guaikei-douyin-query-retrieve-deliver-public-data

• Outcome: Review
• Latest audit: Aug 22, 2026 · 2:59 AM UTC
• Version: 1.0.0

Overview

This skill appears to fetch public Douyin data as advertised, but broad auto-trigger rules and default saved logs make it a Review item.

Install only if you are comfortable sending Douyin keywords, video or author URLs, limits, and your GUAIKEI token to guaikei.com, and with retrieved public data being saved under the skill's logs directory by default. Use explicit Douyin requests, avoid ambiguous broad invocations, periodically delete logs that contain comments or identifiers, and confirm your use complies with Douyin terms and privacy obligations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The changelog explicitly states support for obtaining an author's published works to enable bulk competitor-account content scraping. That goes beyond a narrow public-data lookup purpose and introduces a capability for large-scale harvesting of third-party content, which can facilitate surveillance, profiling, or platform-policy violations even if the data is nominally public.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The CLI writes the full retrieved comment payload to a local JSON file after completing a read-style operation, even though the skill description presents the behavior as retrieval/delivery rather than persistence. Persisting user-requested social media data creates an unnecessary data retention surface: comments may contain personal data, and the file may be accessible to other local users, backup systems, or later processes without the user's awareness.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: The CLI persists fetched results to a local JSON file after execution, even though the stated purpose is query-and-deliver public Douyin data. Local persistence can create unintended data retention, expose results to other local users/processes, and leave behind searchable artifacts containing queried URLs and retrieved data without explicit necessity or user consent.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI writes the full search output, including the user's keyword and returned results, to a local log file by default. For a retrieval-only skill, silent persistence expands the data exposure surface because sensitive queries or collected public-data results can remain on disk, be accessed by other local users/processes, or be unintentionally retained beyond the user's expectation.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger description is broad enough to activate the skill from vague references to short-video content, which can cause unintended external data retrieval and local logging without clear user consent. Overbroad invocation increases the chance of unnecessary data collection, surprising behavior, and privacy/compliance issues in multi-skill environments.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The file explicitly instructs activation even when the user did not mention Douyin, which materially widens scope and can cause the agent to pull third-party platform data based on weak inference. In context, this is more dangerous because the skill also uses an API token and persists output to disk, so accidental triggering can create unauthorized external requests and stored artifacts.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill maps broad everyday phrases like '搜索/搜一下/找' and other colloquial requests directly to command execution, which can cause unintended invocation when a user is speaking generally rather than explicitly requesting data scraping. In this skill's context, unintended activation is more sensitive because the action retrieves third-party platform data and writes structured outputs/logs, so accidental collection is a realistic privacy and compliance risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The intent recognition priority rules use high-level keywords such as '热搜', '搜索', '评论', '作品', and '博主' as activation signals, which are common terms in ordinary conversation and can cause the skill to run without sufficiently specific user intent. Because this skill accesses external data sources and may collect comments, author identifiers, and trend data, mistaken invocation can lead to unnecessary third-party data retrieval and storage.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README advertises automatic JSON log generation for scraped results but does not warn that logs may contain scraped content, user-supplied query terms, URLs, platform identifiers, or comment text. In a data-collection skill, silent persistent storage increases the risk of retaining personal or sensitive information longer than intended and may expose it through local access, backups, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: The code uses a credential from the environment and sends the requested URL/limit to a remote API without any explicit user-facing disclosure in the tool flow. In this skill context, users expect data retrieval from Douyin, so network use is somewhat implied, but undisclosed credential use and third-party transmission still create a transparency and consent gap, especially in agent-mediated environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The tool silently writes the complete comment results to a local JSON file after displaying them. Because comment content can include personal or sensitive user-generated text, undisclosed local storage increases the chance of unintended retention, later exfiltration, or access by other processes/users on the host.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Writing fetched results to a local JSON file without explicit warning or consent is a real security/privacy issue because users may expect transient processing from a CLI that 'retrieves and delivers' data. In shared or managed environments, these files can be read later by other users, included in backups, or harvested by malware, increasing exposure beyond the immediate command output.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The program silently writes search results to a file without informing the user in its help text or runtime prompts. Even when results are nominally public, undisclosed local persistence can violate user expectations, create privacy/compliance issues for query terms, and leave residual data on shared systems.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.