guaikei-douyin-spch-data-toolkit

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 9:26 AM UTC
• Version: 1.0.0

Overview

This skill is a read-only Douyin public-data query tool, but users should understand it sends requests to guaikei.com and saves result logs locally.

Install only if you are comfortable sending Douyin keywords, URLs, and requested public data to guaikei.com using your API token, and with search/post/comment results being saved under the skill's logs directory. Avoid using it for confidential monitoring targets unless that third-party sharing and local retention are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The schema explicitly documents `video_url` as both playback and download addresses, which contradicts the skill metadata claiming it does not cover downloading. That mismatch can enable downstream agents or users to use the skill for media extraction beyond its declared scope, creating policy, copyright, and trust/compliance risks even if the data is publicly reachable.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The schema explicitly documents `play_addr` as both a playback and video download address, which conflicts with the skill description stating it does not cover download functionality. This mismatch can enable downstream agents or users to treat the skill as a content-download interface, expanding capability beyond the declared scope and potentially facilitating policy, copyright, or platform-terms violations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The CLI silently persists fetched comment data to a local JSON file even though the skill description emphasizes query-and-return JSON behavior. This creates an undisclosed local data retention channel, which can expose scraped comments and queried URLs to other local users, backup systems, or downstream tooling without the operator's awareness.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI persists fetched Douyin post data to a local JSON file after already printing the results, which exceeds the described query-and-return behavior and creates an undeclared data retention side effect. Even if the data is public, silent local storage can leak collected profiles or activity data to other local users, backups, or later processes, and it broadens the privacy and compliance footprint of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI writes the full search output, including the user-provided keyword and returned results, to a local JSON file after completing the request. In a skill whose stated behavior is to query public Douyin data and output JSON, this undisclosed persistence expands the data footprint, can retain potentially sensitive search terms or collected data longer than expected, and may expose them to other local users/processes if log storage is insecure.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This helper writes attacker-influenced content to local disk even though the skill is described as a read-only Douyin query tool that should return JSON. While the filename is partially sanitized and path traversal is mitigated, the capability still introduces unnecessary persistence, possible storage abuse, and a mismatch between declared and actual behavior that can enable data retention or exfiltration workflows.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code performs filesystem output by creating directories and writing files, but the skill description only promises query-and-return JSON behavior. This hidden side effect increases risk because users and platform operators may treat the skill as read-only while it actually persists data locally, which can create privacy, compliance, or abuse issues.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill sends user-supplied Douyin keywords, profile/video URLs, and retrieved content to a third-party service (`guaikei.com`) to fulfill requests, but this data-sharing warning is buried in a later compliance section rather than made prominent in the main usage flow. Users may unknowingly transmit search intents, monitored accounts, comment data, or competitive research targets to an external provider, creating privacy, confidentiality, and data-governance risk.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README defines very broad natural-language triggers such as '搜索 / 搜一下 / 找' and similar everyday phrasing, which can cause the skill to activate when a user is speaking conversationally rather than intentionally invoking this tool. Because this skill sends user-supplied keywords/URLs to an external service and retrieves third-party platform data, accidental invocation can disclose user intent or trigger unintended external data collection.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The hot-list trigger examples include broad phrases like '今天什么火' and '热点/榜单', which are common conversational language and may match unrelated discussion. This increases the chance of silent or unintended execution of the hot-list command, causing unnecessary external requests and exposing user context to the provider without clear intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explains token setup and data retrieval but does not clearly warn users that search keywords, Douyin URLs, and retrieved public-platform data are transmitted to an external service operated by guaikei.com. Users may assume processing is local because the tool is framed as a simple Node.js skill, leading to uninformed disclosure of potentially sensitive research interests, monitored accounts, or collected comment datasets.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: Writing comment results to a local JSON file without explicit user warning reduces transparency and can leak potentially sensitive query history or collected public data through local storage. In the context of a query tool, the hidden side effect is the main risk rather than code execution or privilege escalation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script writes fetched results to disk without any explicit user warning or consent in this file, creating a transparency and privacy issue. Users may reasonably expect a CLI that 'outputs JSON' to emit to stdout only, so silent persistence can surprise operators and unintentionally expose scraped datasets through local storage, shared workspaces, or retained artifacts.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Search results are silently written to disk without a user-facing warning at the point of collection/output, which can violate user expectations and create unintended local data retention. While this is not code execution or direct exfiltration, it increases privacy and operational risk because queried content and keywords may remain available on the host after the command finishes.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.