Security audit

guaikei-douyin-trending-to-ranking-report

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it claims, but it has overbroad activation rules, sends queries and tokens to a third-party API, can collect large public Douyin datasets, and automatically saves result logs locally.

Install only if you intentionally want Douyin public-data collection through guaikei.com. Treat keywords, Douyin account/video URLs, result data, comments, user IDs, and IP-region labels as data that may be sent to the provider and saved locally in JSON logs. Use explicit Douyin-only prompts, keep limits small, protect the GUAIKEI_API_TOKEN, and avoid collecting or redistributing comment/account datasets unless you have a lawful and appropriate use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The schema explicitly documents `video_url` as both a playback address and a download address, which conflicts with the skill metadata stating it does not handle video publishing or downloading. This mismatch can cause downstream agents or integrators to expose or rely on download functionality that the skill was expected to avoid, increasing the risk of policy bypass, unauthorized content retrieval, or misuse of scraped media URLs.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The schema explicitly documents `play_addr` as both a playback and video download address, which conflicts with the skill's stated scope that it does not handle downloading. Exposing a download-capable field can enable downstream agents or users to retrieve media directly, expanding the skill from analytics into content acquisition and increasing legal, policy, and misuse risk.

Vague Triggers

High

Confidence: 92% confidence
Finding: The description instructs activation for generic competitive-analysis requests even when the user does not mention Douyin, which can cause the agent to invoke this skill outside the user's intended platform or scope. That broad trigger increases the chance of silent context expansion, unnecessary third-party data access, and user confusion about what source is being queried.

Vague Triggers

High

Confidence: 95% confidence
Finding: The fallback rule says the skill should trigger for short-video research and topic planning even without explicit Douyin context, creating an overbroad routing policy. In an agent setting, this can redirect unrelated research requests into a Douyin scraping workflow, leading to unintended data collection and behavior the user did not specifically authorize.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The '纯中文界面' constraint suggests the skill may force a Chinese-only interface or locale assumption without checking user preference. While not a classic exploit, this can cause misleading outputs, misrouting, or exclusion of users who expect another language, and it may hide material behavior differences from the user.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The hot-list trigger mapping uses broad everyday phrases like '今天什么火', which can cause the skill to activate when a user is making a general inquiry rather than explicitly requesting Douyin hot-list retrieval. In an agent setting, overly permissive intent rules increase the chance of unintended third-party data access and unnecessary external API calls.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The search trigger descriptions include vague phrases such as '搜索 / 搜一下 / 找 + 关键词', which are broad enough to match ordinary conversation and may activate data collection without sufficiently clear user intent. In a tool that queries an external service and can retrieve large volumes of content, ambiguous activation boundaries create a real risk of over-collection and unintended actions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill encourages bulk retrieval of account content and comment data for competitor monitoring and sentiment analysis, but the surrounding description does not provide meaningful privacy, retention, or lawful-use guidance. Even if the data is public, large-scale aggregation of comments and profile activity can materially increase privacy and compliance risks when used for profiling, monitoring, or redistribution.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI persists the fetched Douyin results to a local JSON file automatically, but this file contains scraped account/content data and metadata that users may not realize is being retained on disk. In shared environments, CI runners, or multi-user systems, this can create unintended data exposure through local file access, backups, log collection, or later exfiltration.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The CLI sends the supplied Douyin URL/sec_uid and limit to remote API functions, which means user-provided identifiers and query intent leave the local environment. In this skill's context, remote transmission is expected to perform the service, but the lack of explicit notice reduces transparency and can surprise users who assume purely local processing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.