guaikei-douyin-public-data-fetcher

• Outcome: Review
• Latest audit: Aug 18, 2026 · 3:20 AM UTC
• Version: 1.0.0

Overview

This Douyin data skill is not clearly malicious, but it should be reviewed because it sends user queries to a third-party API and automatically saves fetched public datasets locally.

Install only if you are comfortable sending Douyin research terms, target URLs, and your GUAIKEI_API_TOKEN to guaikei.com. Treat the generated logs as retained datasets: they may include comments, user identifiers, profile URLs, and your search terms, so delete or protect the logs directory if the workspace is shared or synced. For ambiguous short-video requests, confirm that Douyin is the intended platform before using the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill uses an environment variable for authentication (`GUAIKEI_API_TOKEN`) but does not declare permissions in a machine-enforceable way, creating a gap between documented behavior and actual capability. This can undermine least-privilege review and lead operators to invoke the skill without realizing it requires secret access and writes operational artifacts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The documented behavior does not fully match the skill's effective behavior: it claims user-search coverage not supported by the described interface, and it persists logs to a local `logs/` directory. Behavioral mismatches are dangerous because users and reviewers may approve or invoke the skill under incorrect assumptions, especially when local logging can retain query terms, URLs, and potentially sensitive analysis targets.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The schema explicitly documents `video_url` as including both playback and download addresses, which conflicts with the skill's stated scope that it does not cover downloading videos. This creates a capability/contract mismatch: downstream agents or users may rely on the schema to retrieve downloadable media, expanding the skill into prohibited behavior and potentially enabling unauthorized content acquisition.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback address and a video download address, which conflicts with the skill metadata stating it does not cover downloading videos. That mismatch can enable downstream agents or integrators to expose or rely on download functionality that the skill claims to exclude, creating policy/compliance risk and making misuse more likely in a Douyin data-fetching context.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The CLI persists the full fetched Douyin results to a local JSON file after completing a public-data retrieval task. Even if the source data is public, silent retention expands the data-handling scope from transient retrieval to local storage, which can create privacy, compliance, and unintended disclosure risk on shared systems or in downstream log collection.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger rule explicitly says to use the skill even if the user does not mention Douyin, which broadens activation beyond clear user intent. In an agent setting, ambiguous invocation boundaries can cause the system to send unrelated short-video research queries to an external data-fetching workflow, exposing user prompts or causing actions on the wrong platform.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation guidance repeats that the skill should activate even without an explicit Douyin mention, reinforcing ambiguous routing behavior. This increases the chance of unintended third-party API use, incorrect platform assumptions, and unnecessary disclosure of research topics or target accounts to the skill backend.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README states that collected Douyin data is automatically exported to local JSON logs, but it does not clearly warn that search results, author data, and especially comment data may contain personal or sensitive information. This increases the risk of unintended retention, sharing, or exposure of scraped public data, particularly in team environments or when logs are synced to shared storage.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The skill writes fetched comment results to a local JSON file automatically after execution, without an explicit user opt-in or notice at runtime. Even though the data is public, comments can still contain personal data or sensitive text, and persisting them locally increases exposure through accidental disclosure, shared machines, backups, or later misuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The CLI writes retrieved results to a local file without an explicit warning or consent mechanism in this file. Users may reasonably expect a fetch/analyze tool to print results only; silent local storage can expose collected datasets to other local users, backups, telemetry agents, or accidental inclusion in source repositories.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The CLI writes full search output, including user-supplied keywords and returned public-data results, to a local JSON file without any explicit notice, consent, retention control, or redaction. While this is not remote code execution, it creates a real privacy and data-handling risk because sensitive research terms, account analysis activity, or collected comment data may persist on disk and be exposed to other local users, backups, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill transmits user-provided keywords and search parameters to external APIs as part of its normal function, but it does so without an explicit privacy disclosure or consent boundary. In this skill context, users may enter sensitive competitive-intelligence terms, brand-monitoring targets, or investigation topics, so undisclosed transmission can create confidentiality and compliance concerns even if the API use is expected.

Static analysis

No suspicious patterns detected.