guaikei-douyin-search-post-comment-hot

• Outcome: Review
• Latest audit: Aug 25, 2026 · 9:08 AM UTC
• Version: 1.0.0

Overview

This Douyin research skill is not malicious, but it needs review because it can trigger too broadly, sends its API token in URL parameters, and saves fetched data locally.

Install only if you are comfortable sending Douyin queries, creator URLs, video URLs, and a GUAIKEI API token to guaikei.com, and with returned public data being saved under the skill's logs directory. Use it for explicit Douyin research, avoid ambiguous generic research prompts, and periodically delete logs that contain sensitive research topics or comments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The schema explicitly documents `video_url` as both playback and download addresses, which conflicts with the skill description stating it is not for downloading. This kind of scope drift is dangerous because downstream agents or integrators may treat the documented output as permission to enable download workflows, creating policy bypass and misuse risk even if the skill itself is framed as read/search-only.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback URL and a video download URL, which conflicts with the skill's stated non-download scope. This can enable downstream agents or users to discover and use a download-capable field even when the manifest says downloading is unsupported, creating a scope-bypass and policy-compliance risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI persists fetched comment data to a local JSON file after completing a read-only query operation. Comments can contain personal data, sensitive opinions, usernames, or other user-generated content, so silently storing them expands the data exposure surface through local disk retention, later reuse, or accidental disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill metadata says it supports four query types: video search, creator search, comments, and hot-search lookup. This CLI implements a separate creator post-list retrieval workflow and persists the returned dataset, which exceeds the declared capability boundary and can cause users or orchestrators to expose more creator data than expected. In a data-access skill, undeclared collection functionality is a security-relevant scope expansion because policy, review, and consent may have been based on the narrower manifest.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The code writes fetched Douyin results to a local JSON file via log.taskWrite, even though the skill is presented as a read/query tool. Persisting third-party data increases exposure through leftover artifacts, over-retention, and unintended access by other local users/processes, especially if creators or query history are sensitive. The filename is partly derived from user input, which is sanitized, but the main issue is unnecessary retention rather than path traversal.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill explicitly says it should trigger even when the user does not mention Douyin and for broad requests like general market or content research embedded in multi-step workflows. That can cause overbroad activation, unintended external data collection, and execution of this skill when the user likely meant a different platform or no platform-specific scraping at all.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Several example trigger phrases are generic search or research expressions that are common in normal conversation and do not reliably constrain execution to Douyin-specific tasks. This increases the chance of accidental invocation in unrelated contexts, potentially causing unintended API calls, data retrieval, and user confusion about what system is being queried.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The GET request places sensitive values including token and search keyword into URL query parameters. Query parameters are more likely to be logged by intermediaries, browser history, server logs, and monitoring systems, which can expose authentication material and user search content beyond the intended recipient.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The command writes fetched comment results to a local file without explicit user notice or consent. Even if intended for debugging or auditability, undisclosed persistence can surprise users and leave sensitive content on shared systems or in synced directories.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script persists full search output to a local JSON file, including user query terms and returned content, without explicit user consent or any visibility control. In this skill's context, searches may reveal sensitive interests, research topics, or operational intent, and writing them to disk increases exposure to local disclosure, retention, and accidental sharing.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.