Security audit

guaikei-douyin-public-archive

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin public-data purpose, but it needs review because it can trigger broad scraping, persist large local result logs, and exposes media/download URLs despite saying downloads are out of scope.

Install only if you intend agents to send Douyin search terms, Douyin URLs or IDs, and GUAIKEI_API_TOKEN to guaikei.com. Expect search, post, and comment results to be saved under the skill's logs directory; protect or delete those files if they contain comments, profiles, or business research. Use clear Douyin-specific prompts to avoid accidental invocation, and do not rely on the no-download claim because returned schemas include media URL fields described as download addresses.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares that it needs an environment variable token (`GUAIKEI_API_TOKEN`) and invokes local Node.js commands, but there is no explicit permission declaration governing access to environment data. This can cause the host or reviewer to underestimate the skill's capabilities, and any skill that consumes secrets from the environment should declare that requirement clearly for least-privilege review and runtime consent.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The schema explicitly describes `video_url` as both playback and download addresses, which conflicts with the skill's stated restriction that it is not for downloading videos. This creates a capability/documentation mismatch that can enable downstream agents or integrators to use the skill for prohibited downloading, increasing policy and misuse risk even if no download logic appears in this file.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The schema explicitly documents `play_addr` as both a playback and download address, which conflicts with the skill's stated restriction that it is not for downloading videos. Exposing or normalizing a direct downloadable media URL can enable downstream agents or users to repurpose the skill for content acquisition beyond its declared scope, weakening policy boundaries and increasing misuse risk.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description explicitly says the skill may be used even when the user did not mention Douyin, which broadens activation beyond clear user intent. Over-broad triggering can cause the agent to invoke external data collection unexpectedly, sending user queries to a third-party service when the user only asked for generic research or trend analysis.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The implicit-trigger examples such as generic competitor research, popular content discovery, and hot-topic discovery are broad enough to overlap with many ordinary requests unrelated to Douyin. In context, this increases the risk of silent tool invocation, unnecessary external requests, and collection of third-party data without sufficiently specific user authorization.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README explicitly states that scraped results are automatically exported to JSON logs and later details that comment, video, and account-related data are saved under a local logs directory, but it does not prominently warn users about retention, access control, or cleanup of potentially sensitive public-profile and comment data. This creates a real privacy and operational security risk because users may unknowingly persist large amounts of third-party data on disk where it can be exposed, shared, or retained longer than intended.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The natural-language command mapping includes broad trigger phrases such as '搜索 / 搜一下 / 找' and generic conversational formulations that can overlap with ordinary user requests, making accidental invocation more likely. In this skill's context, unintended activation can launch scraping workflows against Douyin and collect/export third-party data without the user clearly intending to use this specific capability.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The intent-priority rules rely on generic words like '热点', '搜索', '找', and broad references to '视频', which makes activation boundaries unclear and can cause the skill to claim requests that were not meant for Douyin data collection. Because this skill performs public-data scraping and local storage, mistaken routing is more dangerous than in a read-only informational skill: it can trigger network collection and persistent logging of third-party content.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI writes fetched comment data to a local JSON file automatically after successful execution, but this file contains user-generated public comments that may still include personal data, handles, or sensitive contextual information. Silent persistence increases the risk of unintended retention, later disclosure to other local users/processes, or accidental inclusion in backups and logs, especially because there is no explicit opt-in or warning at the point of collection.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI writes the full task output, including scraped Douyin post data and request metadata, to a local JSON file automatically without any explicit user warning or opt-in. In the context of a data-collection skill, this creates a privacy and data-handling risk because sensitive or regulated content may be retained on disk unexpectedly, exposed to other local users, backups, or later compromise.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The CLI writes full search results to a local JSON file automatically, which can persist user queries and returned public-data content on disk without explicit consent or an opt-out. In an agent or shared host environment, this increases privacy and data-handling risk because logs may be readable by other users, included in backups, or retained longer than expected.

Static analysis

No suspicious patterns detected.