guaikei-douyin-public-records

• Outcome: Review
• Latest audit: Aug 20, 2026 · 1:51 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Douyin public-data purpose, but it has review-worthy concerns around broad automatic triggering, automatic retention of collected social data, and runtime contact/marketing output that contradicts its own security notes.

Install only if you are comfortable sending Douyin keywords, profile/video URLs, requested limits, and a GUAIKEI_API_TOKEN-backed request to guaikei.com, and with collected public social-media records being saved locally in the skill's logs directory. Use explicit Douyin-only prompts, avoid ambiguous generic research requests, and periodically delete logs containing comments or user identifiers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill explicitly relies on the environment variable `GUAIKEI_API_TOKEN`, but the metadata shown here does not declare an env permission/capability boundary. That creates a transparency and review gap: operators may not realize the skill reads sensitive runtime secrets, and future code changes could expand env access without an explicit permission contract. In this context the risk is moderated because the documented use is limited to a single API token, but undeclared secret access is still a real security issue.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior says tokens are not persisted and frames the skill as handling public data, but the behavior summary indicates local log-file writes containing search, post, and comment results. Persisting scraped results can capture personal data from comments or account content, increasing retention, leakage, and compliance risk; the mismatch also misleads reviewers about what data is stored. The undeclared logging is more dangerous here because the skill processes large-volume public-platform data, which can still include personal information and sensitive trend-monitoring artifacts.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback address and a video download address, which conflicts with the skill metadata stating it does not cover downloading videos. This creates a capability mismatch: downstream agents or users may discover and use the field to enable prohibited download behavior, expanding the skill beyond its declared scope and potentially causing policy, compliance, or platform-terms violations.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill declares implicit triggers such as broad requests for short-video competitor research or hot topics even when the user does not mention Douyin. Overbroad trigger phrases can cause the agent to invoke this skill for unrelated requests, leading to unintended external data access, unnecessary token usage, and collection of third-party data the user did not actually request. The danger is increased because the skill can fetch up to 10,000 records, so a mistaken invocation can have material privacy, cost, and compliance consequences.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The example trigger expressions include generic phrases that overlap with ordinary research requests, which can train routing logic toward false positives. If the skill is selected on weak signals, it may initiate scraping-style collection against Douyin when the user meant another platform or wanted only general advice, creating unauthorized or unexpected data processing. In this skill's context, broad examples are especially risky because they normalize automatic invocation without clear platform confirmation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The natural-language trigger mappings include very broad phrases such as generic 'search / find' style requests that can match ordinary user queries without a strong Douyin-specific constraint. That can cause unintended skill invocation, leading the agent to call an external data-collection workflow and process/export third-party public data when the user may have meant a different platform or a general research task.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The intent-recognition priority rules use broad activation terms like 'hot', 'ranking', 'search', and 'find + keyword' with insufficient scope constraints, so common conversational requests may be over-classified into this skill. In this skill's context, misrouting is more dangerous because invocation can trigger authenticated API use, external requests, and collection of large volumes of social-media data, creating privacy, compliance, and unintended-action risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI sends the user-supplied Douyin URL and comment query parameters to a remote API service to create and retrieve a comment task, but the code does not provide an explicit notice or consent flow about external transmission. In a data-collection skill, this creates a privacy and transparency issue because users may assume processing is local while their targets and query metadata are being shared with a third-party backend.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool persists fetched comment results to a local JSON file automatically, without clearly informing the user that potentially sensitive collected data will be stored on disk. This can expose scraped public comments, URLs, and metadata to other local users, backups, or downstream processes, especially on shared systems or managed environments.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The CLI persists fetched Douyin results to a local JSON file automatically, without explicit user consent, a configurable output path, or any indication of the sensitivity/retention of the data. In a data-collection skill focused on public-record scraping, this increases the risk of unintended local data retention, disclosure to other local users/processes, and accumulation of potentially sensitive profile/comment metadata beyond the user's expectation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.