other
Warning
- Location
src/utils/token.js:23- Finding
Deceptive promotional content is injected into authentication error output
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-posts-for-content-research
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Douyin public-data purpose, but it mishandles the API token and contradicts its own promise not to show promotional contact details at runtime.
Review before installing. This skill sends your search terms, Douyin URLs or IDs, limits, and GUAIKEI_API_TOKEN-backed requests to www.guaikei.com, and it saves fetched results locally under logs/. Use a dedicated, revocable token, avoid sensitive investigations on shared machines, clear logs when done, and do not rely on runtime contact details shown during auth failures as vetted support channels.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:84- Finding
Reusable API token is transmitted in URL query strings
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个覆盖四类抖音能力的综合技能，但提供的代码片段只涉及博主已发布作品查询：向 /api/douyin/post/url 创建任务，再从 /api/douyin/post/info 获取作品结果，处理的数据字段也是 post。代码访问的资源与“博主最近发了什么”这一子能力一致，但没有任何与搜索、评论、热榜相关的实现迹象。因此，当前代码行为仅覆盖声明中的一部分，整体描述对该代码片段而言过宽，属于描述与实际行为不完全一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
从代码看，唯一涉及的 API 是 /api/douyin/general-search/keyword 和 /api/douyin/general-search/info，参数也都是搜索关键词、排序、发布时间、时长、内容类型、数量等搜索维度，明显属于抖音通用搜索功能。结果处理逻辑也只是对搜索结果添加 author_url 和 create_time_str。没有任何与用户主页/博主作品列表、视频评论列表或热搜榜单相关的接口、字段或流程。因此，代码行为只部分匹配声明中的“搜索”，但与声明的其余三项核心能力不符，构成描述与实际行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个覆盖四项抖音能力的综合技能，而提供的代码块实际只做“获取抖音博主作品列表”。代码通过解析 --url/--limit 参数，校验抖音用户 URL，调用 createPostTask/getPostTask 获取作品结果，并将结果输出及写入日志。这与声明中的“这个博主最近发了什么”子能力一致，但与“抖音搜一下”“这条视频评论怎么看”“今天抖音热搜是什么”等其余三类能力不一致。未发现跨平台或明显额外敏感能力，但整体描述范围明显大于此代码块实际行为，因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是面向抖音内容查询的用户能力，而代码片段仅实现了与平台无关的命令行参数解析基础工具。它没有体现任何抖音平台访问、搜索、作品拉取、评论读取、热榜获取或相关触发逻辑。虽然这类工具代码可能是更大项目的配套模块，但就该代码块本身而言，其主要行为与声明用途明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是面向用户的抖音信息检索/浏览能力，而代码块并未执行任何抖音搜索、博主作品获取、评论分析或热榜查询逻辑，也没有网络请求、平台接口调用或相关触发处理。相反，它具备的是本地日志文件写入能力，访问的资源是文件系统，这与声明的功能和资源范围明显不一致。因此属于明显的描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear mismatch between the declared purpose and the supplied code chunk. The description claims user-facing Douyin content retrieval features across search, creator works, comments, and hot rankings. However, the code does not interact with Douyin, network APIs, user queries, search, comments, or trending data. It only accesses the local filesystem to read package.json and extract the package name. This is a utility/helper behavior unrelated to the declared skill purpose, so the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向用户的抖音内容检索/查看技能，而给出的代码片段只是底层通用重试逻辑，不涉及抖音平台、不处理搜索/评论/热榜/博主作品，也没有任何与所述触发词相关的实现。虽然重试机制可以作为支持性实现细节存在，但当前提供的代码片段本身并不能体现声明中的核心能力，因此描述与实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个覆盖四类抖音能力的技能，但提供的代码片段只体现了“热榜”这一项能力，且具体只是将热榜结果格式化为文本输出，没有看到搜索、博主作品、评论相关处理逻辑。因此，按已提供代码来看，实际行为明显窄于声明能力，描述不能准确代表该代码块的实际作用。未发现额外未声明的越权能力；问题在于声明范围显著大于代码实际实现。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill declares access to an environment variable (
GUAIKEI_API_TOKEN) and network/API use, but it does not declare an explicit tool scope such as permissions or allowed-tools. In agent environments, missing scope declarations can lead to overbroad execution context or make reviewers unable to verify what resources the skill is intended to access.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generalized trigger allows activation for broad phrases like short-video research, competitor analysis, or '这个赛道' even when the user did not clearly request Douyin. In an agent system, overbroad triggers can cause the wrong skill to run, leading to unintended API calls, collection of third-party content, or disclosure of results from an inappropriate data source.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema uses Chinese-only title and description text, and all field descriptions are also Chinese-only. For a generally applicable skill artifact, that creates a language policy concern because it imposes a specific locale without any opt-in or justification that the skill is region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language description forces a single language presentation and does not state that the skill is China/Chinese-language specific or offer an alternative language. This can violate language/locale policy when users are not given a choice or informed of the locale constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README promotes automatic JSON log generation and later notes output under a local logs folder, but it does not clearly foreground that fetched video, author, comment, or hot-list data will be persisted to disk by default. Silent or insufficiently disclosed local persistence increases the risk of retaining scraped content and potentially sensitive metadata longer than intended, especially in shared or multi-user environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad, colloquial, and designed to activate on common user speech patterns, which increases the chance the skill will run in situations beyond the user's precise intent. In an agent environment, over-broad activation can cause unintended access to external data sources and collection of platform content when the user did not explicitly request this specific capability.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The intent recognition rules rely on generic keywords like '热搜', '搜索', '评论', '视频', '主页', and '博主', with limited platform-scoping and only partial ambiguity handling. This can misroute ordinary conversation into tool execution, leading to unintended data retrieval, unnecessary external API calls, and collection or storage of fetched content without sufficiently specific user authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language content in comments and parameter descriptions is entirely in Chinese, including the skill purpose and argument meanings. This can impose a language/locale constraint on maintainers or operators without any opt-in or documented region-specific justification, which matches the policy-violation criterion for forced language usage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file's natural-language strings, including comments and runtime messages, are consistently Chinese-only, and there is no indication that users can select a different language or that the locale is intentionally constrained. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The calls to
post.createPostTaskandpost.getPostTaskare network-facing by context and use an API token plus user-supplied target data. The file lacks a direct warning in comments/help/output that the supplied Douyin identifier/URL will be sent to an external service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code persists the full command output to disk via
log.taskWrite, which is a file-write operation covered by the missing-warning rule for code files. Although the CLI prints status messages, there is no clear disclosure before the write that a local artifact containing request details and results will be created.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI writes full search output to a local file, creating undisclosed data retention beyond the skill's stated retrieval-only behavior. Search results and query terms may contain sensitive or regulated content, and silent persistence increases the risk of local data exposure, overcollection, and misuse on shared or managed systems.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-visible error and success strings are hardcoded in Chinese, which imposes a specific language on users without any opt-in or locale selection. The policy explicitly calls for flagging language or locale constraints when the skill does not offer a choice or justified limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-facing messages only in Chinese, including warnings and status output. The policy for natural-language violations applies to all file types, and forcing a specific language without user opt-in is explicitly in scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains user-facing natural-language documentation and error/output strings exclusively in Chinese, beginning in the docstring and continuing throughout the file. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation because the skill does not provide any language selection or documented justification.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The trigger phrase '热点趋势' is highly generic and may overlap with many unrelated research or news requests. This increases the chance of unintended skill invocation and platform confusion, especially because the skill is supposed to be restricted to Douyin-specific use.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This JSON schema contains user-facing title and description fields entirely in Chinese, including parameter descriptions, with no indication that the skill is region-specific or that users can choose another language. That can violate a language/locale policy when a skill implicitly enforces one language without opt-in or documented justification.
- Content
Static analysis
No suspicious patterns detected.