Security audit

guaikei-douyin-videos-for-competitor-benchmarking

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it can broadly trigger Douyin data collection and automatically save creator/comment data locally.

Install only if you intend to send Douyin search terms, creator URLs, and video URLs to the guaikei.com API and are comfortable with local JSON logs of returned public data. Use explicit Douyin-related prompts, delete logs when no longer needed, avoid collecting more comments or posts than necessary, and do not use returned media URLs for downloading or redistribution unless you have rights and platform-policy clearance.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill requires the `GUAIKEI_API_TOKEN` environment variable and explicitly documents env-based token access, but no declared permissions are provided alongside that capability. This creates a transparency and least-privilege gap: an agent or reviewer may not realize the skill depends on sensitive environment data, which can lead to unintended secret exposure or overly permissive execution contexts.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The schema explicitly exposes a direct `play_addr` described as both a playback and download address, which conflicts with the stated skill boundary that it is not intended for downloading素材. Even though this file is only a schema, documenting and normalizing a direct media URL makes downstream misuse easier by enabling agents or users to retrieve raw video assets rather than limiting use to benchmarking or viewing metadata.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI persists fetched comment data to a local JSON file after completing the request, which expands the skill's behavior from transient analysis into local data retention. Even if comments are public, storing them on disk can create unnecessary privacy, compliance, and data-handling risk, especially when users expect read-only benchmarking rather than durable collection.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI persists the full fetched Douyin results to a local JSON file after completing the request, but this storage behavior is not clearly disclosed in the visible user flow. Persisting collected third-party content and metadata can create unintended data retention, expose potentially sensitive business research on shared systems, and expand the blast radius if local files are later accessed by other users or processes.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill says it should trigger even when the user does not mention Douyin, based broadly on short-video research or competitor-analysis intent. That can cause over-activation, where the agent routes unrelated requests into this skill and sends user queries to an external data-collection workflow without sufficiently specific user consent or platform intent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The natural-language routing examples and intent rules are broad enough to match common phrases like '今天什么火', '找 AI 相关视频', or generic '搜索/找', which can cause the agent to invoke this skill in contexts where the user did not clearly request Douyin scraping. Because the skill fetches third-party public data and writes logs automatically, mistaken invocation can trigger unnecessary collection and storage of personal or behavioral data.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The post-retrieval triggers such as '作品 / 主页 / 账号 / 博主' are ambiguous and can match ordinary conversation about creators or accounts without clear consent to scrape a user's full public works. In this skill's context, that ambiguity is more dangerous because the command maps to bulk collection of an account's content history, increasing privacy and surveillance risk beyond a simple search.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README promotes collection of videos, authors, comments, hot-list data, and automatic JSON log export, but it does not clearly warn that outputs may include personal data from creators and commenters. This omission can lead operators to collect, retain, and redistribute identifiable data without appropriate notice, minimization, or handling controls.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code writes fetched results to disk without an explicit user warning or consent, which is a data-handling and privacy weakness even if the content is not highly sensitive. In the context of competitor benchmarking, saved output may contain collected posts and analysis targets whose local persistence could unintentionally disclose research activity or create compliance issues on managed endpoints.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.