T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:91- Finding
API Token Exposed Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-videos-for-research
Security checks for vulnerabilities and agentic risk
Overview
This Douyin research skill mostly does what it says, but it needs review because it can activate on vague requests, sends its API token in request URLs, and automatically stores research results locally.
Install only if you are comfortable sending Douyin research requests to Guaikei with your GUAIKEI_API_TOKEN and keeping generated JSON result files on disk. Use it only for explicit Douyin tasks, review or delete the logs directory after use, avoid sensitive investigation keywords, and rotate the token if you suspect request URLs may have been logged outside your control.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/log.js:5- Finding
Automatic Plaintext Storage of Complete Research Results
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.slice(0, 200); } if (!safeFilename) { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); ...[truncated 2929 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个覆盖多项抖音数据获取能力的综合技能，但提供的代码片段只涉及“关键词搜抖音”这一项：调用 /api/douyin/general-search/keyword 创建搜索任务，调用 /api/douyin/general-search/info 获取搜索结果，并处理返回数据。代码中没有任何与博主作品抓取、视频评论获取、实时热榜查询相关的接口、数据结构或逻辑。因此，代码实际行为仅覆盖声明中的一部分，且缺少其余核心能力，构成描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个面向抖音内容检索与信息抓取的技能，核心能力应涉及抖音搜索、博主作品拉取、评论查询或热榜获取。但提供的代码仅是通用参数解析模块，负责处理命令行选项、必填校验、默认值和帮助文本生成，属于底层工具代码。虽然这类工具代码可能作为更大系统的辅助组件存在，但就当前代码片段本身而言，其实际行为与声明的技能用途没有直接对应关系，也未展示任何抖音相关业务能力，因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是面向抖音数据获取/分析的功能，而提供的代码片段实际只是一个本地日志写入辅助模块，没有任何抖音搜索、博主作品抓取、评论拉取、热榜查询或网络请求相关行为。虽然日志记录可能属于支持性实现细节，但该片段本身的唯一可见行为是写入本地文件，这与声明的主要用途没有直接对应关系，并且涉及未声明的本地文件系统访问能力。因此可判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill is for Douyin content discovery and analysis. The supplied code chunk does not implement any of those behaviors; it merely accesses the local filesystem to read package.json and return the package name. While this could be a harmless utility helper, based on the provided chunk alone the actual behavior is materially unrelated to the declared end-user purpose, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是面向抖音内容搜索、评论抓取、博主作品采集和热榜查询的业务能力，但提供的代码片段并未执行任何与抖音、视频、评论、热榜或内容分析相关的操作。它的实际作用只是本地 TOKEN 格式验证和提示配置私有 TOKEN，属于配套鉴权/配置模块。若仅把它视为整个技能的辅助实现细节，这段代码本身并不危险；但就“描述是否准确代表该代码块实际行为”而言，二者明显不一致，因为代码的直接行为与声明的核心功能无关，且还包含未声明的营销推广输出。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims it should activate even for generic phrases like “查一下” or “帮我看看” without the user mentioning Douyin. That overly broad trigger scope can cause unintended invocation, sending unrelated user requests, URLs, or text into a third-party data-collection workflow and increasing the chance of unnecessary external queries or credentialed actions.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Saying the skill should be used even if the user never mentions “抖音” makes invocation ambiguous and increases the risk of the agent routing unrelated requests into this skill. In context, this is more dangerous because the skill uses an API token and can perform external data retrieval, so accidental activation may leak user intent or trigger unnecessary authenticated operations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly relies on the environment variable
GUAIKEI_API_TOKEN, but the manifest does not declare any tool scope, permissions, or allowed-tools boundaries. That creates hidden capability exposure: an orchestrator or reviewer cannot tell from the top-level declaration that the skill requires environment access and may invoke local Node processes with token-bearing context.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON schema uses Chinese-only natural-language strings for the title and field descriptions, which can impose a specific language on users without any opt-in or documented locale justification. Under the policy, language constraints should either offer user choice or clearly state that the skill is intended for a specific locale.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest explicitly states '不负责发布、剪辑或下载视频' (not responsible for publishing, editing, or downloading videos). However, the schema describes
video_urlas containing both playback addresses and video download addresses, which expands the skill's described behavior into download-related functionality.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest explicitly limits scope by stating the skill does not handle video downloading. This schema describes
play_addras both a playback address and a '视频下载地址', indicating the skill's defined output includes a direct download URL, which expands beyond the stated read/research-only scope.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README explicitly states that scraped Douyin data and comments are automatically exported to local JSON log files, but it does not warn that these files may contain sensitive or personal data and could persist on disk longer than intended. In a scraping/research skill, silent local retention increases the chance of accidental disclosure, insecure sharing, or misuse of collected account/comment data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI persists fetched comment results to a local JSON file, which effectively creates a downloaded copy of third-party content. This contradicts the stated skill behavior of only performing lookup/research and not downloading, and can expose potentially sensitive or regulated user-generated content to unintended local retention, later access, or reuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript skill contains user-facing natural-language strings such as status messages and errors entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not evident in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The command's descriptions, help examples, status messages, and error text are all presented in Chinese, with no indication of locale selection or opt-in. Under the policy rule, forcing a specific language without offering a language or locale choice is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest frames the skill as a one-shot research/query capability for searching Douyin content, fetching creator works, comments, and hot lists. Here, after producing output, the code additionally writes the full results to disk via
log.taskWrite, which is a behavioral expansion beyond simple retrieval/output and is not disclosed in the description.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code contains user-visible status and error strings in Chinese (for example on L07 and L11), which enforces a specific language for interaction. Under the policy, hard-coding a language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The success and failure messages on L36-L38 are also presented only in Chinese, with no indication that users can choose another language. This creates the same language-policy issue for operational feedback during file writes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The authentication error string is written only in Chinese and instructs the user to contact a specific WeChat number, with no language or locale opt-in. This creates a natural-language locale policy issue because the skill imposes a single language for a user-facing message without documenting that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code emits all user-facing status and warning messages only in Chinese, which enforces a specific language for user interaction. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which is present in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s user-facing strings, comments, examples, and formatted output are entirely in Chinese, including validation errors and the final search-result message. This creates a locale/language constraint in the skill behavior without offering the user any language choice or documenting that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The schema title and description are written only in Chinese, which implies a fixed language choice in the skill artifact without any visible opt-in or explanation that the skill is region-specific. Under the policy rule, forcing a specific language or locale without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The title and description fields are natural-language metadata and they appear exclusively in Chinese. Because this file does not document that the schema is intentionally Chinese-only or region-specific, it may impose a language constraint without user opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON schema uses Chinese-only natural-language title and description fields for the skill and its parameters. Because the file provides no opt-in, alternative locale, or documented region-specific justification, it can violate the language/locale policy against forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema uses Chinese-only title and description text, and the field descriptions throughout the file are likewise fixed to a single language. For a generally reusable schema file, this is a natural-language locale constraint with no user opt-in or documented justification, which matches the policy-violation category.
- Content