T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:101- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-douyin-keyword-search-to-video-list
Security checks for vulnerabilities and agentic risk
Overview
This Douyin data skill is purpose-aligned, but it should be reviewed because it sends the API token in URL query strings and saves collected results locally by default.
Install only if you are comfortable sending your Douyin queries, target URLs or IDs, and GUAIKEI_API_TOKEN to guaikei.com. Treat the token as sensitive, rotate it if exposed, and be aware that successful search, creator-post, and comment results are saved under the skill's logs directory until you delete them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:29- Finding
Collected Douyin Data Persisted with Ambient File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是面向抖音公开数据抓取与分析的业务能力，但实际代码仅是底层通用参数解析模块，属于与抖音无关的基础设施代码。从该代码片段看，不涉及抖音平台访问、数据抓取、评论分析、热榜查询或任何已声明的核心能力。因此，代码行为与声明用途存在明显不匹配。尽管这可能是项目中的辅助文件，但就所提供代码块本身而言，其实际行为与声明描述不一致。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill requires access to the sensitive environment variable
GUAIKEI_API_TOKENbut does not declare an explicit tool/permission scope such asallowed-toolsorpermissions. This weakens least-privilege controls and can let the runtime expose more capability than the skill documentation makes explicit, especially when the skill forwards data to a third-party API.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description, operational guidance, examples, and support instructions are all in Chinese, and there is no statement that users may interact in other languages or that Chinese is required for a documented regional/compliance reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The schema title and field descriptions are entirely in Chinese, which imposes a specific language on users and downstream developers without any visible opt-in or justification in this file. Under the language/locale policy, this is a natural-language policy concern unless the skill explicitly offers language choice or documents a justified regional scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language metadata throughout the schema is written exclusively in Chinese, including the schema title and all field descriptions. For a general schema file, this imposes a specific language without any visible opt-in, alternative locale, or justification that the skill is region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The README states that collected Douyin data is automatically exported as JSON logs, but it does not prominently warn that public-video, author, comment, and hot-list data will be persisted to local disk by default. This can create unintended local retention of scraped content, including potentially sensitive or regulated data such as comments or competitor-monitoring datasets, increasing exposure if the host is shared, backed up, or later compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all operational descriptions in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The function sends the provided token and video URL to an external API via requestApi, which is a data-transmitting network operation. Although the code has developer docstrings, there is no confirmation prompt, user-facing disclosure, or warning text in this file indicating that user data and credentials will be sent to a remote service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JavaScript file contains natural-language comments exclusively in Chinese, including the module description and field documentation. Under the policy, forcing a specific language without user opt-in or documented justification is a locale/language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code persists the full command output, including the requested URL and fetched results, to a file via
log.taskWrite(...). While the script logs progress to the console, there is no explicit disclosure that data will be saved locally, no confirmation prompt, and no inline warning near the write operation.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI writes full search output, including requested keywords and returned results, to a local file by default. In a data-retrieval skill, this creates an undocumented persistence channel that can expose potentially sensitive research terms or collected public data to other local users, backup systems, or later compromise of the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Search results are saved locally without an explicit user warning, confirmation, or opt-in control. Even when the source data is public, automatic local persistence can violate user expectations and increase privacy and data-handling risk, especially for sensitive search topics or regulated environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The AuthError string forces Chinese-language guidance, including remediation text, for all users. This is a natural-language locale policy issue because the file does not provide any user language selection, fallback, or justification for restricting output to a single language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file uses Chinese-only natural-language comments, examples, and user-facing error messages, such as the validation errors and keyword examples. Under the policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The title and descriptions in this schema are entirely Chinese-language strings, and the file does not indicate that the skill is China/Chinese-specific or that users can opt into another language. Under the policy for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON schema uses Chinese for the top-level title/description and all property descriptions, which imposes a specific language in natural-language metadata. The file provides no indication that the locale is optional, configurable, or intentionally limited to a Chinese-only audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON schema contains user-facing title and description fields exclusively in Chinese, which effectively forces a specific language for users without any opt-in or explanation. The stated policy flags language or locale constraints when the skill does not offer a language choice or document a justified regional scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This JSON schema uses Chinese-only natural-language title and description strings, which can amount to a locale/language policy issue when no user opt-in or region-specific justification is provided. Because the file is a manifest/config-type artifact and contains only Chinese-facing metadata, users in other locales are not offered a language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON schema is a manifest-type file, so natural-language policy checks apply. The title and descriptions are entirely in Chinese, which imposes a specific language/locale on users without any opt-in or documented justification that the skill is intentionally region-specific.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This is a manifest file, so vague-trigger review applies. The description lists broad capabilities like keyword search, creator scraping, and hot-list retrieval, but provides no specificity about invocation conditions, allowed contexts, or boundaries, which can make matching or activation overly broad if the manifest is used for skill discovery.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. Nearly all operational instructions and natural-language command mappings are provided only in Chinese, with no indication that users may choose another language or that the locale restriction is required for a justified regional-compliance reason.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file presents all user-facing instructions and parameter descriptions in Chinese only. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file's natural-language strings and comments are entirely in Chinese, including user-facing operation labels such as '创建任务' and '查询任务'. If these strings are surfaced to users, this enforces a specific language without any visible opt-in or locale selection mechanism.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file’s natural-language content, including the module description and function documentation, is entirely in Chinese. Under the policy rules, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code sends a token and user-provided search keyword to a remote API via requestApi, which is a network operation covered by the warning requirement for code files. Although the function docstrings describe parameters and API failure behavior, they do not disclose to a user that their token and query data will be transmitted externally, and there is no confirmation or user-facing logging in this file.
- Content
Static analysis
No suspicious patterns detected.