Security audit

guaikei-douyin-public-archive

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Douyin public-data lookup tool, but it has review-worthy contradictions and credential/data-handling risks before installation.

Review carefully before installing. Use this only if you are comfortable sending Douyin queries, target URLs, and a GUAIKEI token to the Guaikei service, and with fetched public data being saved locally as JSON logs. Protect and rotate the token, avoid sensitive research queries, and treat any runtime website or WeChat token prompts as vendor contact output rather than neutral security guidance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/request.js:50
Finding: Runtime Promotional and Contact Injection Contradicts Declared Authentication Safety Policy
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: Private API Token Is Transmitted in URL Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (44)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该代码片段只是一个通用参数解析模块（parseArgs/readValueAfterFlag/buildHelp），负责处理命令行选项、校验参数和生成帮助信息。这属于支持性基础设施，但当前提供的代码本身完全没有任何与抖音、公开数据抓取、视频搜索、评论读取或热榜访问相关的逻辑。由于评估的是“声明描述是否准确代表所提供代码块实际做的事”，这里存在明显不匹配：声明描述的是一个抖音数据查询技能，而代码实现的是通用 CLI 工具模块，主用途 materially different。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音公开数据采集/查询的技能能力，但提供的代码并未体现任何抖音搜索、作品抓取、评论读取或热榜查询逻辑。相反，它执行的是将内容写入本地日志文件的通用工具功能，涉及文件系统访问与目录创建，这些能力在声明中没有体现。虽然日志模块可能是某个更大技能的辅助实现，但就该代码片段本身而言，其实际行为与声明的主要用途明显不一致，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill is for querying Douyin public data such as videos, creator works, comments, and hot rankings. However, the supplied code chunk only uses fs/path to read package.json and return the package name. That is an internal utility and not merely a visible subset of the declared functionality; based on this chunk alone, the actual behavior shown is materially different from the stated purpose. Therefore this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill documents use of an environment variable token and CLI execution, but it does not declare explicit tool scope or permissions. That weakens containment and reviewability because the runtime can access sensitive environment data without a machine-readable restriction boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly says it can be used even when the user does not mention Douyin, which broadens activation to generic research requests. That increases the chance of accidental invocation and silent transmission of user queries to an external service the user did not intend to use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The implicit trigger examples are broad phrases like competitor research and hot topics, which commonly appear in benign conversations unrelated to Douyin. Overbroad triggers can cause unintended external data access, privacy surprises, and results sourced from the wrong platform or jurisdiction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill notes that servers are located in China and that an API token is required, but it does not clearly warn users that their search terms, URLs, and requested public-data targets will be transmitted to an external domestic service. This is a transparency and privacy issue because users may unknowingly send sensitive research interests or identifiers to a third-party system.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents video_url as both playback and download addresses, which conflicts with the stated skill boundary that it is not for downloading videos. This creates a capability mismatch that can enable downstream agents or integrators to use the skill for prohibited video retrieval, weakening policy controls and increasing abuse risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The schema exposes a play_addr field explicitly described as both a playback and download URL, which conflicts with the skill’s stated restriction that it is not for downloading videos. Even though this file is only a schema, including this field normalizes and enables downstream clients or agents to retrieve direct media URLs and potentially use the skill beyond its declared purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The only natural-language description in the manifest is written in Chinese and presents the skill as Chinese-language oriented without any indication that other languages are supported or that the locale restriction is intentional and documented. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises data export and later mentions logs are saved under a local logs folder, but the initial usage guidance does not clearly warn users that scraped public data will be persisted to disk by default. In a scraping skill, silent local retention can create privacy, compliance, and data-handling risk because comments, account data, and search results may contain personal information that users do not expect to be stored.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README instructs users to obtain and configure GUAIKEI_API_TOKEN before use, but it does not place a prominent warning about credential sensitivity, local environment exposure, or the downstream privacy/compliance implications of using the token to scrape and store platform data. This increases the chance of accidental token leakage or uninformed use in environments where environment variables, shell history, logs, or shared systems may expose secrets and collected data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code includes natural-language descriptions such as the module header and operation labels in Chinese, which indicates the skill is oriented to a single language. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The CLI writes fetched comment data to a local JSON file by default, and Douyin comments may contain personal data, usernames, opinions, or other sensitive content. Persisting this data without an explicit user-facing warning, consent flow, or opt-in flag increases the risk of unintended retention, local disclosure, and mishandling of scraped data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code persists the full command output to disk via log.taskWrite, which is a file-write operation affecting user data handling. While the skill logs progress messages, there is no user-facing disclosure here that results will be saved locally, and the saved JSON includes request metadata and fetched results.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s user-facing natural language is exclusively Chinese, beginning with the header comment at L002 and continuing through help/error text elsewhere. Under the policy, forcing a specific language without user opt-in or justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a skill for searching and reading public Douyin data, and explicitly frames the scope around viewing/analyzing content rather than performing other operations. This utility creates directories and writes arbitrary content to local log files, which goes beyond a purely read-only data-access purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The authentication error string is written entirely in Chinese and includes remediation guidance only in that language. This can violate language/locale policy when the skill does not offer a language choice or document that it is intentionally restricted to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-facing strings at L25-L30 are hard-coded in Chinese, which imposes a specific language on users without any visible opt-in or locale selection. This matches the policy category for language or locale violations because the file provides no mechanism to adapt messaging to user preference or justify a China-specific scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The schema title and field descriptions are written entirely in Chinese, which imposes a specific language in user-facing metadata. There is no indication that the skill is China-specific or that users can opt into another language, so this may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON schema contains natural-language titles and descriptions exclusively in Chinese, including the top-level title/description and property descriptions. Because the file does not state that the skill is China/Chinese-specific or offer any language choice, it may violate language/locale policy by implicitly forcing a specific language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema uses Chinese natural-language titles and descriptions throughout, including the top-level title/description and field descriptions. Because the file does not document that the schema is intentionally China-specific or offer any language/locale choice, it can be interpreted as imposing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title and description are presented exclusively in Chinese, which can impose a language expectation without any visible opt-in or statement that the skill is intended only for Chinese-speaking users. This may violate language/locale policy when the skill is used in broader multilingual environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This manifest-like JSON schema says the required url field may be either a Douyin homepage URL or a SEC_UID, but it does not define more specific accepted formats, boundaries, or exclusion examples. That ambiguity can make it unclear what inputs should activate or route to this skill, increasing the chance of unintended invocation on loosely related user input.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains natural-language title and description strings only in Chinese, but it does not state that the skill is China-specific or that Chinese is optional. Per the policy, forcing a specific language without user opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.