guaikei-douyin-scan-gather-output-posts

• Outcome: Review
• Latest audit: Aug 22, 2026 · 2:45 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Douyin public-data research purpose, but it needs review because it can run on broad prompts, sends queries and a token to a third-party service, saves collected data locally, and exposes media download-style URLs despite saying downloads are out of scope.

Install only if you are comfortable sending Douyin search terms, URLs, and a GUAIKEI_API_TOKEN to guaikei.com and storing collected public-content results in local log files. Use it for explicit Douyin research, avoid ambiguous generic trend prompts, and review the saved logs and media URL fields before sharing outputs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no explicit permissions while clearly depending on access to environment variables via GUAIKEI_API_TOKEN. That mismatch can bypass least-privilege review and cause the hosting agent to grant or use sensitive runtime capabilities without transparent declaration, increasing the risk of secret exposure or unintended execution paths.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback address and a video download address, which conflicts with the skill description stating it is not for downloading. In a Douyin content-gathering skill, exposing a download URL materially enables downstream agents or users to retrieve media in ways the manifest claims are out of scope, undermining policy boundaries and increasing misuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The CLI persists the full fetched post results to a local JSON file after completing a read-oriented operation, even though the skill description frames the capability as information gathering rather than local retention. This creates an undisclosed data-at-rest footprint that can expose scraped content, queried targets, and potentially sensitive operational context to other local users, backups, or later misuse.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The activation rule is overly broad because it triggers on generic short-video research even when Douyin is not mentioned. This can cause the agent to invoke the skill in contexts the user did not intend, leading to unnecessary external data access, cross-platform confusion, and possible disclosure of user queries to a third-party service.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger mapping includes broad conversational phrases such as generic search wording that can cause the skill to activate when a user did not clearly intend to invoke Douyin scraping. In an agent setting, this can lead to unintended collection of third-party platform data, unnecessary token-backed API calls, and silent logging of scraped results to local files.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The intent rules prioritize broad terms like '热点' and '榜单' without requiring platform-specific context, which increases the chance of misrouting ordinary requests into this scraping skill. Because the skill performs external data retrieval and produces stored outputs, accidental invocation has real operational and privacy consequences beyond a harmless classification error.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README promotes exporting scraped public videos, author data, and comments into local logs, but it does not clearly warn about retention, access control, downstream sharing, or potential personal-data handling obligations. Even when data is 'public,' bulk aggregation and persistent logging can materially increase privacy risk and create compliance exposure for users and operators.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends a skill token and a user-supplied Douyin URL to a remote API endpoint, but nothing in this file indicates any disclosure, consent, or minimization around that transmission. In a skill that processes public-platform content, forwarding user input may be expected, but the token is sensitive credential material and undisclosed transmission increases privacy and misuse risk if callers or users are unaware.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The command sends the user-supplied Douyin URL together with an API token to remote service functions without any explicit consent or warning at the CLI boundary. In a skill ecosystem, undisclosed network transmission and credential use can violate user expectations, leak investigation targets to third parties, and increase the chance of accidental token misuse or exposure through downstream systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The tool writes fetched results to a local JSON file without a clear prior warning or user-controlled output path, which can surprise users who expect an ephemeral read-only command. This silent persistence increases the risk of local data leakage, unintended retention of monitored account activity, and discovery through shared workstations, sync tools, or backups.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The CLI writes full search results to a local file without clear user consent or notice, which can create unintended retention of potentially sensitive search queries and collected public-content data. On shared systems or multi-user environments, those logs may be accessible to others and expand the privacy and data-handling footprint beyond what users expect from a search command.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.