T09 · Insecure Skill Coding Practices
Error
- Location
src/api/search.js:59- Finding
API Token Exposed in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-trending-for-hotspot-tracking
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does the Douyin research it advertises, but it needs review because it handles the API token unsafely and contradicts its own runtime-authentication safeguards.
Install only if you are comfortable sending Douyin URLs, keywords, and result requests to Guaikei and storing returned search/comment/account data in local JSON logs. Rotate or limit the GUAIKEI_API_TOKEN where possible, and prefer a version that sends credentials in an Authorization header, narrows auto-triggering to explicit Douyin requests, removes runtime promotional contact messages, and offers controls for disabling or deleting logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
src/utils/request.js:50- Finding
Agent-Visible Promotional Messages Contradict the Declared Neutral Authentication Policy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation states that collected data is automatically written to a local
logs/directory, but the high-level purpose framing emphasizes online Douyin data retrieval rather than local persistence. Undeclared local storage of fetched content can create privacy, retention, and operator-surprise risks, especially when comments or account data may be saved without explicit consent.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation states that collected data is automatically written to a local
logs/directory, but the high-level purpose framing emphasizes online Douyin data retrieval rather than local persistence. Undeclared local storage of fetched content can create privacy, retention, and operator-surprise risks, especially when comments or account data may be saved without explicit consent.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation states that collected data is automatically written to a local
logs/directory, but the high-level purpose framing emphasizes online Douyin data retrieval rather than local persistence. Undeclared local storage of fetched content can create privacy, retention, and operator-surprise risks, especially when comments or account data may be saved without explicit consent.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill says it should trigger even when the user does not mention Douyin, based on broad workflows like content research or topic planning. Overbroad auto-activation can cause the agent to invoke third-party scraping/data-collection behavior in contexts the user did not clearly request, increasing the chance of unnecessary secret use, unintended data transfer, and collection of external data without informed intent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 77% confidence
- Finding
The skill explicitly relies on an environment variable (
GUAIKEI_API_TOKEN) but does not declare any tool scope such as environment access permissions. Undeclared secret access weakens least-privilege controls and makes it harder for the platform or user to understand what sensitive resources the skill needs before activation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents automatic saving of results to
logs/but does not provide an explicit warning to users that fetched data will persist locally. Silent persistence is risky because search terms, account URLs, comments, and trend results may contain sensitive business research or personal data that remains on disk beyond the immediate session.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Line L142 states "纯中文界面", which indicates the skill forces a specific language/locale. The policy requires either user choice/opt-in or a clearly justified locale constraint; neither is provided here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JSON schema contains user-facing natural-language fields such as the title and property descriptions only in Chinese. Because the file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context, it creates a locale policy concern under the language-choice requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JSON schema uses Chinese titles and descriptions throughout, which imposes a specific language/locale in the skill artifact without any visible opt-in, alternative locale, or justification that the skill is region-specific. Under the policy, language constraints should either be optional for the user or clearly documented as a justified locale-specific limitation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README states that the skill automatically exports JSON logs to a local
logsfolder, but it does not clearly disclose the persistence scope or that collected Douyin data, URLs, keywords, comments, and derived metadata may remain stored on disk. In a workflow handling competitor research, comment scraping, and hotspot analysis, silent local retention can expose sensitive operational data to other local users, backups, or downstream tooling.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README instructs users to obtain and configure a
GUAIKEI_API_TOKEN, which strongly implies communication with a third-party service, but it does not clearly disclose that user queries and collected Douyin data will be transmitted externally. Because this skill is marketed as a lightweight local Node.js tool and handles scraped public content plus user-supplied targets, the lack of explicit external data-flow disclosure can mislead users about privacy, compliance, and data-handling risk.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file presents user-facing natural-language content entirely in Chinese, including the title and all change descriptions. Under the language/locale policy rule, forcing a specific language without opt-in or justification is a policy concern because users are not given a choice or explanation for the locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code sends a skill token and a user-supplied video URL to external API endpoints via requestApi, which is a safety-relevant network operation involving potentially sensitive data. Although the functions have developer docstrings, there is no user-facing confirmation, warning, or visible disclosure in this file about transmitting that data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The getCommentTask function performs a GET request containing the token and video URL in request parameters, which transmits user or system data to an API. The file contains no user-facing prompt, logging, or warning text indicating that this data will be sent externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI writes fetched comment data to a local JSON file automatically after successful execution, but there is no clear runtime consent or warning before persisting the data. Because this skill is specifically designed to collect social-media comments at scale for research and analysis, the saved output may contain personal data or sensitive content, creating avoidable privacy, retention, and disclosure risk on shared machines or in automated pipelines.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file contains user-facing natural-language strings entirely in Chinese, including status, errors, and success messages. This forces a specific language/locale on all users with no visible opt-in or documented justification, which matches the language-policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code sends the user-supplied Douyin URL/sec_uid and limit to remote APIs via createPostTask and getPostTask, but there is no explicit disclosure or consent in this file that the input will be transmitted off-host. In a data-collection skill focused on account scraping and trend research, undisclosed network transmission can leak user investigation targets or operational research data to the service operator.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI writes the full result set, including the queried URL and returned post data, to a local JSON file without any user opt-in, warning, or control in this file. Because this skill handles competitor research, comment analysis, and hotspot tracking data, silent persistence can expose sensitive research inputs or scraped content to other local users, backups, or later unintended reuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file presents argument descriptions, help text, warnings, and runtime messages entirely in Chinese. This enforces a specific language for all users without offering any language selection or documenting a justified locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists the full query keyword and returned search results to a local JSON log file without any consent, warning, retention control, or redaction. In this skill's context, queries and results may contain sensitive business research terms, competitor monitoring targets, or comment data, so silent local persistence increases the risk of unintended disclosure to other local users, backups, or log collectors.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains natural-language content in Chinese in the JSDoc comments and also emits a Chinese error message at L31. Per the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-facing warning and status messages only in Chinese via string literals. That can violate language/locale policy requirements when the skill does not provide user opt-in, fallback, or documentation justifying a Chinese-only experience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code formats all user-facing text in Chinese string literals, including headings and labels, with no indication that the skill is intentionally China/Chinese-locale specific or that users can opt into another language. That can violate language/locale policy when the skill is used in broader contexts where users have not chosen Chinese output.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The title and field descriptions are entirely in Chinese, which can constitute a language/locale policy issue when a skill implicitly enforces one language without opt-in or explanation. The file does not document that this schema is intentionally region-specific or offer any language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This JSON schema uses Chinese-only natural-language title and description fields throughout, which can amount to a language/locale policy constraint if the skill is expected to be generally usable without prior user opt-in. The file does not document that the schema is intentionally region-specific or offer any language choice.
- Content
Static analysis
No suspicious patterns detected.