Security audit

guaikei-douyin-search-and-analyze

Security checks for vulnerabilities and agentic risk

Overview

Review before installing: it performs Douyin analytics, but it can trigger broadly, saves fetched results locally, and contradicts its own token-error safety claims.

Install only if you want an API-backed Douyin research tool and are comfortable sending queries, Douyin URLs, and the GUAIKEI token to the provider. Treat generated logs as retained datasets: review and delete them as needed, especially on shared or synced machines. Be aware that missing or invalid token paths print provider contact and marketing text despite the skill's own claim that runtime auth errors stay neutral.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The schema explicitly documents `video_url` as both playback and download addresses, which conflicts with the stated skill boundary that it is not for downloading videos. Even though this file is only a response schema, exposing and normalizing download URLs can enable downstream clients or agents to use the skill for prohibited content retrieval, weakening policy enforcement and increasing abuse risk.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The schema explicitly documents `play_addr` as both a playback and video download address, which conflicts with the skill’s stated restriction that it is not for downloading videos. Even if this file is only a schema, exposing and normalizing a download-capable field can enable downstream agents or users to retrieve media content in ways the skill policy claims to forbid, creating policy-bypass and misuse risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI persists fetched Douyin results to a local JSON file after completing the request, even though the skill description emphasizes searching and analyzing public data rather than storing exports on disk. This creates an undisclosed data-retention behavior that can leak collected data to other local users, backup systems, or later processes, especially when results may include metadata and comments at scale.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI writes the full search output, including user queries and returned public-data results, to a local log file without any user opt-in, retention control, or redaction. Even if the source data is public, local persistence can expose sensitive research intent, account profiling activity, or collected datasets to other local users, backup systems, or downstream tooling beyond the user's expectations for a read/query skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This utility provides a generic file-write primitive that can persist arbitrary string content under attacker-influenced filenames within the skill directory. Although the filename is partially sanitized and constrained to the logs folder, this still exceeds the stated read-only Douyin search/analysis purpose and creates a local state-changing capability that could be abused to store sensitive scraped data, poison local artifacts, or support multi-step attacks if untrusted input reaches this function.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The description says the skill should be used even when the user does not mention Douyin, which creates an overly broad activation condition. This can cause the agent to invoke the skill for generic search or analysis requests and send user queries to an external service unexpectedly, increasing the risk of data over-sharing and incorrect tool use.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The invocation table includes very common phrases like '搜一下 XX', '找 XX 相关视频', and '今天什么火' without requiring platform-specific context. Such ambiguous triggers can cause accidental invocation on unrelated requests, leading to unnecessary external data access, confusion, and possible leakage of user intent to the third-party API.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README states that the tool automatically exports JSON logs to a local `logs` directory, but it does not prominently warn that those logs may contain scraped public data, user-provided search terms, URLs, or other potentially sensitive analysis artifacts. This creates a real data persistence risk because operators may unknowingly retain or later expose collected datasets on shared machines, CI runners, or synced folders.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The README instructs users to configure `GUAIKEI_API_TOKEN` as an environment variable, but the security guidance is delayed and minimal relative to the initial setup instructions. While environment variables are a common mechanism, failing to provide upfront credential-handling precautions increases the chance of token leakage through shell history, screenshots, shared terminals, process inspection, or accidental inclusion in scripts and logs.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The CLI writes fetched comment data to a local JSON file automatically, without any explicit opt-in, warning, or control over persistence. Because comment contents may include personal data, account identifiers, or sensitive business research material, this creates an avoidable data-retention and local disclosure risk, especially on shared machines or CI/automation environments.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The tool silently writes the full result set to a local file without explicit user consent or a prominent warning. Even for public-source data, silent persistence changes the privacy and operational risk profile by creating an unexpected local artifact that may be shared, indexed, or retained longer than intended.

Static analysis

No suspicious patterns detected.