Security audit

guaikei-douyin-search-post-comment-hot

Security checks for vulnerabilities and agentic risk

Overview

This Douyin data skill mostly matches its stated purpose, but it needs review because it can broadly trigger network collection, save large public comment/profile datasets locally, and handles its API token unsafely.

Review before installing. Use only with a dedicated, revocable Guaikei API token, assume queries and target Douyin URLs are sent to the provider, and check local logs after use because results may include third-party comments and profile/video metadata. Avoid allowing it to run from ambiguous research prompts, and ensure any bulk comment or creator-data export complies with platform rules and applicable privacy obligations.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:104
Finding: API Token Exposed Through URL Query Parameters
Content: View full analysis
Remediation: View remediation

other

Note

Location: src/utils/request.js:50
Finding: Authentication Failure Emits Undisclosed Promotional Contact Information
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (58)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This code is related to one declared area—viewing Douyin comments—so it is not malicious or unrelated. However, the declared description presents a broader skill with four distinct command categories and automatic handling of colloquial filters. The actual code chunk only implements comment task creation/query for a specific video URL and some result formatting. Because the code’s actual behavior is materially narrower than the declared purpose, the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个较通用的抖音数据查询技能，支持多种查询类型和自然语言筛选；但该代码片段只实现了“抖音博主已发布作品模块”，通过 /api/douyin/post/url 和 /api/douyin/post/info 两个接口创建任务并获取作品结果。其主要行为是按博主主页URL查询已发布作品列表，属于更窄且不同的功能范围。虽然仍与抖音数据相关，但与声明中的四类核心命令并不一致，且缺少评论、热搜、视频搜索、博主搜索及口语筛选转换等实现，因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a broader multi-function Douyin query skill with four distinct command types: search videos, find bloggers, view comments, and check hot searches, plus automatic mapping of colloquial filters. The supplied code chunk only covers general search APIs (/api/douyin/general-search/keyword and /api/douyin/general-search/info) with filtering parameters such as sort, time, duration, and content type. That does align with part of the description around search and spoken filters like '近一周', '点赞最多', and '只要图文'. However, there is no evidence here of comment retrieval, trending-search lookup, or a separate blogger-finding capability beyond adding an author URL to generic search results. Because the declared purpose claims a broader set of supported query types than the code actually implements, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个面向多类抖音查询需求的能力入口/路由器，能根据问题类型调用四个命令，并支持自然语言筛选条件解析。但实际代码只实现了其中一种非常具体的功能：接收博主主页 URL 或 sec_uid，调用 post 相关 API 获取博主作品列表。它没有体现视频搜索、博主搜索、评论查询、热搜查询，也没有看到将“近一周”“点赞最多”“只要图文”等口语条件解析为参数的逻辑。因此其主要用途与声明存在明显偏差。另有本地日志写入属于附带实现细节，但相较声明仍是未提及行为。综合判断为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音数据问答的具体业务技能，而代码片段仅是通用参数解析辅助模块（args.js）。它只处理 CLI 输入格式、flag 校验和帮助文本生成，没有任何抖音平台交互、数据获取、评论/热搜查询、博主搜索或自然语言条件映射逻辑。根据评估标准，这不是单纯的支持性实现细节能够充分对应声明，因为该代码片段本身展示出的实际行为与声明的核心能力明显不一致，属于主用途层面的不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音数据查询的技能接口与参数映射能力，但提供的代码块仅包含本地日志写入功能，没有任何与抖音、搜索、评论、热搜、筛选条件解析或命令分发相关的实现。虽然日志功能可能作为配套基础设施存在，但就该代码块本身而言，其实际行为与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description claims a user-facing Douyin analytics/search capability with multiple command types and filter parsing. The supplied code chunk does not implement any of that behavior. Instead, it is a small utility that accesses the local filesystem, loads package.json, and returns the package name. While utility code can be supportive, this chunk alone is materially unrelated to the declared purpose and shows an undeclared resource access pattern (filesystem/package metadata) rather than any Douyin querying logic. Therefore this code chunk does not accurately represent the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents an end-user Douyin query capability. However, the supplied code chunk is a token-management utility: it checks token format, prints status messages, and returns the token or an empty string. This is not merely a supporting detail if evaluated in isolation against the declared behavior, because none of the described user-facing functionality appears in this code chunk. The actual behavior is configuration/authentication handling, not Douyin data retrieval or query parsing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The declared description presents a broader skill for answering multiple kinds of Douyin data questions with automatic natural-language filter-to-parameter conversion. The supplied code chunk does not show those capabilities. Instead, it is a small validation module focused on comment-related utilities: cleaning a Douyin post URL and constraining a requested comment count. While this may be a supporting component for the 'view comments' part of the skill, the chunk by itself materially underdelivers relative to the declared primary purpose and does not evidence the other advertised functions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 从该代码片段看，功能仅限于对抖音用户主页 URL 进行规范化，以及对数量参数做范围校验。这可以算是抖音相关工具的辅助实现细节，但如果拿此片段与声明直接对比，声明强调的是完整的数据查询与条件解析能力，而代码并未展示这些核心行为。因此该片段与声明用途存在明显不一致，更像是底层校验模块而非所述技能主体能力。未发现额外越权或危险能力，但主功能描述与实际代码行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill requires access to an environment variable (GUAIKEI_API_TOKEN) but does not explicitly declare a tool scope such as permissions or allowed-tools. This creates an avoidable trust and review gap: operators cannot easily see that the skill depends on secret material, increasing the chance of unintended secret exposure or over-broad execution in environments with more access than necessary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly says it should trigger even when users do not mention Douyin and on generic multi-step 'research' requests. That broad activation can cause the agent to invoke a networked data-collection skill in contexts where the user did not clearly consent to platform-specific collection, increasing the risk of inappropriate tool use, scope creep, and unnecessary secret/API usage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The schema defines input for fetching a creator's works from a profile URL or SEC_UID, which expands the skill beyond the documented four query types. This creates a scope mismatch that can enable unreviewed data-access behavior, confuse policy enforcement, and cause the agent to invoke capabilities users and reviewers were not told about.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and description explicitly advertise 'creator works retrieval' via command-line input, conflicting with the stated purpose of only handling video search, creator search, comments, and hot topics. Such documentation inconsistency is dangerous because it can mask hidden or undocumented functionality and weaken both human review and downstream guardrails built around the manifest.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest limits the skill to searching videos, creators, comments, and hot topics, and explicitly states it is not for downloading. This response schema documents video_url as both playback and download addresses, indicating the skill exposes download-oriented output beyond its stated scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The schema descriptions explicitly say video_url contains '视频播放地址、视频下载地址', which conflicts with the skill's documented intent that it is not used for downloading. This is an active documentation-to-intent contradiction rather than a mere omission.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The schema includes a play_addr field explicitly described as both a playback and download address, which exceeds the stated scope of a read-only Douyin search/comment/hot-search skill. Even though this file is only a response schema, exposing download-oriented fields can enable downstream agents or users to repurpose the skill for content retrieval or downloading, creating capability creep and policy/scope bypass risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README prominently markets bulk collection and export of public videos, author data, comments, and trending data, but provides only a minimal 'internal use' note and lacks meaningful guidance on privacy, consent, retention, lawful basis, platform terms, or handling of exported datasets. Because the tool supports large-scale scraping and structured logs, users may process personal data or sensitive commentary in ways that create privacy, legal, and compliance exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language trigger examples are broad enough that ordinary user phrasing like '找 AI 相关视频' or '今天什么火' could activate the skill in situations where the user did not intend data collection against Douyin. In an agent setting, this can cause over-broad tool invocation, unnecessary third-party data access, and privacy/compliance issues because the skill fetches and exports public videos, profiles, comments, and hot-list data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The intent recognition rules use generic terms such as '热搜', '搜索', '评论', and '博主' with limited scope constraints, which increases the chance that unrelated conversation text will be interpreted as a command. In a tool-using agent, this creates a prompt-to-action gap where normal language can trigger external data retrieval and logging without sufficiently explicit user authorization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file documents a command to retrieve up to 10,000 comments from a Douyin post, which affects third-party user data and may have privacy implications. The section provides usage details but no warning or disclosure about handling scraped comment data, privacy considerations, or compliance expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The function sends a token and video URL to an external API via requestApi, which is a data-transmitting network operation covered by the warning requirement for code files. Although there are developer-facing docstrings, there is no user-facing confirmation, logging, or visible disclosure in this file that these values will be sent to a remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This function performs a GET request that includes the token and video URL in request parameters, transmitting potentially sensitive or identifying data to an external API. The code contains only developer-oriented comments and no user-facing disclosure, confirmation, or visible logging about this remote query behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Comments and operation labels in this file are written exclusively in Chinese, including user-relevant action strings such as task creation and query descriptions. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation when no language choice or justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI persists fetched comment data to a local JSON file automatically, with no user consent, warning, retention control, or redaction. Comment data can contain personal or sensitive content, and writing it to disk increases exposure to other local users, backups, logs, or later unintended reuse; in this skill context, the tool is specifically designed to collect Douyin comments, so silent persistence makes privacy and data-handling risk more relevant.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.