Security audit

guaikei-kuaishou-live-data-fetcher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Kuaishou public-data research tool that calls a third-party API with a user token and saves returned results locally.

Before installing, understand that your Kuaishou keywords or URLs and the API token are sent to guaikei.com, and successful results are saved locally under logs. Use it only for public Kuaishou data and delete saved result files if they contain comments or metadata you do not want retained.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a domain-specific Kuaishou/Kwai analytics and research skill. However, the supplied code only implements reusable CLI infrastructure (argument parsing and help text generation). This is not merely a supporting implementation detail if evaluated as the provided code chunk's actual behavior: it does not itself access Kuaishou data, analyze content, inspect hot lists, research works, or perform trend/competitor analysis. No suspicious extra capability is present, but the actual code's primary purpose is materially different from the declared skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, this is a mismatch. The declared description promises substantial Kuaishou/Kwai analytics and research functionality, but the provided code chunk is only a small utility that reads package.json from disk to obtain the package name. While utility code can be part of a larger skill, based on this chunk alone the behavior shown is unrelated to the declared end-user purpose and does not implement any of the advertised capabilities.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description explicitly claims coverage of '快手热榜' and broad trend research, but the detailed capability boundary later states the skill '当前只覆盖 3 类能力' limited to keyword search, creator works, and video comments. That is a semantic mismatch between the declared scope in the manifest and the skill behavior/documented routing actually provided.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The heading labels the skill as '快手直播数据采集', which implies live-stream data collection. However, the surrounding documentation and routing only describe short-video keyword search, creator profile works, and video comments; there is no live-stream-specific capability described here, so the documentation contradicts itself about the skill's actual intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that all task results are automatically saved to a logs directory, but it does not clearly warn users that fetched platform data, URLs, keywords, or comment content may be persisted locally. In a data-collection skill, silent retention increases the risk of unintended storage, later disclosure, and noncompliant handling of scraped data, especially on shared machines or CI environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The error message string is hardcoded in Chinese, which indicates the skill presents output in a specific language without offering user opt-in or documenting a justified locale restriction. This is a natural-language policy concern because the file contains user-visible text that enforces a language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The thrown error message is hardcoded in Chinese and does not indicate any user opt-in or region-specific justification for the language restriction. Hardcoded single-language messaging can violate language/locale policy when no alternative or explicit constraint is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This retry error output is hardcoded in Chinese, again enforcing a specific language for user-visible messaging with no sign of opt-in or documented regional scope. Repeated hardcoded locale-specific strings indicate a policy issue rather than an isolated implementation detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code sends a user-provided url and an authentication token to /api/kuaishou/post/url, which is a safety-relevant network operation involving potentially sensitive data. Although retry errors are logged, there is no confirmation prompt, user-facing disclosure, or explanatory comment/docstring in this file warning that the skill transmits these values to a remote API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The getJson call transmits url, sort, limit, and token to a remote endpoint, which can affect user privacy and system trust if done silently. This file contains retry-error logging but no user-facing notice, confirmation, or descriptive comment explaining that these values are sent over the network.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The CLI persists fetched comment data to a local JSON file after successful execution, but this file does not clearly warn the user that potentially sensitive third-party content will be stored on disk. Local persistence increases exposure through unintended retention, other local users/processes, backups, or later exfiltration, especially because comments may contain personal or sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script writes full comment results to a local JSON file without explicit notice in this file's interface or help output. Silent persistence can surprise users and create privacy/compliance issues because comment content and metadata may remain on disk longer than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CLI persists scraped results to a local JSON file automatically after completion, but does not clearly warn users that potentially sensitive or regulated data will be stored on disk. In a data-collection skill, silent persistence increases the risk of unintended retention, local disclosure to other users/processes, and compliance/privacy issues if the fetched content includes account or content metadata tied to individuals.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file contains natural-language comments, error messages, and CLI help text exclusively in Chinese, including thrown errors and usage output. Because the skill forces a specific language for user-facing interaction without offering a locale choice or documenting a justified regional constraint, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code performs outbound HTTPS requests, sending request parameters, JSON payloads, and a TOKEN header to a remote host. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that user or system data and credentials may be transmitted over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code emits user-facing warning and info strings only in Chinese ("警告..." and "已使用配置的私有TOKEN"). The file does not provide any user opt-in, locale selection, or documented justification for restricting output to a specific language, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JavaScript file contains multiple user-facing error strings in Chinese, such as the validation errors printed via utils.printError. Because the skill forces a specific language in its natural-language output without any visible opt-in or documented locale restriction in this file, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The package description is written entirely in Chinese and provides no indication that other languages or locales are supported. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The changelog title is entirely in Chinese for the skill name and does not indicate any language choice or opt-in. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all operational instructions and examples in Chinese, and does not provide an opt-in language choice or indicate that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The manifest only describes Kuaishou data analysis and research use cases, but this file reads process.env.GUAIKEI_API_TOKEN to obtain an external service credential. While authentication may be implementation-related, the manifest does not indicate credential handling or dependence on a separate API service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The CLI writes the full search output to a local JSON file, including the user-provided keyword and returned results, without any indication in the stated skill purpose that data will be persisted locally. This creates a privacy and data-handling risk because potentially sensitive research terms and fetched content may remain on disk longer than expected, be accessible to other local users/processes, or be unintentionally collected in backups and logs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code emits user-facing error messages in Chinese only, and the success/error strings throughout the file are likewise fixed to that locale. For a general utility file, that is a natural-language locale policy issue because users are not given a language choice and no region-specific justification is documented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Multiple user-visible error messages are hard-coded in Chinese, such as 请求失败, 响应解析失败, and token validation guidance. This imposes a specific language on users without any opt-in or documented locale constraint.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:15