T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Token Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-public-data-fetcher
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a public Douyin data lookup tool, but it needs review because it mishandles the service token and its runtime behavior conflicts with its own safety disclosures.
Review before installing. Use a dedicated, revocable API token, expect your search terms and Douyin URLs to be sent to www.guaikei.com, and be aware that result JSON files are saved under the skill directory. The publisher should move the token out of query strings, narrow routing to explicit Douyin requests, remove runtime promotional/contact output, and align download-related fields with the documented no-download scope.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:23- Finding
Authentication Failures Emit Undisclosed Promotional and Contact Content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (48)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims minimal local impact while also stating that logs are automatically saved to
logs/, implying local filesystem writes not reflected in a permission declaration. Undeclared file creation/writing can expose user queries, fetched data, or operational metadata on disk, which is especially relevant for research workflows that may include sensitive business inputs.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims minimal local impact while also stating that logs are automatically saved to
logs/, implying local filesystem writes not reflected in a permission declaration. Undeclared file creation/writing can expose user queries, fetched data, or operational metadata on disk, which is especially relevant for research workflows that may include sensitive business inputs.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims minimal local impact while also stating that logs are automatically saved to
logs/, implying local filesystem writes not reflected in a permission declaration. Undeclared file creation/writing can expose user queries, fetched data, or operational metadata on disk, which is especially relevant for research workflows that may include sensitive business inputs.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims minimal local impact while also stating that logs are automatically saved to
logs/, implying local filesystem writes not reflected in a permission declaration. Undeclared file creation/writing can expose user queries, fetched data, or operational metadata on disk, which is especially relevant for research workflows that may include sensitive business inputs.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill explicitly requires access to an environment variable (
GUAIKEI_API_TOKEN) but does not declare a corresponding tool scope or permission boundary. That creates a capability mismatch: an agent may invoke a skill that depends on secret access without the manifest clearly constraining or disclosing that need, increasing the risk of overbroad secret exposure or unsafe runtime behavior.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description says the skill should trigger even when the user does not mention Douyin, making activation scope overly broad. Overbroad routing can cause the agent to send user prompts or parameters to an external data-fetching workflow unexpectedly, violating user intent and increasing unnecessary exposure of queries to third-party services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage guidance repeats that the skill should be used even if the user did not mention Douyin, which creates ambiguous and potentially unauthorized invocation. In context, this matters because the skill appears to contact an external API using a token, so mistaken activation can leak user research interests or cause actions against a third-party service without clear user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema explicitly documents
video_urlas both playback and download addresses, which conflicts with the skill's stated scope that it does not cover downloading videos. This mismatch can enable downstream agents or users to retrieve downloadable media URLs anyway, creating a policy bypass and increasing legal/compliance risk around unauthorized content acquisition.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The schema explicitly exposes
play_addrand describes it as both a playback and download address, which conflicts with the skill’s stated scope that it does not cover video downloading. In an agent ecosystem, this mismatch can enable downstream tooling or prompts to use the field for retrieval/download workflows the skill claims to exclude, increasing policy-bypass and misuse risk.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The entire skill documentation, parameter descriptions, and examples are presented in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the stated policy, language-specific behavior should either offer a choice or clearly document a justified region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code sends a skill token and video URL to remote API endpoints via requestApi, which is a safety-relevant network operation involving potentially sensitive user or system data. Although the functions have developer-facing docstrings, there is no visible user-facing confirmation, warning, or disclosure in this file about transmitting that data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language content in comments and JSDoc forces a specific language/locale for readers and maintainers without indicating any opt-in or alternative. Under the policy, language-specific instructions or documentation can be a violation when the skill does not offer language choice or justify the locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The code sends a token in API request parameters when creating a task, which is a sensitive credential-related operation. Although the function has technical docstrings, there is no explicit user-facing warning, confirmation, or disclosure in this file that the token will be transmitted to an external API.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The GET request places both the authentication token and a user-supplied URL into query parameters, which are more likely to be recorded in browser history, reverse proxies, CDN logs, analytics, and server access logs. In a skill that fetches public Douyin data, this increases privacy and credential-handling risk because sensitive auth material is exposed more broadly than necessary, and the target URL may also reveal user research intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file uses Chinese-only natural-language descriptions and operation labels such as "创建任务" and "查询任务" in comments and string literals, with no indication that the skill is China-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists fetched comment data to a local JSON file after displaying it, which creates an undisclosed secondary data sink beyond the obvious fetch-and-print behavior. Even though the source data is public, comment content can still contain usernames, personal opinions, and other sensitive contextual information, so silent local retention increases privacy and data-handling risk on the host system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool writes full comment results to disk without an explicit user-facing warning in the normal CLI flow. This is risky because users may reasonably expect transient output only, while the program creates a lasting local record that could be accessed by other users, backup systems, or unrelated processes on the machine.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains multiple user-facing strings in Chinese, including status messages and errors, with no indication that the user can choose another language. The policy explicitly flags language or locale constraints when a skill forces a specific language without user opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CLI persists fetched Douyin results to a local JSON file after completing the request, but there is no visible notice, consent, retention control, or redaction in this file. Even if the data is 'public', bulk-fetched profile/content data may still be sensitive in aggregate, and silent disk persistence increases the chance of unintended disclosure to other local users, backup systems, or later processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The program writes the full fetched result set to a local JSON file without any visible confirmation, destination selection, or access-control consideration in this file. Silent persistence can surprise users and create a secondary data store containing scraped content and metadata, increasing privacy, compliance, and local disclosure risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The calls to
search.createSearchTask(...)andsearch.getSearchTask(...)clearly send the search keyword and related parameters over the network, and the code also retrieves an API token from the environment. While success/error logs exist, there is no explicit user disclosure that entered search terms will be sent to a remote service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The tool silently persists full search results to a local JSON file without explicit user consent or warning. Even though the target data is described as public, queries, result sets, and associated metadata can still reveal analyst interests, investigations, or business research and may be exposed to other local users, backups, or downstream processes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code emits all user-facing status and warning messages exclusively in Chinese, including operational guidance and marketing text. Because there is no opt-in, fallback, or documented locale limitation, it creates a language/locale policy issue for users who may expect language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The title and field descriptions are written only in Chinese, which can impose a language expectation on users or downstream tooling without any visible opt-in or justification. Under the policy, locale or language constraints should either be optional for the user or clearly documented as intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The schema title and description are written only in Chinese, which imposes a specific language choice in natural-language metadata. The file does not provide an alternative language option or explain that the schema is intended solely for a Chinese-language or region-specific context.
- Content
Static analysis
No suspicious patterns detected.