Security audit

guaikei-douyin-videos-for-competitor-benchmarking

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin research purpose, but it needs review before installation because credential handling, broad auto-triggering, local data retention, and runtime messages are less safe than the documentation claims.

Install only if you are comfortable sending Douyin search terms, profile/video URLs, and a GUAIKEI_API_TOKEN to www.guaikei.com. Treat the token as sensitive, prefer a limited/revocable token, delete generated logs when no longer needed, and avoid using this for confidential research unless the logging and query-string token behavior are fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:104
Finding: API Authentication Token Exposed in URL Query Strings
Content: View full analysis
Remediation: View remediation

other

Note

Location: src/utils/request.js:50
Finding: Runtime Disclosure of Promotional Website and Personal Contact Information
Content: View full analysis
process.exit(exitCode), ); ``` This behavior contradicts the declared runtime policy in `SKILL.md:40-44`, which states that invalid-token handling must use a neutral message and must not emit a webs ...[truncated 2443 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 从代码看，核心行为是调用 /api/douyin/general-search/keyword 和 /api/douyin/general-search/info 两个接口，创建并查询抖音通用关键词搜索任务，返回搜索结果并补充 author_url 与 create_time_str。代码访问的资源与“抖音搜索”一致，但只覆盖声明中的“搜”，并未体现“扒（博主作品）”“翻（评论）”“追（热榜）”。因此，若将这段代码视为该技能实际行为，则其声明描述了更广泛的能力范围，存在描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个覆盖“搜、扒、翻、追”四个动作的综合抖音分析技能，包含搜索、博主作品、评论、热榜等多个场景。当前代码块只实现了其中很窄的一部分：输入博主主页 URL 或 sec_uid，获取该博主作品列表。没有看到搜索抖音内容、抓取评论、读取热榜、判断谁在火等功能。因此代码行为只是声明中的一个子能力，且与声明的整体主用途相比明显更窄，属于描述与实际行为不一致。代码写日志文件属于支持性实现细节，不是主要不匹配点。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容洞察的技能，核心能力应包括搜索抖音内容、查看博主作品、读取评论、追踪热榜等。给出的代码片段却仅实现了通用命令行参数解析与帮助信息生成，没有任何与抖音平台、内容抓取、评论分析、热榜查询或数据访问相关的逻辑。因此代码行为与声明用途在主功能上明显不一致，属于实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向抖音内容搜索/分析的技能，而实际代码片段只具备本地日志写入能力，没有任何抖音搜索、博主作品抓取、评论分析、热榜查询或相关网络访问行为。这不是对主要功能的支撑细节，而是完全不同的能力方向，因此描述与代码行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音内容分析的技能，核心能力应涉及搜索、抓取或分析抖音相关数据。但提供的代码片段只使用 fs 和 path 读取本地 package.json，并返回技能名称。这与声明的主要用途明显不一致。虽然这可能只是辅助代码文件，但基于所给代码片段本身，实际行为与声明能力无直接对应，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向抖音内容搜索、博主分析、评论查看和热榜追踪的业务技能；而给出的代码片段并未体现任何抖音搜索、评论抓取、热榜查询或内容分析能力。实际代码仅处理技能私有TOKEN的格式验证与读取，并在配置错误时打印提示信息。这不是单纯的底层实现细节与业务描述一致的问题，因为当前代码片段展现的唯一功能与声明的核心用途完全不同。不过，这也可能只是配套基础模块而非完整技能，因此从该片段本身判断，描述与行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs activation even when the user does not mention Douyin, which broadens trigger conditions beyond clear user intent. Over-broad auto-invocation can cause unintended third-party data access, surprising external requests, and collection of platform-specific data in contexts where the user did not explicitly consent to using this capability.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Ambiguous generalized trigger guidance increases the chance that the agent invokes this skill for loosely related research tasks without clear platform intent. That can lead to unnecessary exposure of API tokens, unintended outbound calls, and user-surprising data collection behavior, especially because the skill is tied to an external service and credentialed access.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The phrase '纯中文界面' indicates a fixed Chinese-only interface. The file does not offer language choice or explain a justified region-specific requirement, so this appears to impose a locale constraint without user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This manifest-style JSON file uses Chinese-only natural-language titles and descriptions for the schema fields, which can impose a specific language on users without any opt-in or documented locale limitation. Under the policy rules, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The schema explicitly documents video_url as both playback and download addresses, which conflicts with the skill description stating it is not suitable for downloading materials. Even though this file is only a response schema, exposing and normalizing download URLs makes downstream clients more likely to support bulk saving or redistribution of copyrighted media, undermining the stated usage boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title at L004 and property descriptions across the schema. For a generally applicable skill artifact, this imposes a specific language/locale without user opt-in or any documented region-specific justification, which matches the policy-violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema explicitly includes play_addr and describes it as both a playback URL and a video download address, which conflicts with the stated skill boundary that it is not intended for downloading素材. Even if the field is only declarative, exposing and documenting a direct media URL makes downstream misuse for unauthorized downloading materially easier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly states that collected Douyin data is automatically exported to local JSON logs, including search results, author works, and comments, but it does not clearly warn that these files may contain personal or sensitive public data and should be protected. In a competitor benchmarking and comment-analysis skill, silent persistence increases the chance of unintended retention, sharing, or leakage of scraped user data through local files, backups, or source-control commits.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code sends a skill token and a user-supplied Douyin profile URL to remote API endpoints via requestApi, which is a privacy-relevant network operation. Although the functions have technical docstrings, there is no confirmation prompt, warning, or user-facing disclosure in this file indicating that these values will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI persists fetched comment data to a local JSON file after completing what appears to be a read-only analysis action. Comment content can contain personal data, opinions, usernames, or other sensitive business intelligence, and silently retaining it on disk increases the chance of unintended disclosure through shared machines, backups, or later collection by other processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The tool writes comment results to a local JSON file without any user confirmation or obvious warning, creating hidden data retention. In the context of competitor benchmarking and social-comment analysis, the saved file may contain scraped user-generated content and analysis targets that users may not expect to persist locally, increasing privacy, compliance, and operational exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI persists fetched Douyin post results to a local JSON file after execution, even though the skill is described as a read/analysis tool rather than one that stores harvested data. This creates an unnecessary data-retention channel on disk, which can expose scraped content, metadata, and user activity to other local users, backups, or later unintended reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI persists the full search output to a local JSON file, including the searched keyword and returned results, without any runtime notice or opt-in. In this skill’s competitor-benchmarking context, results may contain sensitive business research, account data, or user-generated content that can be exposed to other local users, backups, or later tooling that reads the log directory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This JavaScript code constructs and sends GET and POST HTTPS requests using caller-supplied params and data, which may include user or system information. While there is retry logging for failures, there is no user-facing disclosure, confirmation, or comment warning that request parameters and payloads are transmitted over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JavaScript file contains user-facing validation errors and comments entirely in Chinese, including fixed output such as search-keyword error messages. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The schema title and field descriptions are written entirely in Chinese, which can impose a specific language on users or integrators without any opt-in or documented locale limitation. Under the policy rules, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This JSON schema includes title and description text exclusively in Chinese across the file. Because the file provides no stated locale constraint or user opt-in, it may violate a language/locale policy requiring language choice or explicit regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The schema title and description are written entirely in Chinese, which imposes a specific language on users and downstream tooling without any visible opt-in or justification in this file. Under the policy, locale or language restrictions should either be optional for the user or clearly documented as intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.