Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate Kuaishou public-data research CLI that sends requested queries to GuaiKei and saves results locally, with no hidden persistence or destructive behavior found.
Before installing, confirm you are comfortable sharing Kuaishou search terms, URLs/IDs, options, and your GUAIKEI_API_TOKEN with the GuaiKei API service. Also remember that fetched results are saved locally under logs, so delete those files when the research data should not be retained.
The primary natural-language description is written as a Chinese-first invocation and usage description, and the rest of the skill instructions are effectively Chinese-only for operation details. There is no explicit user opt-in or language selection mechanism, which can violate a language/locale policy requiring user choice.
The manifest description is written entirely in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language or locale policy when a skill appears to assume a specific language without user opt-in or documented justification.
The README states that all task results are automatically saved to a local logs directory, and the tool is designed to collect comments, account data, and interaction metrics. Even if the source data is public, automatic retention without a clear warning, data minimization guidance, or storage controls can expose sensitive research targets, comment content, or operational intelligence to other local users, backups, or downstream sharing.
The file's natural-language content is entirely in Chinese, including the title and changelog entries, with no indication that the skill supports other languages or that Chinese-only output is an intentional, justified locale constraint. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown file presents all instructions, parameter descriptions, and examples only in Chinese. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
This code hard-codes Chinese-only descriptions and messages in the CLI interface, including argument help text and operational status output. Because the file provides no opt-in, fallback, or documentation that the skill is intentionally region-specific, it violates the language/locale policy criteria.
The script persists the full output to disk via log.taskWrite(...), which can affect user data handling and local system state. While the code logs progress for network activity, there is no user-facing disclosure here that results will be saved to a file, nor any confirmation before the write occurs.
The file's natural-language content visible to users is entirely in Chinese, including error messages and help text. Because this code does not offer a language selection mechanism or document that the skill is intentionally limited to a Chinese-speaking context, it may violate the language/locale policy for skills that should not force a specific language without user opt-in.
This code performs outbound HTTPS requests and sends both a TOKEN header and JSON payload to a remote host, which is a safety-relevant data transmission operation for code files. There is no confirmation prompt, user-facing log, or explanatory comment/docstring in this file disclosing that user or system data may be sent over the network.
The GET helper constructs a query string from params and sends it to a remote host together with a TOKEN header, which may transmit user or system-derived data. In this file there is no user-facing warning, prompt, or explanatory comment indicating that these parameters are sent externally.
The warning and info strings are hard-coded in Chinese, which imposes a specific language on users without any opt-in or indication that this module is intentionally region-specific. This matches the language/locale policy concern for natural-language content in code files.
This code emits multiple user-facing validation errors exclusively in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking context. The policy for natural-language violations applies to code files as well, including string literals.
This manifest file describes the skill in broad marketing terms as a professional Kuaishou data analysis tool, but it does not specify how or when the skill should be invoked, nor does it provide trigger boundaries or exclusion conditions. In manifest files, missing specificity about invocation scope can lead to overly broad or unintended activation.
The natural-language instructions and user-facing documentation are exclusively in Chinese, which effectively forces a specific language for use of the skill. The file does not mention that the skill is China-region-specific or offer any opt-in or alternative language support.
The calls to createSearchTask and getSearchTask transmit the user's search keyword and related parameters over the network. The help text mentions the required API token but does not warn users that their query data will be sent to an external service.
This code persists the full search output to disk via log.taskWrite, which is a file-write operation affecting user data and local system state. Although the script logs progress for the search itself, it does not disclose that results will also be saved to a file.
This code emits user-facing error messages in Chinese only (for example at L07 and L11), which imposes a specific language on users without offering any choice. The policy explicitly flags language or locale constraints when they are forced without opt-in.
Multiple error strings are written only in Chinese, including user-directed remediation text, which can impose a fixed language experience regardless of user preference. The file does not show any locale choice, fallback, or opt-in mechanism to justify this constraint.
The thrown error string is hard-coded in Chinese (重试${maxAttempts}次后失败), which imposes a specific language in user-visible output. This can violate language/locale policy when the skill does not offer localization or document that it is intentionally Chinese-only.
