Security audit

guaikei-douyin-public-data-fetcher

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a coherent Douyin public-data collection skill, but it has review-worthy credential handling and runtime contact/redirection behavior that conflicts with its own stated policy.

Review this before installing if you are comfortable sending Douyin queries, URLs, and a Guaikei API token to www.guaikei.com. Treat the token like a secret, avoid shared environments, and expect search/post/comment results to be saved under logs by default. The package should remove runtime promotional contact messages and move token authentication from URL query strings to headers before broad use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/request.js:49
Finding: Authentication Failures Inject Promotional Contact Information into Agent-Visible Output
Content: View full analysis
process.exit(exitCode), ); ``` ### Technical Analysis The runtime emits an external website when a token is missing or malformed and embeds a WeChat contact number in errors generated for HTTP 401 or 403 responses. The CLI then copies the remote authentication error into machine-readable standard output through `message: error.message`. This behavior directly conflicts with the declared token-management policy in `SKILL ...[truncated 2038 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: Reusable API Token Is Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开数据检索与分析的技能，应体现与抖音搜索、作品抓取、评论获取、热榜查询等相关的网络请求、数据处理或平台特定逻辑。但提供的代码仅实现了通用参数解析器（parseArgs/readValueAfterFlag/buildHelp），属于底层 CLI 支撑工具，与抖音平台能力没有直接对应关系。虽然这类代码可能作为更大系统的辅助模块存在，但就该代码块本身而言，其行为与声明的核心用途明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音公开数据检索与分析的技能，而提供的代码片段只是日志工具函数 taskWrite，用于将字符串内容写入本地文件。它访问的是本地文件系统（fs、path），没有任何网络请求、抖音数据处理、搜索、评论分析或热榜查询逻辑。因此这不是单纯的辅助实现细节能够支撑声明能力的情况；从该片段可见的实际行为与声明的核心用途明显不一致，并且包含未声明的本地文件写入能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该代码片段的实际功能非常有限：使用 fs/path 读取相对路径下的 package.json，并返回 pkg.name。这与声明中描述的抖音公开数据采集与分析能力没有直接对应关系。虽然这可能是某个辅助工具函数，但就所提供代码本身而言，其主要行为是本地元数据读取，而非抖音数据处理。因此，描述与代码行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill explicitly depends on an environment variable (GUAIKEI_API_TOKEN) but does not declare any corresponding tool scope or permission boundary. This creates a transparency and least-privilege problem: an agent may access secrets from the environment without the skill manifest clearly advertising that requirement, making review and runtime containment harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill says it should trigger even when the user did not explicitly mention Douyin, for broad 'short video research' workflows. Over-broad triggering can cause the agent to invoke external data collection unexpectedly, increasing the chance of unnecessary secret use, unintended network access, and collection of third-party data outside the user's actual intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Generic trigger words like '热点' and '舆情' are too broad without platform or task constraints. In agent environments, overly generic routing can misfire into this skill during unrelated conversations, causing unintended API calls and use of the configured token, which is especially risky because the skill has networked data-collection behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JSON schema is a manifest-type file, so natural-language policy checks apply. The title and all field descriptions are written exclusively in Chinese, which imposes a specific language/locale without any opt-in or explanation that the schema is intended only for a Chinese-region tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The schema explicitly describes play_addr as both a video playback address and a video download address, which conflicts with the skill metadata stating it does not support downloading videos. That mismatch can enable downstream agents or integrators to expose or automate download behavior the skill claims to exclude, creating policy/compliance risk and expanding the skill’s effective capability beyond its declared scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states that the tool automatically exports collected Douyin data to local JSON logs, but it does not prominently warn that those files may contain scraped public content, identifiers, URLs, and potentially sensitive analysis artifacts that persist on disk. In a data-collection skill focused on comments, creator data, and trend monitoring, silent local retention increases the risk of unintended disclosure, over-collection, and insecure sharing of stored datasets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README instructs users to place the API token in an environment variable, but the warning about token security is secondary and not prominent where setup is introduced. This can lead users to expose the credential through shell history, screenshots, CI logs, shared terminals, or misconfigured environments, which would allow unauthorized use of the API quota and associated account access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The changelog content and feature descriptions are primarily presented in Chinese, and the file does not indicate that users can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file documents commands that fetch creator works and comment data from Douyin, which implies network access and retrieval of third-party content. The description provides usage details but does not include any warning about privacy, data handling, or the fact that the commands contact an external service and collect user-generated data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The program stores full comment results locally without explicit warning, confirmation, or a user-selected destination. Silent persistence can surprise users and may violate least surprise, retention, or privacy expectations, especially in research or shared workstation environments where cached files can be accessed by others.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code contains multiple natural-language strings shown to users exclusively in Chinese, such as status and error messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not evident in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: post.createPostTask and post.getPostTask are network-oriented API calls by naming and context, transmitting the supplied Douyin URL/sec_uid and request parameters off-host. This file does not include a confirmation prompt or explicit disclosure that input data will be sent to an external service, beyond the skill's implicit data-fetching purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI silently persists fetched creator-post results to a local JSON file, which creates a data-retention side effect beyond simply displaying public data. Even if the source data is public, local storage can expose research targets, collected datasets, or downstream metadata to other local users, backups, or unintended workflows without the operator realizing it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The tool writes fetched results to a local JSON file without an explicit user-facing warning in this flow, which can surprise users and create unintentional retention of collected data. Silent persistence is risky because operators may believe the command only performs a transient fetch while it actually leaves artifacts on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The CLI silently persists full search results and request metadata to a local file without explicit user notice or consent. Even though the data is publicly sourced, queries can reveal analyst interests, investigations, or monitored subjects, and local result files may later be exposed to other users, backup systems, or compromised hosts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple error strings in this file are hard-coded in Chinese, including parsing, authentication, timeout, and network failure messages. This imposes a specific language on users without opt-in or any documented justification, which is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file performs outbound HTTPS GET and POST requests and sends both URL parameters and JSON request bodies to a remote host via https.request. While the functions are documented as API helpers, there is no confirmation prompt, user-facing log, or warning in this file indicating that user or system data may be transmitted over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code constructs all user-facing output strings in Chinese, including headings and labels, with no indication that the skill is intended only for Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments and user-visible error/output strings exclusively in Chinese, including validation errors and formatted result text. That enforces a specific language for users without any opt-in or indication that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该表述直接限定界面语言为中文，属于自然语言层面的 locale 约束。文档中未说明这是用户可选项，也未给出必须限制为中文的政策或合规依据，因此可能违反语言选择相关组织政策。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest-style JSON file contains user-facing title and description fields exclusively in Chinese, which can impose a specific language on users without any opt-in or documented locale limitation. The policy requires flagging language or locale constraints unless the skill offers a language choice or clearly documents a justified region-specific scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON schema contains user-facing natural-language title and description fields exclusively in Chinese, including field descriptions throughout the file. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no locale choice or justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.