Security audit

guaikei-douyin-open-intel

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Douyin public-data tool, but its broad auto-trigger rules and automatic local archiving deserve Review before installation.

Install only if you are comfortable sending Douyin research queries, target URLs, and a GUAIKEI_API_TOKEN to guaikei.com, and with results being saved locally under logs by default. Use explicit Douyin-specific requests, avoid collecting more comments/profile data than needed, protect and rotate the API token, and handle saved logs as sensitive business or personal-data material.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares 'no declared permissions' while explicitly requiring access to the GUAIKEI_API_TOKEN environment variable. This creates a transparency and review gap: operators may deploy the skill without understanding that it consumes secrets, and policy engines that rely on declared permissions may fail to enforce appropriate controls.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The schema explicitly describes `video_url` as both a playback address and a download address, which conflicts with the skill’s stated scope that excludes downloading videos or removing watermarks. Even though this file is only a schema, documenting and normalizing download URLs can enable downstream tooling or agents to use the skill for prohibited content retrieval, expanding capability beyond the declared read/search-only purpose.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The schema explicitly documents `play_addr` as both a playback URL and a video download address, which conflicts with the skill’s stated restriction against download use cases. That mismatch can enable downstream agents or integrators to treat download as an intended capability, expanding the skill beyond its declared scope and potentially facilitating policy bypass or unauthorized content acquisition.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The changelog advertises capabilities beyond the stated search/browse use case, including social-data search, bulk collection of an author's published works, and comment scraping/analysis. This kind of scope expansion can mislead reviewers and downstream agents about what the skill is allowed to do, increasing the risk of privacy-invasive collection, excessive data harvesting, or use outside the manifest's declared boundaries.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI persists fetched Douyin post results to a local JSON file without any explicit disclosure or opt-in. Because the skill is described as a read/query tool, silently creating local copies expands data handling beyond the apparent user expectation and can expose browsing targets, fetched content, and metadata to other local users, backup systems, or later unintended processing.

Vague Triggers

High

Confidence: 93% confidence
Finding: The description says the skill should activate even when the user does not mention Douyin, based on very broad phrases like '帮我搜下' or '网上谁在讲这个'. That can cause overbroad invocation on unrelated requests, leading to unintended transmission of user queries to an external service and collection of platform data the user did not specifically request.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The implicit trigger examples remain broad enough to match generic research requests such as '帮我做短视频竞品调研' or '最近有什么热门话题' without establishing that Douyin is the intended source. In this skill, that is dangerous because execution performs external queries and logs parameters locally, so a false activation can disclose user intent and create unnecessary data retention.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill states that logs are automatically archived to the local logs/ directory with filenames containing timestamps, keywords, parameters, and type, but the user-facing description does not warn users about this retention. Search terms, URLs, and analysis targets can contain sensitive business interests or personal data, so undisclosed local persistence increases privacy and confidentiality risk.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The README explicitly promotes scraping public videos, authors, comments, and exporting them to JSON logs, but gives only minimal restrictions and no concrete privacy/data-retention guidance. Even when data is publicly visible, bulk collection and local log storage can amplify privacy exposure, create sensitive profiling datasets, and increase the chance of accidental redistribution or leakage.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README instructs users to set an external-service API token in an environment variable, but does not clearly state that the token will be transmitted to guaikei.com-backed services during requests. That omission can cause users to misjudge trust boundaries, mishandle secrets, or reuse sensitive credentials in contexts where they would not knowingly send them to a third party.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The natural-language mapping includes broad triggers such as generic 'search' or conversational phrases that may match ordinary user speech, increasing the chance of invoking scraping operations without clear, informed user intent. In this skill's context, unintended invocation can trigger external requests, consume paid quota, and collect or store third-party data unexpectedly.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The intent rules use ambiguous triggers like '热点', '榜单', or '今天什么火' with high priority and insufficient scope constraints, so ordinary conversation about trends could be reinterpreted as a command to query Douyin hot lists. Because this skill performs external data access and may log results, ambiguous auto-routing makes accidental collection and quota consumption more likely.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The program writes a detailed result file locally without any user warning, confirmation, or explicit output-path selection. This can unexpectedly retain potentially sensitive query history and retrieved content, which is especially risky for a skill whose stated purpose is just to browse or inspect Douyin content rather than archive it.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.