Security audit

guaikei-douyin-public-videos-dataset

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its Douyin public-data purpose, but it has under-disclosed behavior around broad triggering, credential handling, local data retention, and agent-visible promotional or remote error output.

Review before installing. Use only if you are comfortable sending Douyin queries, profile/video URLs, and a Guaikei API token to the third-party service, and with fetched results being saved locally by default. Treat error messages from the remote service as untrusted data, and avoid using broad natural-language requests that do not explicitly ask for Douyin data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/token.js:23
Finding: Promotional content is injected into authentication failure output
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: src/utils/request.js:28
Finding: Untrusted remote API error messages are emitted into Agent-visible output
Content: View full analysis
{ let response; if (method === "POST") { response = await postJson(path, params, data); } else { response = await getJson(path, params); } return response; }, maxAttempts, (attempt, err) => { utils.printError( `【${actionName}重试】 ${attempt + 1}/${maxAttempts} 次 - ${err.message}`, ); }, ); ``` `src/douyin/search-cli.js:171-181`: ```js } catch (error) { utils.printError(`搜索失败: ${error.message}`); const errorOutput = { status: "error", error_code: error.code || "UNKNOWN", message: error.message, timestamp: new Date().toLocaleString(), request: { command: "search", keyword: keyword, ``` ### Technical Analysis The HTTPS response body is parsed as JSON, after which the remotely supplied `errmsg` field is used directly as an exception message. No allowlist, normalization, length limit, control-character filtering, or separation between trusted local status text and untrusted remote diagnostic data is applied. The same message is subsequently: - Printed to stderr during retries. - Printed again when the CLI catches the final error. - Copied into the structured stdout JSON response. An AI Agent consuming the command output may treat this text as trusted tool guidance. If the remote service is compromised, misconfigured, or ...[truncated 1458 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:88
Finding: Reusable API token is transmitted in URL query strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (53)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill states that logs are automatically written to logs/ with filenames derived from timestamps and keywords. Local file writes increase the attack surface because user-influenced strings may end up persisted on disk, potentially exposing sensitive queries, creating retention/compliance issues, or enabling path/name handling bugs if sanitization is weak.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill states that logs are automatically written to logs/ with filenames derived from timestamps and keywords. Local file writes increase the attack surface because user-influenced strings may end up persisted on disk, potentially exposing sensitive queries, creating retention/compliance issues, or enabling path/name handling bugs if sanitization is weak.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that logs are automatically written to logs/ with filenames derived from timestamps and keywords. Local file writes increase the attack surface because user-influenced strings may end up persisted on disk, potentially exposing sensitive queries, creating retention/compliance issues, or enabling path/name handling bugs if sanitization is weak.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that logs are automatically written to logs/ with filenames derived from timestamps and keywords. Local file writes increase the attack surface because user-influenced strings may end up persisted on disk, potentially exposing sensitive queries, creating retention/compliance issues, or enabling path/name handling bugs if sanitization is weak.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states that logs are automatically written to logs/ with filenames derived from timestamps and keywords. Local file writes increase the attack surface because user-influenced strings may end up persisted on disk, potentially exposing sensitive queries, creating retention/compliance issues, or enabling path/name handling bugs if sanitization is weak.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill states that logs are automatically written to logs/ with filenames derived from timestamps and keywords. Local file writes increase the attack surface because user-influenced strings may end up persisted on disk, potentially exposing sensitive queries, creating retention/compliance issues, or enabling path/name handling bugs if sanitization is weak.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs generalized activation even when the user does not mention Douyin. Over-broad trigger logic can cause the agent to invoke external-data tooling unexpectedly, sending user queries to third-party services without clear consent or relevance, which is a privacy and boundary-control problem.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The explicit '泛化触发' statement is insufficiently bounded and encourages the agent to infer Douyin intent from broad content-research scenarios. In practice this can route unrelated user tasks through this skill, unnecessarily exposing prompts, causing irrelevant data collection, and violating user expectations about tool use.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares use of an environment variable (GUAIKEI_API_TOKEN) but does not explicitly declare any tool scope or permissions boundary. That creates an authorization and transparency gap: an orchestrator or reviewer cannot easily tell that the skill depends on secret material, which increases the risk of unintended secret exposure or over-broad execution rights.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The statement '纯中文界面' indicates the skill is limited to Chinese, but the file does not present this as a user-selectable option or justify it as a documented regional compliance constraint. This is a natural-language locale policy concern because it forces a specific language by default.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest explicitly says the skill is not suitable for downloading materials, but this response schema documents video_url as both playback and download addresses. That indicates the skill exposes downloadable video resource links, which goes beyond the stated read/search/comment/rank viewing intent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly says the skill is not suitable for downloading素材, implying a read-only discovery/analysis scope. However, the response schema documents play_addr as both a playback address and a '视频下载地址', which indicates the skill exposes downloadable media URLs rather than only search, creator, comment, or ranking metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README advertises automatic JSON log generation and later mentions storage in a logs folder, but it does not clearly foreground that fetched platform data, including comments and creator/video metadata, will be written to local files by default. This can lead to unintentional retention of scraped data on disk, increasing privacy, compliance, and data-handling risk if users assume results are ephemeral.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language trigger examples are broad enough to match ordinary user phrasing such as '搜一下' or '找…相关视频', which can cause the agent to invoke this skill when the user did not clearly request Douyin data collection. In this skill’s context, unintended invocation can expose user queries to a third-party service and initiate collection/storage of platform data without sufficiently explicit consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The competitor-monitoring examples use broad phrases like viewing a creator's works or homepage, which may over-trigger on common requests about accounts or profiles. Because the skill is designed to batch collect creator content, accidental invocation can result in excessive third-party data retrieval and local persistence beyond what the user specifically intended.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Generic comment-analysis phrases like '看看这个视频的评论' can be triggered in many conversational contexts and may cause the agent to fetch comment data from a provided link without clear informed intent. In this skill, that is more sensitive because comments can include personal data or controversial content, and the results are also logged locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The changelog and skill descriptions are written entirely in Chinese, which can imply a fixed language experience without user opt-in. The policy requires flagging language or locale constraints when the skill forces a specific language and does not offer a choice or document a justified regional limitation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI writes fetched comment data to a local JSON file after completing the query, even though its apparent purpose is to retrieve and display results. Persisting user-requested social media comments creates an unnecessary data-retention side effect that may surprise users, expose sensitive or regulated content in local storage, and increase the chance of later leakage from logs, shared workspaces, or compromised hosts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The tool silently saves retrieved comment results to disk without user-facing warning or confirmation. Because comments may include usernames, opinions, or other personal data, this undisclosed write behavior can violate user expectations, create privacy/compliance issues, and leave recoverable local artifacts on developer machines or CI runners.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code contains multiple user-facing strings in Chinese, including status and error messages, and does not provide any opt-in, fallback, or indication that the skill is intentionally limited to Chinese-speaking users. That creates a natural-language locale policy issue because the skill effectively forces a specific language without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The code reads GUAIKEI_API_TOKEN from the environment and calls remote API functions to create and fetch post tasks using the token, URL, and limit. Although network access is part of the tool's behavior, this file does not provide an explicit user-facing disclosure that input data and credentials will be used in outbound API requests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI persists fetched Douyin post results to a local JSON file after completing what is described as a search/read workflow. This creates an undisclosed data-retention side effect: scraped results may contain profile metadata or other sensitive business-research data and will remain on disk where other local users, processes, or backups can access them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The program writes retrieved results to a local file without any explicit warning or consent mechanism in this CLI path. For a skill positioned as search/analysis, silent persistence can surprise users and leak collected data through shared workstations, log collection agents, or filesystem backups.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI persists full search results to a local JSON file whose name includes user-supplied keyword data, and the tool does not provide a clear user-facing warning or consent flow before writing potentially sensitive query/output data to disk. In this skill’s context, users may search topics, creators, and public sentiment for research, which can still expose operational interests or sensitive research targets through local artifacts on shared machines or CI/workspaces.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The authentication error message is presented only in Chinese, which imposes a specific language choice on users with no opt-in or fallback. This can violate language/locale policy when the skill does not clearly document that it is region-specific or provide language selection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.