Security audit
Security checks across malware telemetry and agentic risk
The skill mostly matches its Douyin research purpose, but it combines bulk public-data collection, automatic local result retention, broad activation wording, and runtime promotional contact output that contradicts its own security notes.
Review this before installing if you handle sensitive research topics or regulated data. Use it only for lawful Douyin public-data research, keep the GUAIKEI_API_TOKEN private, avoid ambiguous non-Douyin prompts, and periodically delete the generated logs if you do not need retained search, post, or comment datasets. Be aware that auth failures may show vendor contact information even though the skill text says runtime auth errors should stay neutral.
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.
