Security audit

guaikei-douyin-spch-data-toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Douyin public-data tool, but it needs review because it sends its API token in URL parameters and saves fetched datasets locally by default.

Install only if you are comfortable sending Douyin keywords, URLs, and your Guaikei API token to guaikei.com, and with search/post/comment results being saved under the skill's logs directory. Use a revocable token, delete logs you do not need, avoid collecting more comments or creator history than necessary, and treat returned download-style media URLs as outside the stated skill boundary.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:96
Finding: API Token Exposed in HTTPS URL Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (50)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill performs local filesystem writes and persistent logging while presenting itself as a read-only public-data query tool, that is a meaningful trust-boundary violation. Undeclared file writes can retain queried content, URLs, or API-related diagnostics on disk, creating privacy, data retention, and secret leakage risks, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the skill performs local filesystem writes and persistent logging while presenting itself as a read-only public-data query tool, that is a meaningful trust-boundary violation. Undeclared file writes can retain queried content, URLs, or API-related diagnostics on disk, creating privacy, data retention, and secret leakage risks, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill requires access to the environment variable GUAIKEI_API_TOKEN but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent platform, missing scope declarations can cause overbroad runtime access or make secret usage insufficiently transparent, increasing the chance of unintended secret exposure or policy bypass.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JSON schema contains user-facing natural-language fields such as title and description entirely in Chinese, which effectively enforces a specific language. The file does not offer any language/locale option or explain that the skill is intentionally region-specific, so it conflicts with the language/locale policy rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON schema contains user-facing title and description fields exclusively in Chinese, including the top-level title/description and property descriptions. Because the file provides no opt-in, alternative locale, or documented region-specific justification, it appears to force a specific language and may violate language/locale policy.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The schema explicitly documents video_url as including both playback and download addresses, which conflicts with the skill description stating it does not cover downloading. This mismatch can enable downstream agents or users to retrieve downloadable media anyway, expanding the skill’s effective capability beyond its declared scope and creating policy/compliance risk around content acquisition.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly documents play_addr as a '视频播放地址、视频下载地址' (video playback/download address), which conflicts with the skill description stating it does not cover downloading. This creates a capability mismatch: downstream agents or users can infer and use the field for download workflows, expanding the skill beyond its declared scope and potentially enabling policy or platform-TOS violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises automatic JSON log export for scraped videos, authors, comments, and rankings, but does not warn that local log files may persist scraped public content, identifiers, and metadata. This creates a data-handling risk because users or downstream agents may store potentially sensitive or regulated personal data longer than intended, leak it via backups or shared workspaces, or process it without appropriate minimization and retention controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README maps very common natural-language phrases such as '搜索', '找', '热点', and similar everyday wording directly to executable commands. In an agent setting, broad trigger phrases increase the chance of unintended tool invocation from ambiguous user messages or surrounding context, which can cause unauthorized scraping actions, unnecessary external API use, or data collection the user did not clearly request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent recognition priority rules are broad and overlapping, especially around terms like '搜索', '热点', '视频', '作品', and '评论'. In LLM-driven tool use, ambiguous routing logic can be exploited or simply misfire, leading the agent to run the wrong command, scrape unintended data, or bypass the user's actual intent through overly permissive matching.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The changelog and feature descriptions are written in Chinese throughout, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explicitly enables bulk collection of creator posts and video comments, including up to 10,000 records, but provides no warning about privacy expectations, lawful basis, retention, or downstream handling of user-generated content. Even though the data is described as public, comments and creator activity can still contain personal data, and the lack of guardrails increases the risk of misuse, over-collection, and non-compliant processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The function sends a token and a user-provided Douyin video URL to an external API via requestApi, which is a data-transmitting operation. Although there are code comments describing parameters, there is no confirmation prompt, user-facing log/print, or explicit disclosure in this file that user data and credentials are being sent over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This function issues a GET request containing the token and video URL to retrieve task results from an external API. The file contains no user-visible warning, confirmation, or runtime notice that these identifiers are sent to a remote service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI persists fetched comment data to a local JSON file after already printing the results, which exceeds the described query-and-return behavior and creates an unnecessary at-rest copy of potentially sensitive or regulated user-generated content. This increases exposure through local disclosure, accidental sharing, or retention on systems where users may not expect any storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The tool silently writes returned comments to a local file without any user-facing warning, confirmation, or explicit request. Because comment payloads may contain personal data, silent persistence can violate user expectations, increase privacy risk, and leave recoverable artifacts on shared or monitored systems.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI writes the full query output to a local JSON file after completing the request, which goes beyond a pure query-and-print behavior and creates unintended data persistence. In this skill context, scraped public-data results may still contain sensitive operational context or user-requested datasets, and silent local retention increases privacy, compliance, and data-handling risk if the host environment is shared or monitored.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The tool silently saves scraped results to a timestamped local JSON file without explicit user consent or even a user-facing notice before persistence. In a data-query skill, this is more dangerous because users reasonably expect transient JSON output; hidden local storage can leave behind datasets, create audit/compliance issues, and surprise operators running the tool in automated environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-facing descriptions and help text are entirely in Chinese, and the script continues using Chinese for runtime messages and output labels. Under the policy rule, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI writes full search results to a local file after printing them, creating undeclared persistent storage of user queries and returned content. This can expose sensitive research interests or scraped public data to other local users, backup systems, or later processes, especially because the manifest promises query JSON output rather than file persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Writing search results to disk without explicit notice or consent creates a privacy and data-handling risk, because users may reasonably expect transient JSON output only. In this skill context, queries can reveal user interests, investigative topics, or monitored accounts, and silent local retention increases exposure beyond the immediate command execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code emits all user-facing error text in Chinese, and later also prints a success message in Chinese. For a general utility module, this imposes a specific language on users without offering a choice or documenting a justified region-specific constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a read/query-style toolkit for fetching four kinds of Douyin public data and returning JSON, and explicitly frames scope around data querying rather than local side effects. This code creates directories and writes content to local files under a logs folder, which is behavior not reflected in the stated skill description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file includes a user-facing authentication error message entirely in Chinese, which enforces a specific language on all users. Under the policy, language/locale restrictions are only acceptable when users are given a choice or the constraint is clearly justified as region-specific, neither of which is shown here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file’s natural-language content, including comments and error/output strings, is entirely in Chinese, and the formatted output is hard-coded for Chinese users. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.