Security audit

guaikei-douyin-vault

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed Douyin public-data analytics tool, with notable but purpose-aligned remote API use and local JSON logging.

Install only if you are comfortable sending Douyin keywords, creator/video URLs, and the configured GUAIKEI_API_TOKEN to guaikei.com. Treat saved logs as potentially sensitive because they can contain comments, user identifiers, public profile data, and query history; avoid committing or broadly sharing the logs, and use the tool only for public data you are authorized to collect and analyze.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The changelog advertises broader capabilities than the skill metadata claims, including generic Douyin search across content types and social data plus bulk retrieval features. This scope mismatch is dangerous because it can hide higher-risk data collection behavior from reviewers and users, enabling overbroad scraping or unauthorized collection under the cover of a narrower analytics skill.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The phrase '竞品账号内容批量抓取' describes bulk scraping of competitor account content, which goes beyond a simple end-user query/analysis use case. In context, this increases the risk of mass data harvesting, platform-policy violations, and covert competitive intelligence collection, especially because the skill description presents a more benign analytics-oriented purpose.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI persists fetched comment data to a local JSON file after completing the request, even though the visible behavior of the command is primarily data retrieval and display. Comment content may contain personal data or sensitive text, and silent local retention increases the risk of unintended disclosure, especially on shared machines or in automated environments.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The CLI persists the full fetched results to a local JSON file after completing the request, but the skill description only frames the behavior as data retrieval. This creates an undisclosed data retention behavior that can expose queried account data, result contents, and user activity to other local users, backup systems, or later unintended processing.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI persists the full search output and request metadata to a local JSON log file, which expands data retention beyond transient search execution. If the host is shared, compromised, or backed up to less trusted storage, searched keywords and returned content may be exposed without the user's knowledge.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The implicit trigger examples are broad enough to match generic research requests such as competitor analysis or trending-topic discovery, which can cause the skill to activate outside its intended Douyin-only scope. In an agent setting, over-broad activation increases the chance of unintended data access, confusing tool selection, and collection of third-party platform data when the user did not explicitly request this skill.

Missing User Warnings

Medium

Confidence: 77% confidence
Finding: The README states that scraped Douyin data is automatically exported to local JSON logs, but it does not clearly warn that comments, account data, and other collected content may be sensitive and persist on disk. This can lead to unintended retention, sharing, or exposure of scraped data through local files, backups, or repository commits, especially in team or marketing-report workflows.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The README tells users to configure GUAIKEI_API_TOKEN but does not clearly disclose that the skill will use that credential to send requests and retrieved data to an external third-party service. Users may misunderstand the trust boundary, exposing search targets, scraped URLs, and token-backed usage to a remote provider without informed consent.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: This command sends the user-supplied URL to external API functions and later stores returned results locally, but this file does not present a clear user-facing notice or consent step before transmission and persistence. In a data-collection skill this external processing is expected, but undisclosed outbound sharing and storage can still expose user queries and third-party content unexpectedly.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code writes full comment results to a local file without clearly warning the user that data will persist on disk. This creates a privacy and operational risk because scraped comments may remain accessible beyond the session, be indexed by backups, or leak from shared environments.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The program silently writes fetched results to a local file without user confirmation or obvious warning, which can surprise users and leave potentially sensitive retrieved content on disk. In the context of a data-fetching skill, this is more dangerous because users may reasonably expect ephemeral output rather than persistent local storage.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Writing search results to disk without explicit warning or consent creates a privacy risk because user queries and retrieved content may remain on the system after execution. This is especially relevant for analytics/search tooling where users may assume retrieval is ephemeral and not locally archived.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.