Security audit

guaikei-douyin-recon

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its Douyin public-data purpose, but it automatically saves collected datasets and contradicts its own token-error safety claims by printing provider contact/promo information at runtime.

Review this before installing if your Douyin searches, monitored accounts, or comments could reveal sensitive business interests or personal data. Protect or regularly delete the generated logs, avoid running it in shared workspaces, and be aware that token errors may display provider contact information despite the skill documentation saying runtime output stays neutral.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The changelog advertises a capability to fetch all works published by a Douyin author, which expands the skill beyond the stated scope of keyword search, comment retrieval, and hot-list tracking. In an agent setting, undocumented capability expansion is risky because it can enable broader content harvesting, competitor surveillance, or unexpected data collection that downstream users and reviewers did not consent to or evaluate.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The code writes fetched post results to a local file after execution, creating persistent storage of potentially sensitive monitoring data without any visible consent, retention controls, or access protections in this file. In a reputation-monitoring skill, stored results may include account identifiers, post metadata, and other collected intelligence that can later be accessed by other local users, processes, or tooling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill states that logs are automatically archived to `logs/` using filenames derived from timestamps, keywords, parameters, and type, but it does not prominently warn users in the description that their queries and context will be retained. In a reputation-monitoring workflow, search terms, URLs, and analysis targets may reveal sensitive business interests, investigations, or personal data, creating confidentiality and privacy risk if logs are exposed or retained too long.

Vague Triggers

Low

Confidence: 89% confidence
Finding: The package description is overly broad and frames the skill as a general-purpose Douyin public-data analysis tool without clearly limiting when it should be invoked. In an agent setting, vague trigger boundaries can cause over-invocation for loosely related requests, increasing the chance of unnecessary scraping, privacy-invasive collection, or use in contexts beyond the user's intent.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The README explicitly promotes automatic export of scraped Douyin data to JSON logs for later analysis, but it does not clearly warn that search results, author metadata, comments, and other public-platform data may still contain personal data or sensitive content that requires careful retention, access control, and lawful handling. In a social listening and comment-scraping skill, silent local persistence increases the chance of over-collection, unintended retention, and downstream misuse or leakage of scraped datasets.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The instructions require users to set a persistent API token in an environment variable, but the guidance offers only a brief note about avoiding leakage and does not give concrete handling advice such as using secret managers, avoiding shell history exposure, restricting logs, or rotating compromised tokens. Because this skill depends on a third-party tokenized service, weak credential-handling guidance can lead to unauthorized API use, quota abuse, or accidental disclosure in shared environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Sensitive API results are silently persisted to a local JSON file, which increases exposure beyond the immediate command output and can leak monitoring data through filesystem access, backups, or later reuse. Because this skill is used for public-opinion and brand monitoring, the collected dataset may be operationally sensitive even if sourced from public content, making undisclosed local retention more dangerous in context.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The CLI writes full search output, including potentially sensitive keywords and returned content, to a local JSON file by default without an explicit warning or opt-in at the write site. In a public-opinion/reputation-monitoring skill, these logs can accumulate sensitive business intelligence, user queries, or monitored subjects and may be exposed to other local users, backups, or accidental commits.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.