T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:81- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-quick-fetch-public
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it claims, but it handles an API token and scraped public data in ways users should review before installing.
Install only if you are comfortable sending Douyin queries, target URLs, and your GUAIKEI_API_TOKEN to guaikei.com, and with fetched results being saved locally in logs/. Treat the token as a real credential, rotate it if exposed, and avoid using this skill for ambiguous non-Douyin research unless you explicitly intend to query that service.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/token.js:23- Finding
Runtime Promotional and Contact Output Contradicts the Declared Token-Handling Policy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (43)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill explicitly states it will not write to the filesystem except limited logging, yet the analysis indicates local filesystem writes unrelated to the declared user-facing purpose. Undisclosed file writes are security-relevant because they can create persistence, leak queried data to disk, or bypass user expectations about data handling.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly states it will not write to the filesystem except limited logging, yet the analysis indicates local filesystem writes unrelated to the declared user-facing purpose. Undisclosed file writes are security-relevant because they can create persistence, leak queried data to disk, or bypass user expectations about data handling.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly states it will not write to the filesystem except limited logging, yet the analysis indicates local filesystem writes unrelated to the declared user-facing purpose. Undisclosed file writes are security-relevant because they can create persistence, leak queried data to disk, or bypass user expectations about data handling.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill explicitly states it will not write to the filesystem except limited logging, yet the analysis indicates local filesystem writes unrelated to the declared user-facing purpose. Undisclosed file writes are security-relevant because they can create persistence, leak queried data to disk, or bypass user expectations about data handling.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly states it will not write to the filesystem except limited logging, yet the analysis indicates local filesystem writes unrelated to the declared user-facing purpose. Undisclosed file writes are security-relevant because they can create persistence, leak queried data to disk, or bypass user expectations about data handling.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares access to an environment variable token (
GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope such as allowed tools or env access boundaries. In agent environments, missing scope declarations can cause overbroad execution privileges or make secret use insufficiently auditable, increasing the chance of unintended secret exposure or misuse.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises overly broad generalized activation, including triggering on common research or workflow requests even when users do not mention Douyin. In an agentic system this can cause unintended tool execution, unnecessary transmission of user queries to third-party services, and misuse of API credentials outside the user’s intended scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The line "纯中文界面" imposes a language constraint in natural language, but the document does not present it as user opt-in or explain a policy-justified reason for forcing Chinese. Under the policy, fixed language requirements can be problematic unless clearly justified or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON schema contains human-readable title and description strings exclusively in Chinese, including the top-level title/description and per-field descriptions. Because the file does not document that the skill is Chinese-only or offer any language choice, it may violate language/locale policy by forcing a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README states that scraped results are automatically exported to local log files, including video, account, and comment data, but it does not prominently warn that potentially sensitive or regulated public data will be stored on disk by default. In this skill's context, bulk collection of comments and account data increases the chance of unintended retention, leakage through shared workstations/repos, or mishandling of scraped personal data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest frames the skill as a public-data fetcher for Douyin content, creators, comments, and hot lists. At L074, the code reads GUAIKEI_API_TOKEN from the environment, which introduces credential access behavior not disclosed in the stated purpose and not obviously implied by a simple public-data retrieval description.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI writes fetched comment data to a local JSON file after printing the results, creating persistence beyond the user's immediate request. Because comments may include usernames, text, and other potentially sensitive or regulated content, silent local retention increases the risk of unintended data exposure, over-collection, and later reuse outside the stated on-demand retrieval purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code contains user-facing strings such as status/error messages entirely in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. That creates a natural-language policy concern because the skill effectively forces a specific language without user choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI persists fetched Douyin results to a local JSON file after completing the request, even though the visible behavior is framed as a fetch operation. This creates an undisclosed data-at-rest side effect: scraped content, potentially including profile and post metadata, is left on disk where other local users, processes, or backup systems may access it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool writes fetched results to a local file without clear user-facing notice in this file, so users may believe the data is only printed to stdout. Silent persistence increases privacy and operational risk because scraped data remains on disk after execution and may be collected by endpoint monitoring, backups, or other users on the system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script transmits the user-supplied keyword and an API token to external search endpoints, but this file does not provide a clear user-facing disclosure that data will leave the local environment. In a data-collection skill, network access is expected, but lack of transparency can still cause unintentional disclosure of sensitive search intent, especially in operational, competitor, or public-opinion monitoring scenarios described by the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI writes the full search output to a local log file named with the user keyword, without any explicit notice or opt-in in this file. Because search queries and returned results may contain sensitive business, research, or monitoring terms, this creates an unintended data-retention channel and can expose information to other local users, backup systems, or later compromise of the host.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file's natural-language comments and user-facing error/help strings are entirely in Chinese, indicating a fixed language/locale behavior. Under the policy, forcing a specific language without user opt-in or documented justification is a violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code emits user-facing error messages in Chinese, and the success/error messages later in the file do the same. This imposes a specific language on users without any opt-in, fallback, or documented justification, which matches the locale-policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes a skill for searching/viewing public Douyin content, creators, comments, and hot rankings. This helper persists arbitrary string content into local files under a logs directory, which is a separate data-retention/write capability rather than an obvious requirement of public-data fetching itself.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file returns user-facing error strings in Chinese, such as 请求失败, without offering any language choice or indicating a justified locale restriction. The policy requires avoiding forced language/locale behavior unless the skill explicitly offers opt-in or is clearly documented as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Several user-visible error messages, including 响应解析失败 and the authentication guidance, are hard-coded in Chinese. Because the file does not offer users a language choice or document a justified locale-specific scope, this appears to force a specific language in violation of the language/locale policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code constructs all user-facing output using Chinese text literals such as '抖音最新热榜' and '详细列表'. Because the file provides no indication that the skill is region-specific or that users can opt into this locale, it creates a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits multiple user-visible validation and formatting messages only in Chinese, including error messages and result labels. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The example trigger "热点趋势" is broad and may refer to general news, marketing, or other platforms rather than Douyin. Without nearby constraints requiring platform context, this can create unintended activations.
- Content
Static analysis
No suspicious patterns detected.