Security audit

guaikei-douyin-discover-viral-content

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it has Review-worthy risks around broad activation, automatic data logging, credential handling, and runtime messages that contradict its own security claims.

Review before installing. Use this only for Douyin public-data analysis you are authorized to perform, and assume submitted keywords, profile/video URLs, and targets go to the GUAIKEI service. Protect the API token, clear local logs when no longer needed, and prefer a revised version that sends credentials in headers, makes log export explicit, tightens activation to Douyin-specific requests, and removes promotional runtime messages.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/token.js:23
Finding: Runtime Promotional Output Contradicts Declared Security Behavior
Content: View full analysis
process.exit(exitCode), ); ``` ### Technical Analysis The Skill documentation states that invalid-token handling must emit only a neutral error and must not display website links, WeChat contact details, or marketing language at runtime. The implementation violates those explicit guarantees in two authentication paths: 1. A missing or locally malformed token causes `skillToken()` to print a website acquisition channel to stderr. 2. An HTTP 401 or 403 response ...[truncated 1669 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: API Authentication Token Is Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill states it is for Douyin content retrieval but also documents automatic logging to local files under logs/. Undeclared or under-emphasized filesystem writes can create privacy and data handling risk, especially if queries, URLs, comments, or token-related errors are persisted unexpectedly on shared systems.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill states it is for Douyin content retrieval but also documents automatic logging to local files under logs/. Undeclared or under-emphasized filesystem writes can create privacy and data handling risk, especially if queries, URLs, comments, or token-related errors are persisted unexpectedly on shared systems.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill states it is for Douyin content retrieval but also documents automatic logging to local files under logs/. Undeclared or under-emphasized filesystem writes can create privacy and data handling risk, especially if queries, URLs, comments, or token-related errors are persisted unexpectedly on shared systems.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states it is for Douyin content retrieval but also documents automatic logging to local files under logs/. Undeclared or under-emphasized filesystem writes can create privacy and data handling risk, especially if queries, URLs, comments, or token-related errors are persisted unexpectedly on shared systems.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill states it is for Douyin content retrieval but also documents automatic logging to local files under logs/. Undeclared or under-emphasized filesystem writes can create privacy and data handling risk, especially if queries, URLs, comments, or token-related errors are persisted unexpectedly on shared systems.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill documentation declares use of an environment variable token but does not declare any explicit tool scope or permissions boundary. That creates a trust and review gap: a runtime with broader-than-expected environment access could expose unrelated secrets or normalize undeclared secret use, making the skill harder to safely approve and sandbox.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad enough to match ordinary requests like '帮我搜下' or '网上谁在讲这个' without clear Douyin-specific intent. This can cause over-activation of the skill, leading to unexpected external data access, token use, and logging for requests the user may have meant for another source or for a general web search.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The generalized rule says the skill should infer Douyin use even when the platform is not mentioned, which increases the chance of invoking a third-party data collection workflow without informed user intent. In context, this is more dangerous because the skill also uses an API token and persists logs, so mistaken activation can leak query context into external services and local storage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The schema explicitly documents video_url as both a playback address and a download address, which conflicts with the skill manifest stating that downloading is out of scope. Even though this file is only a schema, it shapes downstream tool behavior and developer expectations; exposing download-oriented fields can enable or normalize unsupported content acquisition and policy bypass.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the schema title and every property description. Because the file does not document that the skill is region-specific or provide any language/locale opt-in, it appears to impose a specific language by default, which matches the language/locale policy-violation category.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest says the skill is for searching Douyin videos, hot lists, comments, and creator history, and explicitly says it is not for downloading or watermark-removal. However, the schema describes play_addr as both a playback address and a '视频下载地址', which expands the represented behavior into downloading.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README explicitly promotes automatic JSON log exports of scraped Douyin videos, comments, and account data, but it does not warn that these outputs may contain personal data, user-generated content, or profiling information that will be stored locally. In a scraping/monitoring skill, silent local retention increases the risk of privacy violations, accidental sharing, and non-compliant downstream use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README requires a GUAIKEI API token and directs users to an external website, which strongly implies requests and target metadata are sent to a third-party service, yet it does not clearly disclose that user queries, URLs, and scraped targets may leave the local environment. For a skill handling search terms, profile URLs, and comment retrieval, lack of transparency about external transmission can expose sensitive research, monitoring targets, or business intelligence workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file presents all operational instructions and parameter descriptions in Chinese only, which can amount to a language/locale constraint without user opt-in. The policy allows locale constraints when clearly documented and justified, but this file does not state that the skill is intended only for Chinese-speaking users or a China-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code file contains natural-language comments and descriptions exclusively in Chinese, which can amount to a language-policy violation when the skill does not offer any locale choice or indicate that it is intentionally region-specific. The instructions require flagging language or locale constraints that are imposed without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The CLI persists fetched comment data to a local JSON file automatically after successful execution, without an explicit consent step or a prominent warning at the point of collection. Comment data may contain personal information, usernames, or sensitive content, so silent local retention increases privacy and data-handling risk, especially on shared systems or in agent-driven environments where the user may not expect durable storage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file's natural-language strings, including comments and runtime messages such as "获取抖音热榜失败" and "抖音热榜任务完成", are presented only in Chinese with no indication that users can choose another language. This is a natural-language policy concern because the skill appears to enforce a specific language/locale rather than offering opt-in or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The code reads GUAIKEI_API_TOKEN and then calls remote task APIs with the token, normalized URL, and limit. Although the skill purpose implies fetching data, this file does not explicitly warn users that their supplied identifier/URL and credentials are being sent to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI writes the full request and results to a local JSON file, and the request object includes the user-supplied Douyin profile URL/sec_uid. In this skill context, that can expose browsing targets, collected content metadata, and potentially sensitive account identifiers on shared systems or in insecure working directories without warning the user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The hard-coded AuthError message is entirely in Chinese and directs users to a specific support contact, with no indication that language is selectable or that the skill is intentionally limited to a Chinese-speaking audience. This creates a natural-language locale policy concern because the file imposes one language on all users by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JavaScript file contains user-facing error strings and formatted output entirely in Chinese, such as the validation errors and search result headings. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a documented region-specific justification is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The statement "纯中文界面" indicates a fixed language constraint. Under the policy, forcing a specific language without user opt-in or a clearly documented justification is a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest/config file contains user-facing title and description fields entirely in Chinese, which can amount to forcing a specific language without explicit user opt-in. The file does not document that the skill is region-specific or offer any language/locale alternative.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title and description are entirely in Chinese, which imposes a specific language in natural-language metadata without indicating user opt-in or that the schema is intentionally region-specific. Under the language/locale policy, this is a potential policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This JSON schema contains user-facing natural-language metadata entirely in Chinese, including the title and multiple description fields. Because the file provides no opt-in, language selection, or documented region-specific justification, it may violate a language/locale policy that requires user choice or explicit justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.