Security audit

guaikei-douyin-trending-videos-and-rankings

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin public-data purpose, but it under-discloses important token, logging, and runtime contact-output behavior users should review before installing.

Review this before installing if your searches, target accounts, or API token are sensitive. Running it sends Douyin queries or URLs and the token to www.guaikei.com, may save collected public results locally under logs/, and may print provider contact/promotional text on auth failures despite the stated policy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: src/utils/request.js:51
Finding: Authentication Errors Inject Promotional Contact Information into Agent-Visible Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/api/search.js:59
Finding: API Credentials Are Exposed in URL Query Parameters
Content: View full analysis
`. HTTPS encrypts the request in transit, but it does not prevent the plaintext URL from being recorded at endpoints or infrastructure components. Full request targets are commonly retained in origin access logs, reverse-proxy logs, load balancer telemetry, application-performance monitoring systems, debugging output, and error reports. The polling endpoints also place search keywords or supplied Douyin URLs in the same query string. This unnecessarily associates the reusable credential with user activity in log records. ### Attack Path 1. The CLI reads `GU ...[truncated 974 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/config/constants.js:21
Finding: Query Operations Can Retry Up to Twenty Times Contrary to the Documented Limit
Content: View full analysis
setTimeout(resolve, delay)); } } } throw lastError || new Error(`重试${maxAttempts}次后失败`); } ``` Query operations pass the twenty-attempt value directly to the retry wrapper: ```js // src/api/search.js:115-121 const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "查询任务", ); ``` ### Technical Analysis The documentation states that network timeouts should be retried at most three times. In practice, result-query and hot-list operations use `QUERY_MAX_ATTEMPTS`, which is set to twenty. The retry wrapper does not restrict retries to transient network failures. It retries any error without the `noRetry` property, including API errors that the response parser has not explicit ...[truncated 1479 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音公开数据检索与分析的技能，其核心行为应涉及抖音相关数据访问或处理。实际代码仅实现通用参数解析和帮助文本构建，属于基础设施/辅助模块，没有任何抖音平台访问、内容检索、评论读取、热榜获取或相关业务逻辑。根据评估标准，虽然辅助实现细节本身不必单独判定为不匹配，但这里提供的代码片段完全不体现声明中的主要目的，呈现出的实际行为与声明能力存在实质性偏差，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音公开数据抓取/查询的技能，而代码片段实际实现的是本地日志写入辅助工具，与抖音数据搜索、作品抓取、评论读取、热榜查看等核心能力无直接对应关系。虽然日志记录可能是支持性实现细节，但当前提供的代码片段本身只展示了文件写入能力，且涉及本地文件系统访问，这在声明中未体现，也不是所述技能的直接行为。因此该代码与声明用途存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description presents a user-facing Douyin analysis/data-retrieval skill. The supplied code chunk does not implement any of those capabilities: it neither accesses Douyin nor performs search, comment reading, hot-list retrieval, or creator-work collection. Instead, it is a simple internal helper that reads package.json from the local filesystem to obtain the package name. This is materially different from the declared purpose, so the description is not accurately represented by this code chunk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly depends on an environment variable (GUAIKEI_API_TOKEN) but does not declare any tool scope or permissions metadata for environment access. This creates a transparency and least-privilege problem: orchestrators or reviewers cannot accurately constrain or audit what sensitive runtime capabilities the skill needs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is configured to trigger on broad, generic research requests even when the user does not explicitly mention Douyin. This can cause unintended invocation in unrelated contexts, leading to unnecessary external data access, token use, and possible leakage of user intent to a third-party API.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Several trigger phrases such as generic terms for search, comments, trends, or rankings are common in everyday requests and may collide with unrelated user tasks. Over-broad activation increases the chance of misrouting conversations into this skill, causing unnecessary API calls and exposing contextual data beyond user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title at L04 and property descriptions across the file. For a general-purpose skill artifact, that imposes a specific language/locale without any visible opt-in or justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema explicitly describes video_url as both playback and download addresses, which conflicts with the skill metadata stating it must not be used for downloading videos. Even though this file is only a schema, documenting download-capable outputs can enable downstream clients or agent logic to expose prohibited functionality and bypass the intended product restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema title and nearly all descriptions are written exclusively in Chinese, which imposes a specific language/locale on consumers of the skill metadata. The file does not provide any user opt-in, alternative locale, or documented reason that this skill is intentionally limited to Chinese-language usage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The schema exposes a direct media playback/download field (play_addr) even though the skill metadata says it should not be used for downloading videos. This creates a capability-policy mismatch: downstream agents or consumers may rely on the schema and use the field to retrieve media content, bypassing the stated restriction and increasing the risk of unauthorized downloading or policy noncompliance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The package description is entirely in Chinese and provides no indication that other languages are supported or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, a language-specific constraint without user opt-in or explicit justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly promotes exporting scraped Douyin data and automatic JSON log generation, but it does not give a clear privacy/data-minimization warning about storing public comments, author data, or other potentially sensitive personal data. In a scraping skill, persistent local logs increase the risk of unintended retention, sharing, or secondary misuse of collected data, especially in marketing and sentiment-analysis workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The quick-start commands cause network requests to a third-party service and retrieval of Douyin data, yet the workflow does not prominently disclose that data, queries, URLs, and the API token will be transmitted to external infrastructure. In the context of a scraping/data-collection skill, this matters because users may unknowingly send potentially sensitive search terms, target account URLs, or business intelligence queries to a third-party provider.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language comments and API parameter descriptions in this file are exclusively in Chinese, with no indication of language choice or opt-in. Under the stated policy, forcing a specific language/locale without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code performs an outbound API request that includes a skill token and user-provided search keyword, which constitutes transmission of potentially sensitive user or system data. Although the functions are documented for developers, there is no visible confirmation prompt, user-facing log, or comment/disclosure warning users that their inputs and token are being sent to an external API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This GET request sends the token along with keyword and filter parameters to a remote API endpoint. The file lacks any user-facing notice, confirmation, or warning about this outbound data transmission, and the existing JSDoc comments only describe the function for developers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI writes the full fetched comment results to a local JSON file automatically after successful execution, without any explicit user consent, warning, or opt-in control in this file. Because comment data can contain personal data, sensitive opinions, or account-identifiable information, silently persisting it increases privacy and data-retention risk if the host system is shared, monitored, or later compromised.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI writes the full fetched results to a local JSON file without clearly disclosing that persistence behavior to the user. Even if the data is public Douyin content, local retention can expose query history, monitored accounts, and collected content to other local users, backup systems, or downstream processes, which is a privacy and data-handling risk inconsistent with a read-only/query-oriented tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code presents its command descriptions, help text, warnings, and runtime messages exclusively in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without offering the user a choice or documenting a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI writes full search outputs to a local log file using a filename derived from user-controlled input (keyword). Even though the skill is described as a read/query tool for public Douyin data, persisting results locally expands the data-handling surface, can unexpectedly retain queried content, and may expose search history or collected results to other local users/processes. The risk is contextual rather than overtly malicious, but it is still a real privacy/data-minimization issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The authentication failure message is written only in Chinese and includes support instructions in that language, which imposes a specific language on users without offering a choice. This matches the natural-language policy category for language or locale policy violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The statement "纯中文界面" indicates a fixed language constraint. The file does not offer the user a language choice or explain a necessary compliance reason for enforcing Chinese-only output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions for the command-line parameters. Because no locale scope, opt-in, or alternative language is provided, it may violate a language/locale policy that requires user choice or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON schema contains human-readable titles and descriptions exclusively in Chinese, such as the title and field descriptions. For a general-purpose skill asset, that constitutes a locale/language constraint in natural-language content without any indication that users can choose another language or that the schema is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title and property descriptions. Under the policy, forcing a specific language is a violation unless the locale constraint is explicitly documented and justified or the user is given a choice.
Content: No source excerpt is available for this finding.