Security audit

guaikei-douyin-vault

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it has review-worthy issues around broad activation, external API data handling, default result logging, and contradictory promotional authentication errors.

Install only if you are comfortable sending Douyin search terms, target URLs or identifiers, and your GUAIKEI_API_TOKEN to the vendor service. Treat the token as sensitive, rotate it if already used, review the local logs directory after runs, and avoid submitting confidential research targets unless the vendor and retention model are acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: src/utils/request.js:49
Finding: Hardcoded Promotional Contact Information in Authentication Error Output
Content: View full analysis
process.exit(exitCode), ); ``` ### Technical Analysis The request layer injects a fixed third-party contact number whenever the remote API returns HTTP 401 or 403. The CLI then copies `error.message` directly into stderr and the JSON response returned to the caller. This behavior contradicts the explicit policy in `SKILL.md`, which requires authentication failures to produce only a neutral configuration error and prohibits runtime contact information or marketing content. Because the text is emitted through the structured `message` property, an agent or downstream application may treat it as legitimate task output and relay it to the user. The issue is deterministic and does not require control o ...[truncated 1197 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:94
Finding: API Token Exposed in HTTPS URL Query Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (51)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 描述覆盖的是较广泛的抖音数据查询能力，包括视频评论、博主热度、热搜话题等用户意图；而实际代码只处理“抖音博主已发布作品”任务的创建与结果查询，输入是博主主页 URL 和数量限制，输出是作品数组。两者主功能范围明显不一致：描述强调评论/热度/话题分析，代码则是作品抓取。因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 描述将技能定位为一个较通用的抖音数据查询能力，面向视频评论、博主热度、热搜话题等多种用户意图；但这段代码的唯一明确功能是获取“抖音热榜”。它通过 token 认证后调用 hot.getHotTask，并输出热榜结果，没有体现对视频评论、博主分析或其他抖音数据类型的支持。因此，代码实际行为与声明的能力范围存在实质不一致。虽然“热搜话题”与热榜相关，部分重叠，但整体声明明显宽于实际实现，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个面向多种抖音数据需求的技能，包括视频评论舆情、博主热度、热搜话题等自然语言触发场景；但实际代码只实现了“获取抖音博主作品列表”这一单一功能。输入参数也明确要求博主主页 URL 或 sec_uid，输出是作品任务结果，没有任何评论抓取、热度评估、热搜话题抓取或其他平台处理逻辑。因此，代码实际行为比声明的能力范围窄得多，属于描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音/短视频数据获取场景的技能，核心能力应与平台数据查询、评论分析、博主热度或话题分析相关。而实际代码仅是通用参数解析器，负责读取命令行参数、检查重复/缺失参数、处理布尔值和生成帮助信息。这不是对声明能力的直接实现，也看不出任何与抖音或短视频平台相关的业务行为。虽然这类工具代码可能作为底层支持模块存在，但就当前提供的代码块本身而言，其实际行为与声明用途明显不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音/短视频数据查询分析的技能，而提供的代码片段仅展示了本地日志写入功能，没有任何与抖音、视频、博主、热搜、评论抓取或数据分析相关的实现。虽然日志模块可能作为辅助组件存在，但当前代码片段的实际行为是文件名清洗后写入本地 logs 目录，这属于未声明的文件系统写入能力，且其主要目的与技能声明明显不一致。因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says the skill should help users get data about Douyin videos, creators, comments, or hot topics. However, the supplied code chunk does not implement any such behavior. It merely accesses the local filesystem, reads package.json, and returns the package name. While this could be a harmless support utility in a larger skill, based on this chunk alone the actual behavior is materially unrelated to the declared purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个较通用的抖音数据查询技能，覆盖视频、博主、热搜话题等多种场景；但提供的代码片段实际只负责把热榜结果渲染成文本消息，内容固定为“抖音最新热榜”。没有看到与视频评论分析、博主热度查询或其他短视频平台相关的实现。虽然这段代码可能只是整体技能的一部分，但就该代码块本身而言，其实际行为与声明的广泛用途不一致，属于功能范围明显更窄的实现。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises broad natural-language triggers such as references to Douyin, short-video platforms, creators, or trending topics, which can overlap with many ordinary user requests. In agent environments, overly broad triggers can cause the skill to activate unexpectedly and route user queries, tokens, or context into external data-fetching workflows without sufficiently clear user intent. The risk is increased here because the skill can perform network-backed data retrieval and logging once invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The 'implicit trigger' examples are vague enough to match broad business-analysis requests that may not actually be asking for Douyin data retrieval. This can lead to unintentional invocation, causing unnecessary external queries, misrouting of user context, or collection of third-party data when the user did not explicitly request that workflow. In a skill that logs execution and uses an API token, accidental activation raises the operational and privacy risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON schema uses Chinese exclusively for the title and all description strings, which can impose a specific language/locale on downstream skill behavior or generated documentation. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README describes obtaining a vendor token and using commands that submit keywords, video URLs, and account identifiers, but it does not clearly warn users that these inputs are sent to an external service. This creates a transparency and privacy risk: users may unknowingly transmit sensitive research interests, monitored accounts, or target URLs to the provider when invoking the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger examples are broad conversational phrases such as requests to 'search' or 'find' content, which can overlap with normal user speech and cause unintended invocation of the skill. In this skill, unintended invocation is more sensitive because activation can lead to external data requests about third-party videos, accounts, or URLs and may expose user-provided queries to the vendor-backed service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent-recognition rules use high-priority broad keywords like '热搜', '搜索', '评论', '视频', and '博主' without enough constraints to ensure the user actually intends to invoke this specific skill. Because this skill performs outbound lookups and can process target URLs/account identifiers, ambiguous matching increases the risk of accidental data transmission and actions the user did not clearly request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The changelog title is presented in Chinese as the primary language, with only a partial English gloss in parentheses. This indicates a language preference in the skill's natural-language materials without any indication that users can choose another language or locale.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 技能清单描述将用途限定为当用户提到抖音、短视频平台、某条视频、某个博主、热搜话题并想获取数据时使用，强调的是面向这些对象的数据获取与分析。更新日志却宣称提供抖音通用搜索、图文搜索、社交数据搜索，以及竞品账号内容批量抓取能力，这些能力明显更广，也带有更强的抓取/竞品分析色彩，超出清单描述的自然范围。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code sends a token plus user-supplied video URL to remote API endpoints via requestApi in both task creation and task lookup flows. Although the functions are documented for developers, there is no user-facing warning, confirmation, or disclosure in this file that user data and an access token will be transmitted over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code sends a skill token and user-provided search keyword to a remote API when creating a search task. Although the functions have technical docstrings, there is no user-facing prompt, warning, or explicit disclosure here that these values are transmitted off-box.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The GET request includes the token, keyword, and other search parameters in the request to an external endpoint. The code contains developer comments, but no user-oriented notice, confirmation, or warning that these inputs are transmitted during result retrieval.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI persists fetched comment data to a local JSON file after already printing the results, creating an additional copy of potentially sensitive or regulated user-generated content without explicit user consent or necessity for the stated retrieval function. This increases data exposure risk through local disk retention, unintended sharing, or later access by other users/processes on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The program silently writes the full comment results to a local JSON file without any explicit warning, prompt, or user-selected output destination in this CLI flow. Because comment data may contain personal information, opinions, or identifiers, this hidden persistence can violate user expectations and increase privacy/compliance risk if the host is shared or monitored.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file contains multiple natural-language strings in Chinese for status, error, and success output, but provides no indication that the skill is intentionally region-specific or that users can opt into that locale. Per the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI persists the full fetched Douyin results to a local JSON file after completing a user-requested retrieval. This creates unnecessary data retention beyond the immediate response path, which can expose scraped content, identifiers, or metadata to other local users, backups, or later compromise, especially since the skill description emphasizes retrieval rather than storage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CLI persists full search output to a local log file after completing an on-demand retrieval operation. This creates an unnecessary at-rest copy of potentially sensitive query terms and retrieved content metadata, increasing exposure to local compromise, unintended retention, or later misuse beyond the user's immediate request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments and user-facing messages entirely in Chinese, including thrown errors and generated help text. Under the policy, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.