Security audit

guaikei-douyin-trend-radar

Security checks for vulnerabilities and agentic risk

Overview

Review before installing: this is mostly a Douyin public-data tool, but it has broad activation, automatic saved result files, token-in-URL API calls, and runtime behavior that contradicts some safety claims.

Install only if you are comfortable sending Douyin search terms, target URLs, and a GUAIKEI_API_TOKEN to guaikei.com, and with search/post/comment results being saved locally by default. Confirm the user really wants Douyin data when the request is ambiguous, avoid using returned media URLs for downloading or redistribution, and periodically delete logs that contain sensitive research or comments.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The schema explicitly documents `play_addr` as both a playback URL and a video download address, which conflicts with the skill description stating it is not intended for downloading material. Exposing a download-capable field can enable downstream agents or users to repurpose the skill for unauthorized content acquisition, creating policy and abuse risk even if the file itself is only a schema.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI writes the full fetched comment results to a local JSON file after completing the request. This creates persistent storage of potentially sensitive or regulated user-generated content beyond the stated read/inspection behavior, increasing risk of unintended retention, later disclosure, or collection from disk by other local users/processes.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI writes fetched Douyin post results to a local JSON file after completing a read/search operation, creating data at rest that users may not expect from a search-oriented skill. Even if the content is public, the stored file can accumulate scraped data, metadata, and query context on disk, increasing privacy and retention risk on shared or managed systems.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The CLI writes full search output to a local JSON file after execution, even though the user-facing behavior appears to be a read/search tool. Persisting results can expose user queries and returned content to other local users, backups, or later processes without clear necessity or consent, increasing privacy and data-retention risk.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The description says the skill should be used even when the user has not mentioned Douyin, which broadens activation beyond explicit user intent. That can cause the agent to route generic trend, competitor, or reputation-analysis requests into a third-party data-collection workflow unexpectedly, increasing the chance of unnecessary external queries, privacy/compliance issues, and user surprise.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The 'when to use' section repeats the instruction to invoke the skill for broad task types even without the user naming Douyin, reinforcing overbroad automatic activation. In an agent setting, this can redirect ambiguous requests to a platform-specific scraping/search capability without informed consent, creating data-minimization and policy-boundary risks.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The GET request places the token and user-supplied request data in query parameters, which are more likely to be exposed through logs, browser history, proxies, monitoring systems, and intermediary infrastructure than request bodies. In a skill that processes user-provided Douyin targets, this increases the chance of credential leakage and unintended disclosure of the queried video URL and collection parameters.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The tool silently writes retrieved comments to a local file without a user-facing warning or explicit consent in the CLI flow. Even if intended for convenience, undisclosed persistence can surprise users and leave copies of scraped comment data on disk, where they may be accessed later or retained longer than expected.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The tool silently writes fetched results to a local JSON file without clear user consent in this code path, which can surprise users and leave residual data on disk. In the context of a search/scraping skill, silent persistence expands the privacy footprint and may expose collected data to other local users or backup/sync systems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Search results are silently written to disk without an explicit warning or consent flow, which can surprise users and leak potentially sensitive search terms or output into local storage. In a trend-radar/search skill, this is more concerning because users may assume the tool is read-only and ephemeral, not creating forensic artifacts.

Static analysis

No suspicious patterns detected.