Security audit

guaikei-douyin-omni-public-data

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs Douyin public-data lookups, but it needs Review because it can trigger too broadly, exposes tokens in request URLs, contradicts its own no-promotion auth-error policy, and saves results automatically.

Install only if you are comfortable sending Douyin keywords, account/video URLs, and a GUAIKEI_API_TOKEN to the guaikei.com API, and with results being saved locally by default. Treat this as Review-worthy until the publisher narrows activation to explicit Douyin requests, removes runtime promotional/contact output, stops putting tokens in URLs, and clarifies or removes download-address fields.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/token.js:23
Finding: <![CDATA[Authentication failures inject promotional and external contact information into Agent-visible output]]>
Content: View full analysis
process.exit(exitCode), ); ``` ### Technical Analysis The Skill declaration explicitly states that invalid-token failures must contain only a neutral error message and must not include contact information, website links, or promotional content. The implementation violates this declared security boundary in two separate authentication-failure paths: 1. Local token-format validation prints a pro ...[truncated 1911 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:100
Finding: <![CDATA[API authentication token is exposed through URL query parameters]]>
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 代码行为与声明的总体领域一致，都是抖音数据检索相关；且代码没有出现未声明的危险能力，如发布或下载视频。但就当前提供的代码块而言，实际只覆盖了 search 中的一部分：调用抖音通用搜索接口并返回结果。声明却强调该技能有四项能力（search/post/comment/hot），以及可用于评论区反馈分析、热点追踪、对标账号研究等更广泛场景，而这些能力在本代码块中没有体现。因此按“描述是否准确代表所 supplied code chunk 实际行为”来看，描述明显宽于代码实现，存在能力层面的不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容研究与热点分析的技能，而给出的代码片段仅是底层通用参数解析与帮助文本生成模块，属于基础设施代码。按评估标准，若代码的主要用途与声明的核心能力 materially different，则应判定不匹配。虽然该模块可能被更大系统复用，但就该代码片段本身来看，没有任何抖音相关逻辑、数据访问、搜索/评论/热榜处理或竞品分析实现，因此描述不能准确代表该代码实际行为。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是面向抖音内容检索与分析的技能能力，但该代码片段实际只是在本地文件系统中写日志，没有任何抖音搜索、作品获取、评论分析、热榜抓取或账号研究相关逻辑。虽然日志功能可能是配套实现，但就该代码片段本身而言，其行为与声明的核心用途明显不一致，且涉及未声明的本地文件写入能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容研究与竞品分析的技能，但给出的代码片段只是一个读取 package.json 中名称字段的辅助函数。虽然这可能是工程内部支持代码，但就该代码片段本身而言，其实际行为与声明的业务能力没有直接对应关系，也未体现任何抖音数据获取、分析、评论处理或热榜查询能力。因此，按描述与行为是否一致来判断，应认定为明显不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is overly broad and can cause the skill to trigger for generic research or competitor-analysis requests even when the user did not ask for Douyin data. In an agent setting, that can lead to unintended third-party API calls, unnecessary secret use, collection of platform-specific data outside user intent, and privacy/compliance issues from over-collection.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares use of an environment variable token but does not define an explicit tool scope or permissions boundary. That creates an unnecessary trust gap: the runtime may expose environment access more broadly than users or reviewers expect, and secret-bearing skills should be explicit about required capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Generalized activation for broad multi-step research workflows is risky because it removes platform constraints and encourages implicit data collection. That makes accidental invocation more likely, especially in composite tasks, and can expose user prompts or targets to an external API without sufficiently specific authorization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The line "纯中文界面" imposes a language constraint in natural-language documentation, but the file does not offer user opt-in or language alternatives. Under the policy, forcing a specific language without user choice can be a locale/language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents video_url as containing both playback and download addresses, which contradicts the skill manifest's statement that the skill does not handle video downloading. In an agent/tooling context, schema fields guide downstream behavior; exposing download URLs can enable unauthorized media downloading or cause the agent to perform actions outside its declared scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest explicitly says the skill does not process video downloading, but this response schema documents play_addr as both a playback address and a video download address. That indicates the skill exposes download-capable data as part of its supported outputs, which exceeds the stated behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill defines very broad natural-language triggers such as generic requests about competitor analysis or 'what's hot,' and even says to use the skill 'even if Douyin is not mentioned.' That can cause unintended invocation in unrelated contexts, leading the agent to fetch third-party public data when the user did not clearly request this specific platform or data collection behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent-recognition rules rely on generic terms like 'search,' 'comments,' 'account,' and 'what's trending' with limited boundary conditions. In an agentic environment, this can misroute ordinary conversation into external data collection actions, causing unintended data access, privacy/compliance issues, or surprising tool use without sufficiently informed user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The function sends a token and user-provided video URL to an external API via requestApi, which is a network operation involving potentially sensitive user or system data. While the code has developer-oriented docstrings, there is no user-facing confirmation, warning, or logging in this file disclosing that this data is transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This function performs a GET request that includes the token, URL, and limit as request parameters, transmitting them to a remote endpoint. The file does not show any user-facing notice, confirmation, or warning that these values will be sent over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The CLI silently persists fetched comment data to a local JSON file after printing results, without explicit notice or consent. Because comment data can contain usernames, profile identifiers, or other user-generated content, this creates avoidable privacy and data-retention risk, especially on shared systems or in automated environments where users may not expect durable storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI sends the user-supplied URL and limit to external APIs to create and fetch a post task, but this file does not clearly warn users that their input will be transmitted over the network. In a data-collection skill focused on competitor analysis and trend tracking, URLs and query targets can reveal investigation intent, monitored accounts, or business-sensitive research activity, so silent transmission creates a meaningful privacy and disclosure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI persists the full fetched results to a local JSON file automatically, but this file does not provide any explicit notice or consent mechanism before writing data to disk. Because the tool is designed to collect public-profile and comment-adjacent social media intelligence, the saved output may contain sensitive research targets, operational context, or regulated personal data, increasing privacy and data-retention risk on shared systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The functions createSearchTask and getSearchTask make network-backed search requests using the user's keyword and search filters. The code logs progress messages, but it does not explicitly warn the user that their query data will be sent to an external API, which is a privacy-relevant network operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CLI writes full search results and request metadata, including user-supplied keywords, to a local file automatically. In this skill context, keywords may reveal research targets, business interests, or sensitive monitoring topics, and silent persistence increases the risk of unintended disclosure on shared systems or through later log collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code performs outbound HTTPS GET and POST requests and sends URL parameters and JSON request bodies, but the file provides no user-facing disclosure such as a prompt, log, or warning about transmitting data to a remote service. For code files, network calls that may transmit user or system data should have some visible disclosure unless clearly covered elsewhere; this file only contains internal comments and retry error logging.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file emits all user-facing warnings and status messages in Chinese, including the token misconfiguration warning and success/info messages. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstrings and user-facing error/output strings are written exclusively in Chinese, including validation errors and formatted result messages. This imposes a specific language on users without offering a language choice or documenting a justified locale constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: L030 states the skill does not write to the filesystem except for logs, implying limited side effects, while elsewhere the file documents automatic output-file creation in logs/. This is an internal documentation inconsistency about write behavior and side effects.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Including query parameters in filenames can leak sensitive user-supplied values to disk, backups, or monitoring systems even if the API token itself is not written. In research workflows, queries may contain private names, URLs, incident terms, or other sensitive context, so persisting them in filenames increases exposure and can bypass normal log-redaction practices.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema uses Chinese-only natural-language title and descriptions (for example, the title and field descriptions), which can constitute a language/locale policy issue when no user opt-in or documented locale restriction is provided. Because the file contains user-facing metadata rather than internal identifiers, it appears to impose a specific language by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.