Security audit

guaikei-douyin-trend-radar

Security checks for vulnerabilities and agentic risk

Overview

The skill largely performs the advertised Douyin data lookups, but it should be reviewed because it has broad activation rules, automatic local data retention, and credential/error-output handling that conflicts with its own safety claims.

Review this skill before installing. Use it only when you intentionally want Douyin public-data collection, avoid broad automatic invocation, expect result files to remain under logs/, and treat the GUAIKEI_API_TOKEN as sensitive because the current implementation sends it in query strings. Do not rely on its stated neutral-auth-error guarantee until the runtime contact messages are removed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/request.js:51
Finding: Hard-Coded External Contact Solicitation in Authentication Error Output
Content: View full analysis
process.exit(exitCode), ); return; } ``` ### Technical Analysis When the remote API responds with HTTP 401 or 403, the request layer creates an authentication error containing a hard-coded WeChat number and an instruction to contact it for a solution. The CLI then copies `error.message` directly into stderr and its machine-readable JSON output. This behavior contradicts the declared authentication-error policy in `SKILL.md`, which states that runtime authentication failures must produce only a neutral error and must not include contact details, website links, or marketing language. Because structured CLI output may be consumed and presented by an AI agent, the ...[truncated 1494 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: API Authentication Token Transmitted in URL Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 从代码看，核心行为是调用 /api/douyin/general-search/keyword 和 /api/douyin/general-search/info 两个接口，围绕关键词搜索创建任务和获取结果，属于抖音搜索能力。结果处理函数只是在搜索结果上补充 author_url 和 create_time_str，不构成评论、博主作品或热榜功能。声明将技能定位为同时支持搜索、博主作品、评论、热榜四大场景，这与当前代码的实际能力范围明显不符，因此属于描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 从代码看，主函数明确标注为“获取抖音博主作品列表”，参数也只接受博主主页 URL/sec_uid 和数量限制，随后调用 createPostTask/getPostTask 获取作品结果。输出内容也是 command: "post" 的作品结果，并保存为 post.json 日志。没有任何与关键词搜索、热门榜单、评论抓取/分析相关的参数、API 调用或处理流程。因此，声明描述的是一个覆盖“搜、扒、翻、追”四类能力的综合抖音分析技能，而该代码片段实际只实现了其中“扒博主作品”的子能力，属于描述显著宽于实际行为的情况，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容洞察的技能，核心能力应涉及抖音相关数据访问与分析。实际代码片段只是通用参数解析器，处理命令行输入和帮助文本生成，属于基础工具层实现。该代码本身未体现任何与抖音、搜索、评论、博主作品或热榜相关的行为，因此与声明的主要用途存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容搜索/分析的技能，应涉及获取热门内容、博主作品、评论或热榜数据。实际代码却只是通用的本地日志写入函数，使用 Node.js 的 fs/path 模块在本地创建目录并写文件，没有任何与抖音、搜索、评论、热榜或内容分析相关的行为。这不是单纯的辅助细节，因为所给代码块的功能本身与声明的核心用途完全无关，且包含未声明的本地文件系统访问能力，因此应判定为明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容检索与分析的技能，核心能力应涉及平台内容搜索、评论/热榜查看等。提供的代码片段却只使用 fs 和 path 读取本地 package.json 并返回 name 字段，属于本地元数据读取功能。该行为既没有体现声明中的主要用途，也访问了与描述不相符的本地资源。因此这是明显的描述与实现不一致。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill explicitly relies on the environment variable GUAIKEI_API_TOKEN, but the manifest does not declare a tool scope such as permissions or allowed-tools for environment access. This creates a transparency and least-privilege problem: an agent may access secrets at runtime without the skill contract making that capability explicit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs activation even when the user does not mention Douyin, which creates an overly broad trigger surface. That can cause the agent to invoke external-data collection or secret-dependent tooling in contexts where the user did not clearly request this platform-specific behavior, increasing the chance of unintended data access or surprise tool execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Ambiguous activation criteria are dangerous in an agent setting because they can silently redirect broad user requests into this skill without informed consent. In this context, the risk is heightened by the skill's use of an API token and external collection actions, so accidental invocation expands both operational and data-handling exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The schema explicitly describes video_url as both playback and download addresses, which conflicts with the stated skill boundary that it is not intended for downloading materials. This mismatch can enable downstream agents or integrators to treat download behavior as supported, increasing the chance of policy bypass and unauthorized media acquisition.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says the skill is for trend discovery, creator works, comments, and rankings, and explicitly says it is not suitable for downloading素材. However, the schema documents play_addr as both a playback address and a '视频下载地址', which exposes a download-oriented output beyond the stated scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes exporting and automatically saving scraped video, author, and comment data into local JSON logs, but it does not prominently warn users that comment data may contain personal information or that files will persist on disk. In this context, the risk is heightened because the skill explicitly targets comment analysis and bulk collection, which can create sizable local datasets containing sensitive public-but-personal content that may later be shared, indexed, or mishandled.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language trigger examples are broad enough that ordinary user requests like '找 AI 相关视频' or generic '搜索/找一下' phrasing could cause the skill to activate when the user did not explicitly intend a Douyin scraping workflow. In this skill's context, unintended activation is more concerning because it initiates collection of external platform data and may process URLs, comments, or account data without a clear confirmation boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Hotlist triggers such as '今天什么火' and similar broad phrases can easily match normal conversation about trends, products, or news, causing the skill to run when the user did not ask for Douyin hotlist retrieval. Because this skill is designed to fetch third-party trend data automatically, misrouting benign conversation into scraping behavior increases the risk of unintended data access and user confusion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The intent recognition rules prioritize broad keywords like '热搜', '搜索', '评论', and '作品' without sufficient scoping, which can over-capture common requests unrelated to Douyin. In this skill, that ambiguity is especially risky because the documented behavior maps directly to command execution paths that fetch and persist scraped data, so a classification mistake has operational consequences beyond a harmless UI error.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Natural-language content in comments and docstrings is entirely in Chinese, which can reflect a locale-specific constraint without any documented opt-in or justification. Under the policy, forcing a specific language without user choice can be a language/locale policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI persists fetched comment results to a local JSON file without making that storage behavior obvious in the stated read-oriented skill purpose. Comment data can include user-generated content and metadata, and writing it to disk increases exposure through unintended retention, local disclosure, or later reuse by other processes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file contains multiple natural-language strings in Chinese for errors, status messages, and descriptions, but provides no indication that the skill is region-specific or that users can opt into another language. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI writes the full fetched results object to a local JSON file automatically after successful execution, with no opt-in, warning, or control over persistence. Because the results may contain sensitive or regulated data such as creator metadata, content details, or comments, this creates unnecessary data retention and increases the risk of unintended disclosure through shared machines, backups, logs, or later compromise.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes a Douyin trend-analysis skill focused on searching content, creators, comments, and rankings for research use, but does not mention credential handling or environment access. Reading process.env.GUAIKEI_API_TOKEN introduces a sensitive-capability dependency that is not evident from the stated purpose alone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file contains user-facing error strings in Chinese, and later also emits a Chinese success/error status message. This enforces a specific language for user interaction without any visible opt-in, fallback, or documented region-specific justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The success and failure messages shown to users are written only in Chinese. Because the file provides no language choice or explicit documentation that the skill is region-specific, this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs outbound HTTPS requests and may send both query parameters and JSON body data to a remote host, but there is no confirmation prompt, user-facing log, or warning near the transmission itself. The existing comments describe API behavior generally, but they do not disclose to a user that supplied data will be sent over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file contains user-facing comments and error/output strings entirely in Chinese, including validation errors and formatted result messages. Because the skill appears to present end-user output in a single forced language with no opt-in or documented region-specific justification, it violates the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and description are written only in Chinese, which imposes a specific language on users through the skill's natural-language interface. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON schema contains user-facing natural-language fields such as the title and descriptions entirely in Chinese, but it does not indicate that the skill is China-specific or offer any language/locale opt-in. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.