T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-thorough-data-miner
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Douyin research purpose, but it handles the API token unsafely and shows undeclared promotional/contact messages during authentication failures.
Review before installing. Use only a scoped, revocable GUAIKEI token, assume search terms and Douyin URLs are sent to guaikei.com, and treat generated logs as retained local datasets that may contain personal data. The publisher should remove promotional/contact text from runtime errors and stop sending tokens in URL query parameters before this is considered low-risk.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
src/utils/token.js:23- Finding
Undeclared Promotional and Contact Content Injected into Authentication Errors
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
If the actual implementation performs local filesystem access while the public description omits that behavior, users and reviewers may underestimate data retention and exposure risk. This is especially relevant for a scraping-oriented skill that may process sensitive research targets, URLs, and comments and then persist them locally.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
If the actual implementation performs local filesystem access while the public description omits that behavior, users and reviewers may underestimate data retention and exposure risk. This is especially relevant for a scraping-oriented skill that may process sensitive research targets, URLs, and comments and then persist them locally.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual implementation performs local filesystem access while the public description omits that behavior, users and reviewers may underestimate data retention and exposure risk. This is especially relevant for a scraping-oriented skill that may process sensitive research targets, URLs, and comments and then persist them locally.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the actual implementation performs local filesystem access while the public description omits that behavior, users and reviewers may underestimate data retention and exposure risk. This is especially relevant for a scraping-oriented skill that may process sensitive research targets, URLs, and comments and then persist them locally.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual implementation performs local filesystem access while the public description omits that behavior, users and reviewers may underestimate data retention and exposure risk. This is especially relevant for a scraping-oriented skill that may process sensitive research targets, URLs, and comments and then persist them locally.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares use of an environment variable token but does not define any explicit tool scope or permissions boundary. That makes secret access implicit rather than auditable, increasing the chance the runtime grants broader env access than users or platform reviewers expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generic trigger rule allows the skill to activate for broad 'short-video research' requests even when the user did not specify Douyin. Over-broad invocation can cause unintended use of the user's token, unnecessary external data access, and collection of data from the wrong context without clear user consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该行以自然语言规定“纯中文界面”，意味着技能默认强制单一语言体验，但文档中未见用户可选择其他语言或明确的用户同意机制。根据语言/locale 政策，若无合理限定场景或用户 opt-in，这类强制语言约束应视为政策问题。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON schema is a manifest-type file, so natural-language policy checks apply. The title and field descriptions consistently force Chinese-language output/documentation, and the file provides no opt-in, alternate locale, or justification that this skill is intentionally region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest says the skill is not applicable to downloading videos, but this response schema explicitly defines
video_urlas containing both playback and download addresses. Even though this is only a schema file, it signals that the skill's implemented/output behavior includes download-oriented data beyond the stated scope.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The natural-language description is entirely in Chinese and presents the skill's purpose and capabilities only in that language, with no indication that users may choose another language or that the tool is restricted to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without opt-in can be a locale-policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README explicitly states that scraped Douyin data and comments are automatically saved as JSON logs locally, but it does not warn users that these files may contain personal data, behavioral data, or sensitive commentary that could be retained longer than intended or exposed through backups, sharing, or weak workstation security. In a data-mining skill focused on large-scale collection and export, silent local retention materially increases privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README instructs users to set a GUAIKEI_API_TOKEN obtained from guaikei.com, but does not clearly disclose that this credential will be sent to and relied upon in third-party network requests. This can mislead users about trust boundaries, causing them to expose a billable or sensitive API token without sufficient understanding of where it is used and the associated security responsibilities.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The function sends the skill token and user-provided video URL to an external API via requestApi, which is a network transmission of potentially sensitive data. Although the JSDoc describes parameters and errors, it does not warn the user that these values are sent to a remote service, and there is no visible confirmation or user-facing notice in the code shown.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This function performs a GET request containing the token and requested video details, which transmits user or system data to an external endpoint. The code lacks any visible confirmation prompt or explicit warning that these parameters are sent remotely, beyond basic parameter documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI writes the full fetched comment results to a local JSON file automatically after execution, but this file does not present any explicit notice, consent prompt, or opt-in control before persisting potentially sensitive user-generated content. In the context of a data-mining skill that harvests social-media comments, silent local retention increases privacy and data-handling risk because scraped content may remain on disk longer than the user expects and could be exposed to other local users, backups, or follow-on tooling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code uses Chinese-only natural-language strings in comments and runtime messages, including errors and success output, without any indication that the skill is region-specific or that users can opt into this locale. That creates a language policy issue because the skill effectively forces a specific language on all users.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI persists the full fetched post results to a local JSON file after completing a retrieval task, even though users may reasonably expect a fetch-and-print workflow only. This creates an undisclosed data-retention channel that can expose scraped content, account data, or analysis artifacts to other local users, backups, or later compromise of the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The tool writes fetched results to a local JSON file without any user-facing warning or explicit consent path in this file. Silent persistence increases privacy and operational risk because collected Douyin data may remain on disk longer than intended and become accessible through local disclosure, backups, or shared workspaces.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill sends the provided keyword and related parameters to remote APIs through
search.createSearchTaskandsearch.getSearchTask. For code files, network transmission of user data should have some visible disclosure; here the CLI prints progress messages but does not explicitly warn that the entered search query is being sent to an external service.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI persists the full search output, including user-supplied keywords and returned content, to a local JSON file without any visible consent or data-minimization controls. In a research tool this can expose sensitive queries, account data, or scraped content to other local users, backups, or later unintended reuse, creating a privacy and data-retention risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Writing search results to a local JSON log file without explicit user warning or consent creates silent persistence of potentially sensitive research data. Because this skill handles keyword searches, competitor analysis, and comment mining, the stored output may contain personal data, operationally sensitive queries, or scraped content that users did not expect to retain on disk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing warning and status strings are written only in Chinese, which imposes a specific language/locale on users without any opt-in or alternative. Under the policy, locale or language constraints should either be user-selectable or clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains user-facing comments and error/output strings entirely in Chinese, including validation errors and formatted result messages. Because the skill does not provide a user opt-in or configurable language selection, it appears to enforce a specific language/locale, which matches the natural-language policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON schema uses Chinese-only natural-language titles and descriptions for the skill inputs, including the top-level title/description and field descriptions. Because the file provides no user opt-in, alternative locale, or justification that the skill is China/Chinese-specific, it may violate the language/locale policy for natural-language content.
- Content
Static analysis
No suspicious patterns detected.