Security audit

guaikei-douyin-scout

Security checks for vulnerabilities and agentic risk

Overview

This Douyin data skill is mostly purpose-aligned, but it needs Review because auth failures inject promotional contact details, the token is sent in URL query strings, and the trigger scope is too broad.

Review before installing. Use it only for explicit Douyin public-data tasks, avoid sensitive research terms or private target URLs, and expect results to be stored locally. Ask the publisher to remove runtime promotional contact output, send tokens in an Authorization header instead of URLs, narrow ambiguous triggers, and provide a way to disable or manage logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/token.js:24
Finding: Authentication Failures Inject Promotional URLs and Contact Information into Runtime Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:103
Finding: API Tokens Are Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/config/constants.js:23
Finding: Query Failures Can Trigger Up to Twenty Authenticated Retry Attempts
Content: View full analysis
setTimeout(resolve, delay)); } } } throw lastError || new Error(`重试${maxAttempts}次后失败`); } ``` ### Technical Analysis The Skill documentation states that network failures should stop after no more than three attempts. However, query operations use `QUERY_MAX_ATTEMPTS`, which is set to twenty. The retry helper treats any error without `noRetry` as retryable. Consequently, repeated transient network failures or API errors can cause up to twenty authenticated requests with exponential delays capped at sixty seconds. If repeated querying is intended as task-status polling, it is not separated from ...[truncated 1245 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (53)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个包含四项能力的综合抖音技能，但提供的代码片段只涉及博主已发布作品模块，调用的接口也仅为 /api/douyin/post/url 和 /api/douyin/post/info，用于根据博主主页URL创建和查询作品任务。代码没有显示任何搜索、评论或热榜相关逻辑，因此就该代码片段而言，实际行为只覆盖声明中的一部分，描述对该片段来说明显过宽，存在描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 代码明确只调用了抖音通用搜索相关接口：/api/douyin/general-search/keyword 和 /api/douyin/general-search/info，功能集中于按关键词创建搜索任务、获取搜索结果，并处理返回数据。未见任何用于获取博主作品列表、视频评论、或热搜榜单的接口、数据结构或逻辑。因此，声明描述了四项能力，但该代码块实际只覆盖其中“搜索”一项，属于描述范围明显大于实际行为的能力不一致。代码所访问的平台资源仍是抖音，与声明的平台范围一致，因此不一致点主要在能力缺失而非平台偏离。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 代码行为非常聚焦于“获取抖音作品评论”。文件名为 comment-cli.js，参数说明是抖音视频/图文 URL 或 aweme_id，核心调用为 createCommentTask 和 getCommentTask，输出也明确是评论结果。没有看到任何与抖音搜索、博主作品列表、热榜/热搜获取相关的逻辑、参数、API调用或分支。因此，声明描述了一个包含四项能力的综合技能，而该代码块只实现了其中的“评论”子能力，属于描述与实际行为不一致。未发现代码存在与抖音评论无关的额外越权能力；不匹配主要在于声明明显过宽、主能力范围不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 该代码片段的行为非常明确：它只处理一个 hot 命令，通过 token 鉴权后调用 hot.getHotTask 获取抖音热榜数据，并格式化输出结果。请求参数中也固定写明 command: "hot"，错误与空结果提示也都围绕“抖音热榜”。声明描述则表示该技能可用于四项能力：搜索、博主作品、评论、热榜。基于当前代码片段，只能确认“热榜”这一项与声明一致，其余三项没有体现。因此描述对该代码的能力范围有明显夸大，属于描述与实际行为不一致。未见额外越权或无关平台访问；问题在于声明的多项能力未被此代码实现。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 代码的主函数和输出文案都明确指向“获取抖音博主作品列表/作品任务”，参数也仅支持博主主页 URL/sec_uid 和返回数量 limit，没有任何与关键词搜索、视频评论、热榜查询相关的参数、API 调用或分支逻辑。因此，虽然声明中的“博主最近发了什么”与代码行为一致，但整体描述将该技能表述为同时覆盖搜索、评论、热榜四类能力，超出了该代码片段实际实现的范围，构成描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 从提供的代码看，唯一明确实现的功能是抖音内容搜索。脚本要求 keyword，并支持 sort/time/duration/content/limit 等搜索过滤参数；随后调用 search.createSearchTask 和 search.getSearchTask 获取搜索结果，最终输出 JSON 并写日志。未见任何与“博主最近发了什么”“这条视频评论怎么看”“今天抖音热搜是什么”对应的作者作品列表、评论拉取、热榜查询逻辑，也没有作者 ID、视频 ID、热榜接口等相关参数或调用。因此，声明描述了四项能力，但这段代码只覆盖其中一项，属于描述与实际行为不一致。不过，代码没有显示出额外越权或跨平台行为，主要问题是声明显著宽于实际实现。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是面向终端用户的抖音内容检索/查看技能，而提供的代码片段仅实现了与业务无关的底层命令行参数解析逻辑。它没有访问抖音、没有执行搜索、没有获取博主作品、没有读取评论、也没有查询热榜。该代码的主要用途与声明的技能目的存在实质性偏离，不属于仅仅“支持性实现细节”，因为当前片段完全未展现任何已声明的核心能力，反而表现为一个通用 CLI 工具模块。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是面向用户的抖音信息检索与分析能力，但提供的代码片段实际只是一个本地日志写入函数，使用 fs/path 对本地文件系统进行目录创建和文件写入。该行为既不是抖音搜索、博主作品获取、评论查看，也不是热榜查询；反而涉及未声明的本地文件写入能力。尽管日志可能是辅助实现的一部分，但当前代码片段本身的实际功能与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是面向用户的抖音内容检索与分析技能，但给出的代码片段仅实现了一个读取本地 package.json 文件并返回技能名称的辅助函数。该代码既没有体现抖音平台交互、搜索、评论分析、热榜获取，也没有与声明中的触发场景直接相关。因此该代码片段的实际行为与声明用途存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是面向用户的抖音内容查询技能，而代码片段仅实现了底层通用重试机制，没有任何抖音平台调用、搜索、评论分析、热榜获取、触发词处理或平台限制逻辑。虽然重试函数可能作为其他功能的辅助实现，但就该代码片段本身而言，其主要行为与声明的技能目的明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 该代码片段仅是一个日志/控制台展示工具模块，功能包括打印 ASCII 横幅和不同级别的彩色日志输出，属于辅助基础设施代码。它没有展示任何与抖音数据获取、搜索、评论分析、博主作品查询或热榜查询相关的逻辑，也没有网络请求、平台接口调用、数据解析或触发词处理。因此，就此代码片段本身而言，其实际行为与声明的核心用途存在明显不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 该代码片段的实际作用非常单一：它只把传入的结果列表格式化为“抖音最新热榜”文本，不包含搜索、博主作品、评论相关逻辑，也没有体现多触发场景处理。因此，代码实际行为只覆盖声明中的“热榜”一项，而未支持其余三项核心能力。虽然没有发现越权访问或额外未声明能力，但声明的主要能力范围明显大于代码所展示的实际功能，属于描述与行为不一致。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly says it should trigger even when the user does not mention Douyin, using broad intents like market research or trend analysis. Over-broad invocation can cause the agent to route unrelated user requests, URLs, or queries to this external data-collection workflow, increasing privacy exposure and risk of unintended third-party data transmission.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares access to an environment variable token (GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege boundaries and can allow broader runtime capabilities than reviewers or users expect, especially when the skill also performs networked API access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger examples include broad everyday phrases such as '网上火啥' and '评论区啥风向' that are not sufficiently constrained to Douyin. That can lead to accidental activation on unrelated content-analysis requests and unnecessary disclosure of user input to this skill's external API path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requires transmitting user-supplied keywords and URLs to an external API service, yet it does not prominently disclose that data leaves the local agent context. Users may unknowingly send sensitive research targets, account links, or content references to a third party, creating confidentiality and compliance concerns.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that outputs are automatically saved into a local logs/ directory with timestamps and query parameters, but the overall skill description does not clearly warn users that their queries and results will be stored locally. This creates a privacy and data-retention risk, especially because search terms, account URLs, and comment-analysis targets may contain sensitive research interests or identifiers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The line "纯中文界面" indicates a fixed language constraint. Under the stated policy, forcing a specific language without user opt-in or an explicit justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JSON schema uses Chinese-only title and description strings throughout, including field descriptions, with no indication that the skill is region-specific or that users may opt into another language. Under the natural-language policy rule, forcing a specific language without user choice or justification is a policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README states that scraped Douyin data is automatically exported to local JSON logs, but the usage examples and feature descriptions do not prominently warn users that potentially sensitive collected content will be persisted on disk. This increases the risk of unintended retention, later disclosure, or secondary misuse of scraped comments, author metadata, or search results, especially on shared machines or in team environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The README instructs users to set a GUAIKEI_API_TOKEN and send requests to the vendor service, but it does not clearly foreground that the skill consumes credentials and transmits user queries and target URLs to an external third party. This can lead to uninformed credential exposure and data-sharing decisions, particularly because the skill is framed as lightweight and safe without equivalent disclosure at the point of setup.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The changelog content is entirely presented in Chinese, and there is no indication that users can choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Under the policy, a language or locale constraint should be opt-in or clearly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The tool sends a user-supplied Douyin URL together with an API token to remote APIs to create and retrieve comment tasks, but this file provides no explicit disclosure that user input and credentials are transmitted off-host. While remote API use is expected for this skill, lack of transparency can cause unintentional data sharing and token exposure risk if users assume processing is local.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI writes fetched comment data to a local JSON file automatically, and comment content can contain sensitive or regulated personal data such as usernames, opinions, or identifiers. Persisting this data without explicit notice, consent, retention limits, or secure storage controls increases privacy and data-exposure risk, especially on shared systems or in automated environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code contains multiple natural-language strings in Chinese for status, errors, and success output, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-only audience. Under the locale policy rule, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.