Security audit

guaikei-douyin-search-collect-export-videos

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin research purpose, but it has credential-handling and disclosure mismatches users should review before installing.

Install only if you are comfortable sending Douyin search terms, URLs, and your Guaikei API token to www.guaikei.com. Treat the token as exposed if server or proxy logs capture full URLs, and review or delete files saved under logs because they may contain collected public account, video, and comment data. Be cautious with broad natural-language activation and with returned media URL fields that may imply download use outside the stated scope.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:104
Finding: API Token Exposed in HTTPS URL Query Strings
Content: View full analysis
Remediation: View remediation

other

Note

Location: src/utils/request.js:52
Finding: Runtime Authentication Error Discloses Unsolicited Contact Information
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states that it writes logs to a local logs/ directory with filenames derived from timestamps, keywords, and types, but that filesystem write behavior is not clearly declared as part of the skill’s operational scope. Undisclosed local writes can leak searched topics, URLs, or other sensitive research inputs to disk and create privacy or retention risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that it writes logs to a local logs/ directory with filenames derived from timestamps, keywords, and types, but that filesystem write behavior is not clearly declared as part of the skill’s operational scope. Undisclosed local writes can leak searched topics, URLs, or other sensitive research inputs to disk and create privacy or retention risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states that it writes logs to a local logs/ directory with filenames derived from timestamps, keywords, and types, but that filesystem write behavior is not clearly declared as part of the skill’s operational scope. Undisclosed local writes can leak searched topics, URLs, or other sensitive research inputs to disk and create privacy or retention risks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly requires access to an environment variable (GUAIKEI_API_TOKEN) but does not declare tool scope, permissions, or allowed tools. This creates hidden capability requirements and can cause an agent runtime to grant broader access than users or reviewers expect, weakening least-privilege controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill says it should trigger even when the user does not mention Douyin, based only on broad short-video research intent. Over-broad activation can cause the agent to invoke external data collection unexpectedly, exposing user queries to third-party services and bypassing informed user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phrase '纯中文界面' indicates a fixed language choice rather than offering language selection or documenting a justified locale restriction. This can violate language or locale policy when users are not given an explicit choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The schema explicitly documents video_url as containing both playback and download addresses, which conflicts with the skill description stating it does not support downloading videos. That mismatch can cause downstream agents or users to infer that downloading is permitted and may enable policy bypass or unauthorized content acquisition through exposed URLs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The schema explicitly documents play_addr as both a video playback and download address, which conflicts with the skill metadata stating it does not cover downloading videos. In this context, exposing a documented downloadable media URL can enable downstream agents or users to repurpose the skill for content acquisition beyond its declared scope, increasing compliance and misuse risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README promotes automatic JSON log export and local storage of scraped video, author, and comment data, but does not provide clear privacy, retention, minimization, or handling guidance beyond a brief restriction on redistribution. In this skill’s context, comment and account data may include personal information, so storing bulk scraped datasets locally without safeguards can create compliance and data-exposure risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger examples include broad natural-language phrases like “搜索 / 搜一下 / 找 …” that can overlap with ordinary conversation and cause the skill to activate when the user did not clearly request Douyin scraping. In this skill’s context, mistaken activation can lead to unintended collection of public social-media data and unnecessary transmission of user queries or targets to an external service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The intent recognition rules prioritize generic keywords such as “热搜 / 热点 / 搜索 / 找” with insufficient constraints, increasing the chance that unrelated user requests are routed into this data-collection skill. Because the skill performs scraping/export operations against an external API, overbroad routing raises privacy, consent, and least-surprise concerns even if the data targeted is nominally public.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The changelog and feature descriptions are written in Chinese throughout, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The parameter description states that --keyword must be '2-50 位长度的汉字或单词', and the overall document is written as a Chinese-only interface description. This imposes a language/locale constraint without offering user opt-in or documenting a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code sends a token and user-provided Douyin video URL to a remote API via requestApi, which is a network operation involving potentially sensitive account or activity data. While the functions are documented for developers, there is no user-facing confirmation, warning, logging, or disclosure in this file about transmitting this data externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The getCommentTask function performs a GET request that includes the token and video URL in request parameters, transmitting user or system data over the network. This file does not show any user-facing notice, prompt, or warning that such data is being sent to an external endpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code sends a token plus user-supplied search terms to remote API endpoints via requestApi in both the task-creation and task-query flows. Although the functions have technical docstrings, there is no visible user warning, confirmation, or disclosure in this file that these values will be transmitted over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Reading GUAIKEI_API_TOKEN is access to sensitive credentials, which falls under the safety-critical operations to check for disclosure. This file does not contain a user-facing warning, prompt, or explanatory comment indicating that the CLI will read an API token from the environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code persists the fetched comment data to disk via log.taskWrite, which is a file-write operation affecting local user/system data. Although the file logs API progress elsewhere, this file does not include a confirmation prompt or any clear user-facing warning that results will be saved locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code consistently uses Chinese in comments and all user-visible status/error messages, such as the success and error strings emitted to stdout/stderr. Because the skill does not offer a language/locale option or document that it is intentionally limited to Chinese users, it may violate a language-choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The calls to post.createPostTask and post.getPostTask send the supplied URL and query parameters to an external service, but this file does not explicitly warn the user that their input will be transmitted over the network. The progress message only states that a task is being created/fetched, not that data is being sent to a remote API.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI persists the full fetched post results to a local JSON file after printing them, but there is no visible user consent, warning, retention control, or redaction. In a data-collection skill, silently creating durable local copies increases privacy and data-handling risk because collected content may include account metadata and other scraped output that the user did not expect to be stored beyond the immediate command output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The tool writes fetched results to a local file without any explicit user-facing confirmation or prior notice, creating a hidden secondary data sink. This can leave scraped data on shared systems or CI runners and may violate user expectations or internal data-handling policies even if the data was legitimately retrieved.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JavaScript file contains natural-language comments and user-visible CLI messages entirely in Chinese, including errors and help text. Under the stated policy, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing warnings and status messages only in Chinese (for example, the warning about token configuration and the private token status). For a general utility module, forcing a specific language without opt-in matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code's docstrings, validation errors, and formatted output are all written in Chinese, and there is no indication that users can choose another language or that the skill is explicitly limited to a Chinese-only regional context. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.