous and increase the risk of unintended activation from loosely related user requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.