Security audit

guaikei-douyin-public-data-for-market-analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it needs Review because it handles an API token and saves collected Douyin data while concealing promotional/contact output in authentication failures.

Review before installing. Use a dedicated, revocable API token; avoid sensitive search terms; treat API-returned messages as untrusted data; and delete or protect the logs/ directory because it may contain queries, creator identifiers, comments, and other public personal data. Do not rely on runtime auth messages for official support because the artifact contradicts its own neutral-error policy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/request.js:50
Finding: Concealed Promotional Contact Injected into Authentication Errors
Content: View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis The Skill hardcodes a WeChat contact into the error generated for HTTP 401 and 403 responses. All four command-line interfaces propagate `error.message` into structured stdout JSON, which is explicitly intended for consumption by an AI agent. This behavior contradicts the declaration in `SKILL.md:36-38`, which states that invalid-token errors will contain only neutral information and will not include contact details or promotional content. The discrepancy conceals runtime behavior from reviewers and causes ...[truncated 1248 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: API Authentication Token Exposed in URL Query Parameters
Content: View full analysis
Remediation: View remediation
`, or another documented secret header. 3. Ensure server-side access logs and tracing systems redact authorization headers. 4. Rotate existing tokens because historical request logs may already contain them. 5. Configure the API and reverse proxies to reject authentication tokens supplied through URLs after a migration period. 6. Add tests that inspect generated request paths and fail if token values appear in them. 7. Apply short token lifetimes, revocation support, rate limits, and scoped API permissions to reduce the impact of credential disclosure. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/request.js:29
Finding: Untrusted Remote Error Messages Propagated into Agent-Consumed Output
Content: View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis The external API controls `jsonBody.errmsg`. The request layer converts that field directly into an exception message, and each CLI copies `error.message` into structured stdout and stderr. JSON serialization prevents the message from breaking JSON syntax, but it does not make the content safe for an AI agent. A consuming agent may interpret natural-language text inside the `message` field as instructions, a ...[truncated 1620 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill declares '不写入文件系统（日志除外)' in one section but later states it automatically saves output files into logs/. Even if intended, undocumented or inconsistently documented filesystem writes can expose scraped data, create retention/privacy issues, and make the skill behavior less transparent to operators.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill declares '不写入文件系统（日志除外)' in one section but later states it automatically saves output files into logs/. Even if intended, undocumented or inconsistently documented filesystem writes can expose scraped data, create retention/privacy issues, and make the skill behavior less transparent to operators.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill declares '不写入文件系统（日志除外)' in one section but later states it automatically saves output files into logs/. Even if intended, undocumented or inconsistently documented filesystem writes can expose scraped data, create retention/privacy issues, and make the skill behavior less transparent to operators.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill declares '不写入文件系统（日志除外)' in one section but later states it automatically saves output files into logs/. Even if intended, undocumented or inconsistently documented filesystem writes can expose scraped data, create retention/privacy issues, and make the skill behavior less transparent to operators.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares access to an environment variable token (GUAIKEI_API_TOKEN) and relies on command execution, but it does not explicitly declare tool scope or permissions. This weakens policy enforcement and reviewability because the runtime may grant broader capabilities than the manifest makes visible, especially around secret access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger guidance says the skill should activate even when the user does not explicitly mention Douyin and for generic multi-step research tasks like '帮我调研一下这个赛道'. This can cause over-broad activation, leading the agent to collect platform data unnecessarily, invoke external APIs without clear user intent, or mishandle tasks that belong to another platform or no scraping workflow at all.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON schema contains natural-language title and description fields exclusively in Chinese, including the top-level metadata and property descriptions. Because the file does not document that the skill is China-specific or offer any language/locale choice, it imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill explicitly supports scraping comments, author works, and exporting structured logs locally, but the README only mentions internal-use restrictions and does not clearly warn about privacy, retention, or handling obligations for collected public personal data. This can lead users to collect and persist large amounts of identifiable or sensitive comment/account data without safeguards, increasing compliance and data-exposure risk if logs are shared, synced, or leaked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger mapping and intent rules treat generic verbs like "搜一下" and "找" as activation cues for search-cli.js. These are common everyday phrases and, without stronger domain qualifiers or exclusion rules, could cause the skill to match unrelated user requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README maps broad phrases such as "今天有什么热点" and the priority rule "热点 / 榜单 / 今天什么火" directly to hot-cli.js. These expressions overlap with common conversational speech and the file does not provide sufficient exclusion conditions to prevent accidental activation outside the intended Douyin-analysis context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The changelog content describes the skill entirely in Chinese, and there is no natural-language indication that users may choose another language or locale. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation explicitly supports bulk retrieval of creator posts and comments, but provides no privacy, terms-of-service, or data-handling guidance. In a market-analysis skill, this omission can normalize large-scale collection of user-generated content and increase the risk of improper profiling, retention, or secondary use of public personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language comments and API descriptions are entirely in Chinese, including the module description and function documentation, with no indication that language selection is optional or that the skill is intentionally region-specific. Under the policy rule, forcing a specific language without user opt-in or documented justification is a locale-policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code sends a token and user-supplied search keyword to remote API endpoints via requestApi, which is a network/data-transmission operation covered by the warning requirement for code files. Although the functions are documented for developers, there is no confirmation prompt, user-facing log/print, or explicit disclosure in this file that user input and the token are being transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The CLI automatically persists fetched comment data to a local JSON file after printing it, without explicit user consent or a clear warning. Even though the data is described as public Douyin data, comment payloads can still contain personal data, usernames, text content, and metadata; silently storing them increases privacy, retention, and unintended disclosure risk on shared machines or in automated environments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI persists fetched Douyin post results to a local JSON file after completing the requested read operation. While the data is public, this creates an additional data-at-rest copy without explicit user notice or consent in this file, expanding the skill's behavior beyond simple retrieval and increasing privacy, retention, and local exposure risk on shared or monitored systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code writes fetched results to a local file with no explicit warning in the command flow, so users may believe the tool only prints output while it silently leaves a persistent artifact on disk. On multi-user machines, CI runners, or environments with disk backup/log collection, this can unintentionally disclose collected dataset contents and query history.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The stated purpose is public Douyin data search and analysis, with an emphasis on not using private/login-only data. This file nevertheless depends on a secret token from the environment, which is a credential-handling capability not disclosed in the manifest and not inherent from the user-facing description alone.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI writes the full search output and request metadata, including the user-supplied keyword, to a local file. In a skill advertised as public-data querying/analysis, this creates undisclosed local data retention and may expose sensitive user intent or collected dataset contents to other local users, backup systems, or later unintended reuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code returns user-visible error strings in Chinese (for example, "请求失败") and continues that pattern throughout the file without offering any language selection or documenting that the skill is China/Chinese-specific. That is a natural-language locale policy issue because the skill appears to enforce a specific language by default rather than making it an explicit opt-in or justified constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The authentication failure message is written entirely in Chinese and includes support instructions in that locale, with no indication that users can choose another language or that the skill is region-specific. This is a locale-policy concern because it hardcodes one language for a user-facing operational message.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code emits user-facing warning and info messages only in Chinese (for example, the warning and success/info output strings). That creates a locale/language policy issue because the skill forces a specific language for user communication without presenting any option or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments and user-visible error/output strings exclusively in Chinese, including validation messages and formatted result labels. Because the file does not offer any language selection or indicate that the skill is intentionally region-specific, it can violate a language/locale policy requiring user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The title and descriptions are entirely in Chinese, which imposes a specific language/locale on users of this schema. The file does not offer any language choice or explain that the skill is intentionally region- or locale-specific, so this is a natural-language policy concern under the locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JSON schema contains natural-language titles and descriptions exclusively in Chinese, including the top-level title/description and all property descriptions. Because the file provides no opt-in, alternative locale, or justification that it is intentionally region-specific, it may violate a language/locale policy requiring user choice or documented locale constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.