ClawHub
Back to skill

Security audit

guaikei-douyin-public-records

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin public-data purpose, but it has review-worthy issues around misleading token-error behavior and insecure token handling.

Review before installing. Use a dedicated, low-privilege Guaikei token, assume search keywords and Douyin URLs are sent to the Guaikei service, and be aware that result files are saved locally under logs/ by default. The runtime contact/website messages also do not match the manifest's stated neutral auth-error policy.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
src/utils/request.js:50
Finding

Undisclosed Promotional Contact Injected into Authentication Errors

Content
View full analysis

Vulnerability Details

File Location: src/utils/request.js:50-56
Vulnerability Type: Hidden runtime instruction and output manipulation
Risk Level: Medium

Evidence

js
} else if (res.statusCode === 401 || res.statusCode === 403) {
  const e = new AuthError(
    "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案",
  );
  e.noRetry = true;
  reject(e);
} else {

The message means that the API token is invalid and instructs the user to contact a specific WeChat number for a solution.

Technical Analysis

The runtime behavior directly contradicts the security policy declared in SKILL.md:31-44, which states that invalid-token errors must remain neutral and must not contain WeChat contact details, website links, or promotional language.

When the remote API responds with HTTP 401 or 403, the implementation constructs an AuthError containing the hard-coded contact number. CLI error handlers then serialize error.message into their JSON output. For example, src/douyin/comment-cli.js:82-103 copies the message into the message property written to standard output.

This creates a hidden output-manipulation channel: an agent following the documented instruction to present runtime errors to the user may unknowingly relay promotional contact information that the Skill manifest explicitly claims will never appear.

Attack Path

  1. A user invokes one of the Skill's CLI commands.
  2. The CLI reads GUAIKEI_API_TOKEN and sends a request to the remote API.
  3. The remote service returns HTTP 401 or 403.
  4. src/utils/request.js creates an AuthError containing the hard-coded WeChat contact.
  5. The CLI catches the error and copies error.message into stdout JSON.
  6. An AI agent or other caller consumes that JSON and may present the promotional contact to the user.

Impact Assessment

The issue enables unauthorized promotional content to enter agent-visible and user-visi ...[truncated 351 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the contact-bearing message with a neutral authentication error:
    js
    const e = new AuthError(
  "GUAIKEI_API_TOKEN is invalid. Verify that the environment variable contains a valid token.",
);
  2. Prohibit runtime error messages from containing phone numbers, social-media contacts, onboarding links, or marketing language.
  3. Add automated tests that simulate HTTP 401 and 403 responses and assert that stdout and stderr contain only neutral error text.
  4. Add a repository-wide policy test that rejects contact information in executable source files.
  5. Keep support and token-acquisition information exclusively in clearly identified user documentation rather than runtime output.
  6. Ensure every CLI maps authentication failures to a stable error code without relaying uncontrolled or promotional text.

T09 · Insecure Skill Coding Practices

Warning
Location
src/utils/request.js:104
Finding

API Token Transmitted in URL Query Strings

Content
View full analysis

Vulnerability Details

File Locations: src/api/search.js:59-62, src/api/comment.js:38-41, src/api/post.js:23-26, src/api/hot.js:19-22, and src/utils/request.js:104-116
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: Medium

Evidence

Token insertion in src/api/search.js:59-62:

js
const params = {
  _: Date.now(),
  token: token,
};

Query-string construction in src/utils/request.js:104-116:

js
params.skill_name = skillName();

const fullPath = `${path}?${querystring.stringify(params)}`;
const jsonData = JSON.stringify(data);

const options = {
  host: constants.BASE_URL,
  path: fullPath,
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Accept-Encoding": "identity",
    "Content-Length": Buffer.byteLength(jsonData),
  },
};

The same token-as-query-parameter pattern is used by the search, comment, post, and hot API modules. The GET path also serializes the supplied parameters into the URL.

Technical Analysis

Authentication credentials should not be placed in URL query strings. Although HTTPS encrypts the request in transit, URLs are routinely captured outside the transport layer by:

  • Reverse-proxy and web-server access logs
  • API gateway and load-balancer logs
  • Application performance monitoring systems
  • Request tracing and error-reporting platforms
  • Server-side analytics or debugging middleware

The token is therefore exposed to a broader set of systems and operators than necessary. It may also remain in retained logs after the original request has completed.

Using a query parameter also makes reliable redaction more difficult because generic URL logging frequently records the complete request target. Authentication should instead use a dedicated header whose value can be centrally redacted.

Attack Path

  1. A user stores a valid service credential in `GUAIKE ...[truncated 967 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove token from all query-parameter objects.
  2. Send the credential in a dedicated authorization header:
    js
    const options = {
  host: constants.BASE_URL,
  path: fullPath,
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
    "Accept-Encoding": "identity",
    "Content-Length": Buffer.byteLength(jsonData),
  },
};
  3. Refactor the request API so the token is accepted separately from ordinary query parameters, preventing accidental URL serialization.
  4. Configure server, proxy, gateway, and telemetry systems to redact authorization headers.
  5. Review existing access and telemetry logs for previously retained tokens and securely delete or restrict those records.
  6. Rotate all tokens that may already have been transmitted and retained in request URLs.
  7. Add tests asserting that generated request paths never contain token, access_token, or equivalent credential parameters.
  8. Apply short expiration periods, scoped permissions, rotation support, and revocation controls to issued tokens.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

代码仅实现了 parseArgs、readValueAfterFlag 和 buildHelp 三个通用参数处理函数，用于读取命令行输入、校验参数合法性并生成帮助信息。这属于底层辅助工具，而不是抖音公开数据相关技能本身的业务逻辑。根据评估标准，虽然辅助实现细节本身不应单独判定为不匹配，但在当前提供的代码片段中，完全看不到与抖音、搜索、评论、热榜、账号作品抓取等声明能力相关的任何行为，因此该代码片段与声明目的存在明显的实质性不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是抖音公开数据采集与分析相关能力，而提供的代码片段并未体现任何抖音数据搜索、抓取、评论分析或热榜查询功能。相反，它执行的是本地日志文件写入这一通用辅助功能，并访问了文件系统资源，这与声明的核心用途明显不一致。虽然日志功能可能作为配套实现存在，但当前代码片段本身的实际行为与所宣称的主要能力完全不匹配，因此应判定为描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a feature-rich Douyin data collection and analysis skill. However, the supplied code chunk does not implement any of those capabilities. It simply accesses the local filesystem to read package.json and returns the package name. This is a materially different purpose from the declared behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill explicitly depends on the environment variable GUAIKEI_API_TOKEN, but it does not declare a tool scope such as permissions or allowed-tools to make that access explicit. Undeclared environment access weakens reviewability and least-privilege guarantees, making it harder for a host system to constrain what secrets the skill may read.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill says it should trigger even when users only mention generic short-video research without explicitly naming Douyin. Overly broad implicit activation can cause the agent to invoke platform-specific scraping or data collection unexpectedly, increasing the chance of collecting data the user did not intend to request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples include broad research phrases like competitor research and popular-topic discovery without clear platform constraints, reinforcing accidental invocation on ambiguous requests. In an agent setting, this can lead to unnecessary third-party data access and user-surprising behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill states that it automatically archives logs containing timestamps, keywords, parameters, and type to logs/, but it does not clearly warn users or provide controls over retention. Search keywords, account URLs, and comment/video targets can reveal sensitive business intent or research topics, so silent persistence creates a privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The title and field descriptions are entirely in Chinese, which imposes a specific language on users and integrators with no opt-in or indication that the schema is intentionally limited to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a language without user choice or clear justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The schema explicitly documents video_url as both playback and download addresses, which conflicts with the skill manifest stating it does not cover downloading videos. This mismatch can enable downstream agents or integrators to expose or automate video download functionality that is outside the declared scope, increasing policy and misuse risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The schema explicitly documents play_addr as both a playback URL and a video download address, which conflicts with the skill’s stated scope that it does not support video downloading. Even though this file is only a schema, exposing and legitimizing a download field can enable downstream tooling or agents to use the skill for prohibited content retrieval, creating policy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README promotes data export and later mentions logs are automatically saved locally, but it does not clearly warn users up front that retrieved data and task metadata will be written to disk. In a skill handling search terms, account URLs, video IDs, and comment data, silent local persistence can expose sensitive research targets or regulated content to other local users, backups, or endpoint monitoring tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill requires a GUAIKEI_API_TOKEN and sends keywords, profile URLs, and video URLs to an external service, but the README does not clearly disclose that user-supplied search targets are transmitted off-box to a token-gated third party. This creates a privacy and data-governance risk because users may assume the skill operates locally while their research interests, monitored accounts, and analyzed content are actually shared with an external provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The changelog and feature descriptions are written in Chinese throughout, and the file does not indicate that users may choose their preferred language or that the skill is restricted to a Chinese-language or region-specific audience. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The function sends a token and video URL to an external API via requestApi, which is a data-transmitting network operation covered by the warning requirement for code files. While there are developer docstrings, there is no user-facing confirmation, logging, or warning in this file about transmitting these values.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This function performs a GET request that includes the token and video URL in request parameters, which is a network transmission of potentially sensitive or user-provided data. The file contains no user-facing notice, confirmation, or runtime logging that this external request occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The code reads an API credential from process.env.GUAIKEI_API_TOKEN and exits on failure, but there is no inline comment, help text, or user-facing warning in this file explaining that the command depends on and accesses a sensitive environment variable. For code files, accessing credentials should have some visible disclosure unless it is already clearly documented elsewhere, which is not shown here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI silently persists fetched comment data to a local JSON file after printing the results. Comments can contain personal data, usernames, or sensitive research data, and writing them to disk without explicit user consent or notice can create unintended data retention, exposure to other local users/processes, and compliance/privacy issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The CLI descriptions, examples, and runtime messages are presented in Chinese throughout the file, with no option to select another language and no documented justification for a Chinese-only locale. This can violate language/locale policy where skills should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code reads an API token from the environment and then sends the user-supplied identifier to create and fetch a remote post task. Although this network behavior is central to the tool, this file does not include a clear user-facing disclosure, prompt, or comment warning that the supplied URL/sec_uid will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

After retrieving results, the code sanitizes the URL and writes the full output to a timestamped JSON file via log.taskWrite. This is a file-write operation affecting local user data/storage, but the file does not present a clear disclosure beforehand that a persistent artifact will be created.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The CLI writes the full search output, including potentially sensitive query terms and collected public-records data, to a local log file without clear user disclosure or opt-in. In this skill’s context, users may reasonably expect data to be printed to stdout only; silent persistence increases the risk of unintended retention, later exposure to other local users/processes, or accidental inclusion in backups and telemetry.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JavaScript file contains natural-language comments and user-visible CLI messages entirely in Chinese, including errors and help text. Under the stated policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file contains user-facing status and error messages in Chinese, such as the validation errors at L07 and L11, which imposes a specific language on users. Under the policy, locale-specific behavior should either offer user choice or be explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The success and failure messages at L36-L38 are also hardcoded in Chinese, reinforcing a fixed-language behavior across the skill. This is a natural-language policy concern because users are not given a language choice and the locale restriction is not justified in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The phrase "纯中文界面" indicates a fixed language/locale behavior. The file does not mention user choice, opt-in, or a documented justification that this must be Chinese-only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.