ClawHub
Back to skill

Security audit

guaikei-kuaishou-creator-work-fetcher

Security checks across malware telemetry and agentic risk

Overview

This skill coherently fetches public Kuaishou data through a disclosed third-party API and saves results locally, with no evidence of hidden or destructive behavior.

Install only if you are comfortable sending Kuaishou search terms, profile/video URLs, and your GUAIKEI_API_TOKEN to guaikei.com. Review or delete the generated logs directory after sensitive research tasks, especially when collecting large comment datasets.

A.I.G

By Tencent
Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README states that all task results are automatically saved to the logs/ directory, but it does not warn users that harvested public-platform data, URLs, comments, and analysis outputs may persist locally beyond the session. This creates a real data-retention risk: saved logs can expose collected content to other local users, backups, or later accidental disclosure, especially because the tool is designed for bulk scraping and comment analysis.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:15