Security audit

guaikei-douyin-public-data-fetcher

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs Douyin public-data collection as described, but it has review-worthy mismatches around token error messaging, credential handling, automatic logging, and download-capable output fields.

Review before installing. Use only for clearly Douyin-related public-data tasks, avoid sensitive search terms, and treat exported comments/account data as potentially personal data. Be aware that invalid-token handling displays promotional contact/website text despite the skill's own safety instructions, and that the token is sent to the provider in URL query parameters.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The schema explicitly documents `play_addr` as both a playback URL and a video download address, which conflicts with the skill's stated scope that excludes download functionality. Even though this file is only a schema, documenting and normalizing a download field can enable downstream consumers or agents to expose unsupported downloading behavior, creating policy and compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI writes the full comment-fetch results to a local JSON file after printing them, which creates unnecessary persistence of potentially sensitive or regulated user-generated content. Even though the data is described as public Douyin data, comments can still contain personal information, and silent local retention increases exposure through accidental disclosure, insecure file permissions, or later reuse beyond the user's expectations.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The description says the skill should trigger even when the user does not mention 'Douyin', which broadens activation beyond clear user intent. This can cause the agent to invoke a third-party data collection workflow unexpectedly, increasing the chance of unnecessary external requests, token use, and mismatched handling of requests that were meant to be platform-agnostic or about another service.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The invocation guidance repeats the ambiguous rule to use this skill even if the user did not say 'Douyin', reinforcing over-broad routing logic without sufficient guardrails. In practice, this can misroute unrelated requests into a data-fetching skill that consumes credentials and queries an external service, creating privacy, compliance, and least-surprise issues.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly collects Douyin public content, comments, and exports structured logs locally, but the warning language focuses on token setup and usage limits rather than privacy, retention, or handling of potentially personal data in comments and account outputs. Even for public data, local export and secondary analysis can create privacy, compliance, and misuse risk if users are not clearly warned about storage, sharing, retention, and lawful use.

Missing User Warnings

Medium

Confidence: 71% confidence
Finding: The GET request places the token and search parameters into the query string, which can be exposed through server logs, proxies, browser history, or monitoring systems even when TLS is used. In this skill context, the parameters include authentication material and potentially sensitive research keywords, so leakage could enable account misuse or reveal user interests and investigation targets.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The CLI writes full search results to a local JSON file named with the user keyword, but the file output is not clearly disclosed to the user in this code path. In this skill context, results may contain scraped public-platform data and user-supplied search terms, so silent persistence can create privacy, retention, and operational exposure on shared systems.

Static analysis

No suspicious patterns detected.