Security audit

guaikei-douyin-scan-gather-output-posts

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin public-data purpose, but it mishandles API tokens and contradicts its own safety claims about runtime promotion and downloads.

Review before installing. Use only a narrowly scoped GUAIKEI_API_TOKEN, avoid running it for ambiguous requests, and expect provider API calls plus local logs of collected results. Treat runtime token-recovery messages and download-address fields as inconsistent with the skill's stated safety boundaries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/token.js:23
Finding: Runtime promotional and contact-message injection contradicts the declared neutral authentication policy
Content: View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis The Skill documentation explicitly states that invalid-token handling must produce only a neutral error and must not emit websites, contact information, or marketing material at runtime. The impl ...[truncated 2215 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: API authentication token is transmitted in URL query strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:15
Finding: Remote API responses are buffered without a size limit
Content: View full analysis
{ let timedOut = false; const req = https.request( { ...options, timeout: constants.REQUEST_TIMEOUT }, (res) => { res.setEncoding("utf-8"); let body = ""; res.on("data", (chunk) => (body += chunk)); res.on("end", () => { if (timedOut) return; if (res.statusCode === 200) { try { const jsonBody = JSON.parse(body); if (jsonBody.errcode === 0) { resolve(jsonBody); } else { let e; if (jsonBody?.errcode <= 16) { e = new ApiError( jsonBody?.errcode?.toString(), jsonBody?.errmsg || "请求失败", ); } else { e = new ApiError( jsonBody.errcode.toString(), jsonBody?.errmsg || "请求失败", ); e.noRetry = true; } reject(e); } } catch (parseError) { reject(new NetworkError(`响应解析失败: ${parseError.message}`)); } } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量或联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); } else { reject( new ApiError( `HTTP_${res.statusCode}`, `请求失败, 状态码: ${res.statusCode}`, true, ), ); } }); }, ); ``` ### Technical Analysis The HTTP client append ...[truncated 1984 chars]
Remediation: View remediation
{ receivedBytes += Buffer.byteLength(chunk, "utf8"); if (receivedBytes > MAX_RESPONSE_BYTES) { req.destroy(); reject( new NetworkError("The API response exceeded the permitted size limit."), ); return; } body += chunk; }); ``` ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill states that it collects public Douyin data, but it also documents automatic persistence of results into local log files without prominently surfacing that behavior as part of the skill's effective data handling. Silent or under-disclosed local storage of collected content can create data retention and privacy risks, especially when search terms, URLs, or comments may contain sensitive business or personal context.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that it collects public Douyin data, but it also documents automatic persistence of results into local log files without prominently surfacing that behavior as part of the skill's effective data handling. Silent or under-disclosed local storage of collected content can create data retention and privacy risks, especially when search terms, URLs, or comments may contain sensitive business or personal context.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that it collects public Douyin data, but it also documents automatic persistence of results into local log files without prominently surfacing that behavior as part of the skill's effective data handling. Silent or under-disclosed local storage of collected content can create data retention and privacy risks, especially when search terms, URLs, or comments may contain sensitive business or personal context.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states that it collects public Douyin data, but it also documents automatic persistence of results into local log files without prominently surfacing that behavior as part of the skill's effective data handling. Silent or under-disclosed local storage of collected content can create data retention and privacy risks, especially when search terms, URLs, or comments may contain sensitive business or personal context.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states that it collects public Douyin data, but it also documents automatic persistence of results into local log files without prominently surfacing that behavior as part of the skill's effective data handling. Silent or under-disclosed local storage of collected content can create data retention and privacy risks, especially when search terms, URLs, or comments may contain sensitive business or personal context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill explicitly requires an environment variable token and Node execution but does not declare any tool scope such as environment-variable access. This creates a transparency and least-privilege problem: an orchestrator or reviewer cannot easily tell that the skill depends on secret material, increasing the risk of unintended secret exposure or over-broad execution permissions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation rule is overly broad: it says the skill should trigger for general short-video research even when Douyin is not mentioned. That can cause the agent to invoke this skill unexpectedly, sending user queries or target identifiers to an external data-collection workflow outside the user's clear intent, which is a scope-creep and consent problem.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents that results are automatically saved to local log files, but this is not surfaced as a clear user-facing warning in the skill description. Automatic persistence of collected data can expose search topics, URLs, comments, and analysis targets to later users, backups, or other processes, making this a real data-handling vulnerability in context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The phrase "纯中文界面" indicates a fixed Chinese-language interface. Under the policy, forcing a specific language without user opt-in or a clearly justified region-specific constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents video_url as both playback and download addresses, which conflicts with the skill metadata stating the skill is not for downloading. This mismatch can enable downstream agents or integrators to use the skill for media downloading anyway, weakening policy boundaries and increasing the chance of unauthorized content acquisition or misuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest explicitly says the skill is not applicable to downloading, but the response schema documents play_addr as both a playback address and a '视频下载地址'. That indicates the skill exposes downloadable media URLs rather than staying limited to searching, browsing posts, comments, and trends.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill states that it automatically generates JSON logs and later notes files are saved under a local logs directory, but it does not present this as a prominent upfront warning before use. Since the exported data may include scraped post metadata and comment content, users may unknowingly persist potentially sensitive or regulated data locally, increasing privacy, retention, and accidental disclosure risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language trigger mapping includes generic phrases like “搜索 / 搜一下 / 找” and broad topic cues that can activate the skill for routine conversation not clearly requesting Douyin scraping. In an agent setting, this can cause unintended collection of third-party platform data and execution of external commands when the user did not explicitly consent to using this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The intent recognition priority uses broad activation terms such as “热搜 / 热点 / 榜单 / 今天什么火” and “搜索 / 搜一下 / 找 + 关键词” without enough scope constraints. Because the skill is designed to query and export scraped Douyin data, these loose rules increase the chance of over-triggering on unrelated user requests and performing unintended data collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The code sends the token parameter in outbound API requests when creating a comment task, which is a sensitive credential transmission. Although the function has technical docstrings, there is no user-facing warning, confirmation, or disclosure in this file that a token will be sent to an external API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The getCommentTask function includes the token in request parameters for a network call, which involves sending sensitive authentication data. This file does not include any visible user disclosure, confirmation, or warning about that transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The CLI sends the normalized URL and requested comment limit to createCommentTask and getCommentTask, which are network-facing operations implied by the API module usage. The script logs the URL locally but does not clearly warn users that their input will be sent to a remote service for processing.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI persists fetched comment data to a local JSON file via log.taskWrite after completing the request. Even if the source data is publicly visible on Douyin, silently storing potentially large volumes of comments creates an undisclosed data-retention surface that exceeds a simple transient retrieval workflow and can expose user content to later unintended access on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The tool writes full comment results to a local JSON file without any user-facing warning, confirmation, or opt-in. This undisclosed persistence can surprise users, leave artifacts containing public-but-sensitive research data on shared systems, and broaden the exposure window beyond the immediate command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code writes the full task output to a JSON file via log.taskWrite, which persists user-requested data locally. In this file there is no explicit warning, confirmation prompt, or user-facing disclosure before saving the results to disk, so users may not realize data is being stored.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI writes full search outputs to a local JSON log file without obtaining explicit user consent or offering an obvious opt-out. Even if the source content is public, persisted query history and result sets can reveal user interests, investigative activity, or collected datasets, and the filename also embeds the searched keyword, increasing exposure through filesystem metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Search results are silently persisted to local storage with no user-facing warning at execution time. This creates a privacy and data-handling risk because users may reasonably expect a read/search operation to return results to stdout only, while the tool leaves behind recoverable artifacts on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file contains natural-language comments and user-facing error/help strings entirely in Chinese, including thrown errors and generated help output. Because the file does not offer any language/locale choice or explain that the skill is intentionally region-specific, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code embeds user-facing error strings only in Chinese, including an instruction to contact a WeChat number for resolution. That imposes a language/locale requirement without offering a choice or documenting a justified locale constraint, which matches the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JavaScript file contains user-facing natural-language strings entirely in Chinese, including warnings and status messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not shown here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.