Guaikei Kuaishou Data Harvester

• Outcome: Review
• Latest audit: Sep 8, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

The skill appears to collect the public Kuaishou data it advertises, but it needs review because it tells users to print an API token and automatically saves large API results locally.

Install only if you are comfortable sending Kuaishou keywords, profile/video URLs, and your Guaikei API token to the third-party service. Do not print or share `GUAIKEI_API_TOKEN`; use a presence check instead. Treat generated `logs/` files as retained datasets and delete or protect them when they contain comments, creator identifiers, or business-sensitive research.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:280
• Finding: API Token Exposure Through Unsafe Troubleshooting Command## Vulnerability Details **File Location**: `SKILL.md`, line 280 **Vulnerability Type**: Credential disclosure through terminal output **Risk Level**: Medium ### Vulnerable Code ```bash echo $GUAIKEI_API_TOKEN ``` ### Technical Analysis The troubleshooting guidance instructs users or agents to print the complete `GUAIKEI_API_TOKEN` value. Although the application code does not otherwise log the token, this instruction can expose it through terminal scrollback, agent transcripts, continuous-integration logs, screen recordings, command history context, or support material. Printing a secret is unnecessary for determining whether an environment variable is configured. The disclosed token is transmitted as the authentication credential in the `TOKEN` header for requests to `www.guaikei.com`, so possession may allow another party to make authenticated API requests under the affected user's account or quota. ### Attack Path 1. A user encounters an authentication or configuration error. 2. The user or an automated agent follows the troubleshooting instruction. 3. The full API token is printed to the terminal. 4. Terminal output is captured in an agent transcript, build log, screen recording, or support bundle. 5. A party with access to that output extracts the token. 6. The exposed token is reused to submit authenticated API requests until it is revoked or expires. ### Impact Assessment Exploitation does not provide local operating-system privileges or arbitrary code execution. It may grant unauthorized access to the third-party API within the permissions, rate limits, billing scope, and lifetime assigned to the exposed token. Possible effects include quota consumption, unauthorized data requests, and actions being attributed to the legitimate token holder.
• Remediation: ## Remediation Suggestions - Remove all instructions that print the complete token. - Check only whether the variable is present: ```bash test -n "$GUAIKEI_API_TOKEN" && echo configured || echo missing ``` - If token identification is required, display only a masked suffix or a non-reversible fingerprint. - Warn users not to include tokens in logs, screenshots, transcripts, or support requests. - Revoke and rotate any token that has already been printed in a shared or retained environment. - Add automated documentation scanning to reject examples that use `echo`, `printenv`, or equivalent commands on secret variables.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/utils/log.js:33
• Finding: Unconditional Plaintext Retention of Complete API Results## Vulnerability Details **File Location**: `scripts/utils/log.js`, lines 33-34 **Vulnerability Type**: Insecure local storage and excessive data retention **Risk Level**: Low ### Vulnerable Code ```js await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); ``` The affected function is invoked with complete successful response objects by: - `scripts/kuaishou/search-cli.js`, lines 204-207 - `scripts/kuaishou/post-cli.js`, lines 179-182 - `scripts/kuaishou/comment-cli.js`, lines 159-162 ### Technical Analysis Every successful operation automatically writes the complete structured API response to the project-level `logs/` directory. Logging is not opt-in, and the implementation provides no retention limit, automatic deletion, field minimization, or explicit restrictive filesystem mode. The files inherit permissions from the process environment and its umask. In environments with permissive defaults, other local users or processes may be able to read them. The responses can contain collected comments, creator information, video metadata, search terms, and target URLs. Although the Skill states that it processes public Kuaishou data, aggregating and retaining complete datasets creates an additional confidentiality and privacy exposure beyond displaying the requested result. Filenames are sanitized before use, so the reviewed implementation does not expose a confirmed path-traversal vulnerability. ### Attack Path 1. A user performs a search, creator-post retrieval, or comment collection operation. 2. The third-party API returns a successful response. 3. The Skill writes the entire response to a plaintext JSON file under `logs/` without requesting confirmation. 4. The files remain present after the command finishes. 5. A local user, another workspace process, a backup system, or a recipient of an exported project directory obtains access to th ...[truncated 524 chars]
• Remediation: ## Remediation Suggestions - Make result persistence opt-in through an explicit command-line option such as `--output`. - Clearly disclose the output path and retained fields before writing. - Create the logs directory with mode `0700` and result files with mode `0600`, while documenting that platform behavior may vary. - Store only fields necessary for the user's stated purpose rather than the complete API response. - Add configurable retention limits and an automatic deletion mechanism. - Provide a command to securely remove previously generated result files. - Avoid placing logs inside directories likely to be committed, synchronized, archived, or shared; add `logs/` to `.gitignore`. - For higher-sensitivity use cases, support encrypted output with user-managed keys.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README states that all task results are automatically saved to a logs/ directory, but it does not warn users that searched keywords, analyzed profile/video links, comments, and derived marketing data may persist on disk. In a data-harvesting tool, this creates a real risk of unintended local data retention, leakage through backups or shared systems, and exposure of potentially sensitive business intelligence or user-generated content.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly describes bulk collection of Kuaishou search results, creator posts, and comment data, including limits up to 10,000 records, but provides no safeguards, privacy guidance, consent expectations, or platform-compliance warnings. In the context of a data-harvesting skill, that omission materially increases the risk of misuse for unauthorized scraping, profiling, or large-scale collection of user-generated content.

Missing User Warnings

Medium

• Confidence: 73% confidence
• Finding: The CLI stores fetched results to a local JSON file without any explicit user consent or visible warning in this file. This can unintentionally persist potentially sensitive retrieved content or identifiers on disk, creating privacy and data-handling risk on shared systems or environments where users expect retrieval-only behavior.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16