T09 · Insecure Skill Coding Practices
Warning
- Location
src/api/search.js:59- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-query-retrieve-deliver-public-data
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Douyin public-data purpose, but it has review-worthy concerns around broad triggering, automatic local retention of scraped data, and inconsistent token/error handling.
Review before installing. Use only when you intentionally want Douyin public data sent to Guaikei's API, treat the API token as sensitive, and avoid running broad comment or creator scraping on shared systems unless you are comfortable with full JSON results being saved locally.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:23- Finding
Runtime Promotional and Contact Output Contradicts the Declared Authentication-Error Policy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (54)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
代码行为比较单一：输入抖音博主主页URL和作品数量，创建任务后查询并返回博主已发布作品列表。这与描述中的广泛能力范围不一致。描述提到可在用户询问某条视频、某个博主、热搜话题的数据时使用，还举了“这视频底下大家咋说”“这博主火不火”等触发示例，暗示评论数据、热度分析或热搜相关能力；但当前代码没有评论抓取、热度分析、热搜话题处理，也没有其他短视频平台支持。虽然“某个博主获取数据”与已发布作品列表部分相关，但整体描述明显宽于该代码实际能力，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个较通用的抖音数据技能，触发场景包括查看某视频下大家怎么说、某博主火不火、热搜话题等多类需求。但该代码片段的主功能非常单一：作为 hot 命令入口，获取抖音热榜并以 JSON 输出结果。它没有实现评论抓取、博主分析、视频级别数据获取等行为。因此描述与实际行为存在明显范围不一致：虽然“热搜话题”这一部分与代码一致，但整体声明让人预期技能支持更广泛的抖音数据查询，而实际代码只支持热榜。未发现额外越权或处理其他平台的行为，问题主要是声明范围显著大于实际能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
代码明确围绕‘获取抖音博主作品列表’展开：参数说明要求输入博主主页URL或sec_uid，调用 createPostTask/getPostTask 获取作品，最终输出 results 为作品列表。它并未实现视频评论、博主热度分析、热搜话题数据等描述中暗示的多类数据能力。虽然仍属于抖音平台范围内的数据获取，但声明的适用场景明显宽于该代码实际能力，因此存在描述与行为不一致。日志写文件和令牌处理属于支持性实现细节，不构成额外安全能力问题。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
声明描述的是一个面向多种抖音数据需求的技能，包括视频评论舆情、博主热度、热搜话题等较宽泛能力；但提供的代码片段只实现了基于关键词的内容搜索，返回搜索结果列表，并没有显示获取评论、博主指标或热搜榜单的逻辑。因此代码行为只覆盖声明的一部分，且未能支持声明中几个核心示例能力，属于描述与实际行为不完全一致。虽然都属于抖音平台数据查询，主域一致，但能力范围被声明得更广。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向抖音/短视频数据查询场景的技能，强调特定平台、特定用户触发意图和数据获取能力。而提供的代码片段并未体现任何抖音、视频、博主、热搜、数据抓取或平台限定逻辑；它只是通用的 CLI 参数解析与帮助信息构建模块。虽然这类工具代码可能作为更大系统的辅助组件存在，但就该代码片段本身而言，其实际行为与声明的主要用途明显不一致，属于材料性目的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向抖音/短视频数据查询分析的技能，但提供的代码并未体现任何与抖音、视频、博主、热搜或数据获取相关的行为。相反，它执行的是本地日志文件写入这一通用文件系统能力，包括创建目录和写入内容。该能力既未在声明中体现，也与声明的主要用途明显不一致。因此这是明显的描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个面向抖音/短视频内容数据查询与分析的技能，但给出的代码仅是一个辅助函数：通过 fs 和 path 定位并读取 package.json，然后返回其中的 name 字段。这不是对声明能力的支撑性实现细节，因为代码片段本身完全没有体现任何与目标平台、视频、博主、评论或热搜数据相关的逻辑，反而执行了本地文件系统读取这一与描述无关的能力。因此该代码片段与声明用途存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个较通用的抖音/短视频数据查询技能，用户可以通过查看视频评论、博主热度、热搜话题等自然语言触发。但给出的代码片段只负责把一个结果数组渲染成“抖音最新热榜”消息，没有任何与视频评论、博主分析、跨短视频平台数据、触发识别或数据获取相关的实现。虽然这是局部代码，单看该片段其实际行为与声明中的广泛用途存在明显收缩，核心能力更像是“抖音热榜格式化输出”而不是完整的抖音/短视频数据查询技能。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares use of an environment variable token (
GUAIKEI_API_TOKEN) but does not declare an explicit tool scope or permissions boundary. This creates a transparency and least-privilege problem: the runtime may expose environment access that users and reviewers cannot easily validate, increasing the chance of secret misuse or unintended capability expansion.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation guidance explicitly says the skill should trigger even when the user does not mention Douyin, for broad research and planning contexts. Overbroad triggering can cause the agent to invoke external data collection unexpectedly, exposing tokens, network access, and potentially collecting third-party data when the user intent was ambiguous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phrase "纯中文界面" states a fixed language requirement. Under the policy, forcing a specific language without opt-in or documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title at L004 and repeated field descriptions below. Because the file provides no indication that the skill is region-specific or that users can choose another language, it appears to impose a specific language/locale by default.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest context says the skill is for retrieving public Douyin data when users ask about videos, creators, or hot topics, and explicitly says it does not provide growth/operations advice. In contrast, the package description advertises use for '短视频营销、竞品分析...助力爆款内容策划与流量追踪', which broadens the intended purpose toward marketing strategy and competitor analysis rather than simple public-data retrieval.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill for retrieving Douyin public data when users want to inspect video, creator, comment, or hot-topic information, and explicitly says it does not provide follower-growth/agency advice. The README's one-line value proposition adds '帮你做爆款选题、竞品分析、舆情监控、热点追踪', which shifts the skill from simple data retrieval into marketing and competitive-intelligence outcomes not stated in the manifest.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that scraped Douyin data is automatically exported to local JSON logs, including comments and creator/video identifiers, but provides no prominent warning about retention, access control, or handling of potentially sensitive personal data. In practice, this can lead to unnecessary collection and long-term storage of user-generated content on disk, increasing the chance of local disclosure, over-sharing, or reuse beyond the original purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest positions the skill as obtaining Douyin public data on videos, creators, comments, and hot topics, while avoiding operational growth advice. The README's scenario list includes '模仿爆款文案', '监控竞品账号', and '做营销报告', which presents the skill as supporting content replication and marketing analysis rather than merely retrieving requested public data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The changelog advertises 'competitor account content batch scraping,' which expands the skill from narrow public-data lookup into systematic collection of third-party content. Even if the data is publicly accessible, framing and enabling bulk competitor scraping increases the risk of misuse, policy drift, and privacy/compliance issues beyond the declared user-facing purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all operational instructions, parameter descriptions, and examples in Chinese, which constitutes a language-specific constraint in natural-language content. The file does not offer an alternative language option or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JavaScript file contains natural-language comments and operation labels in Chinese, such as the module description and task labels, with no indication that the skill is region-specific or that users can opt into another language. Under the policy rule, forcing a specific language without opt-in is a natural-language locale violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI writes full comment results to a local JSON file by default after printing them, creating a silent persistence channel for potentially sensitive or regulated data. Even though the filename is partially sanitized, users are not clearly warned or asked for consent, and the stored content may include personal data from commenters that remains on disk longer than intended.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code contains multiple user-facing strings such as status messages and errors only in Chinese, and there is no indication that the skill is limited to Chinese-speaking users or that another language can be selected. That creates a natural-language policy issue because the skill effectively forces a specific language without user opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI persists the full retrieved results object to a local JSON file after successful execution, even though the skill is described as retrieval/delivery rather than local retention. Douyin post data may contain identifiers, content metadata, and other scraped output that can accumulate on disk without user awareness, creating unnecessary data retention and local disclosure risk on shared or multi-tenant systems.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file presents all natural-language user-facing content in Chinese, including error messages and generated help text, with no indication that the skill is region-specific or that users can opt into another language. That can violate a language/locale policy when a skill imposes a specific language by default without documented justification or user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code emits user-facing validation and status messages in Chinese only, including error strings and success output. This imposes a specific language on users without any opt-in, fallback, or documented region-specific justification, which matches the language/locale policy violation criterion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The save-success and write-failure messages are also hard-coded in Chinese, continuing the same language restriction in operational output. Because the file provides no mechanism for user language selection or documented locale scoping, this is a natural-language policy issue.
- Content
Static analysis
No suspicious patterns detected.