Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Kuaishou public-data fetcher that sends user-provided search terms or links to a third-party API and saves returned results locally.
Install only if you are comfortable sending Kuaishou keywords, profile URLs, video URLs, and your GUAIKEI_API_TOKEN to guaikei.com. Treat returned posts and comments as user-generated public data: follow platform terms and applicable privacy rules, and remember that successful runs are saved locally in logs.
The primary description is written as Chinese-first and presents the skill's behavior and usage context entirely in Chinese, with no indication that users may choose another language or locale. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.
The manifest description is entirely in Chinese, which may impose a language-specific experience without any indication that users can choose another language or that the skill is intended only for a Chinese-speaking audience. The policy allows locale constraints when they are explicitly justified, but no such justification appears here.
The document provides detailed commands for collecting large amounts of public Kuaishou content, creator posts, and comments, including limits up to 10,000 records, but gives no warning about privacy expectations, platform terms of service, or rate/volume impact. In a scraping-oriented skill, this omission increases the likelihood of misuse for mass collection, profiling, or non-compliant harvesting of user-generated data.
The retry log message is hard-coded in Chinese, which imposes a specific language in user-visible output. The file provides no opt-in, localization option, or indication that the skill is intentionally limited to a Chinese-speaking or region-specific context.
The thrown error message is hard-coded in Chinese, making the skill's natural-language behavior dependent on a single locale. There is no evidence in this file that users can choose their language or that the restriction is justified as a region-specific tool.
This retry status string is also hard-coded in Chinese and appears in operational output. Without a documented locale restriction or language choice, this conflicts with the policy against forcing a specific language.
No manifest is available, so there is no declared purpose that would justify sensitive credential access. This script pulls GUAIKEI_API_TOKEN from the environment to perform its work, which is a capability with security significance that cannot be validated against any stated scope.
With no manifest or declared purpose, local persistence is an additional capability beyond simply returning comment data to stdout. The code derives a filename from the URL and writes the full result payload to disk, which is a material side effect that should be explicitly justified.
The script silently persists retrieved comment data to disk without explicit user notice or consent at execution time. If comments contain personal data or sensitive content, this can create unintended local retention, exposure to other local users/processes, and compliance/privacy issues.
The CLI writes the full retrieved results to a local JSON file named from user-derived data without any explicit warning, confirmation, or opt-in. If the fetched post data contains personal, sensitive, or copyrighted content, this creates an unexpected at-rest data exposure risk on the local system, especially in shared environments or automated pipelines where users may not realize data is being persisted.
Natural-language strings such as flag descriptions, examples, and warnings are presented only in Chinese, which forces a specific language for users. The file does not offer any locale selection, fallback, or opt-in mechanism that would make this language constraint explicit and optional.
This code contains user-visible error messages, comments describing CLI usage, and generated help text entirely in Chinese, which effectively forces a specific language for end users. Under the policy, language constraints should either be optional/opt-in or clearly documented and justified as region-specific.
This code emits all user-facing validation and status messages in Chinese, and the same pattern continues in later strings. For a generally scoped utility file, forcing a specific language without offering a user choice or documenting a justified locale restriction is a natural-language policy violation.
This code performs an outbound HTTPS POST and includes a TOKEN header plus serialized request data, but there is no confirmation prompt, logging, comment, or docstring disclosing that user or system data may be sent to a remote service. For code files, outbound network transmission without any visible warning qualifies when the disclosure is absent and the purpose is not explicitly documented here.
This function makes an outbound HTTPS GET request and transmits a TOKEN header together with query parameters, including a skill identifier, but the file provides no visible disclosure through comments, docstrings, prompts, or logging. Under the code-file criteria, network calls that transmit system or user data should have some form of user disclosure unless clearly documented as the skill's stated purpose.
This JavaScript file contains user-facing warning and info strings only in Chinese, which can force a specific language experience on users without opt-in. The policy allows locale constraints only when clearly documented and justified, which is not evident here.
This code emits all validation errors exclusively in Chinese via string literals such as '搜索关键词不能为空' and similar messages. That imposes a specific language on users without offering a language/locale selection or documenting a justified region-specific constraint, which matches the language-policy violation criteria.
This is a manifest file, so vague-trigger checks apply. The description broadly markets a 'professional Kuaishou data analysis tool' for growth, monitoring, and marketing, but does not define specific activation phrases, contexts, or non-applicable cases, which could contribute to overly broad invocation matching in systems that use manifest descriptions for routing.
The README presents all user-facing instructions and operational details only in Chinese. Under the policy, forcing a specific language without giving the user a language or locale choice is a natural-language policy violation.
The natural-language content, parameter descriptions, and examples are all presented in Chinese, which can amount to a language/locale restriction when no alternative language or opt-in is provided. The policy guidance says to flag cases where a skill forces a specific language without user opt-in unless the locale constraint is clearly documented and justified.
The function sends a user-provided URL to a remote API via postJson and authenticates with a token, which is a network operation involving potentially sensitive user or system data. While retry errors are logged, there is no confirmation prompt, comment, docstring, or other user-facing disclosure in this file explaining that this data is transmitted.
This code performs a network request to /api/kuaishou/comment/info, transmitting the supplied URL and token to a remote service. The file contains retry error logging but no user-facing warning, comment, or docstring disclosing that external data transmission occurs.
The retry error message string is hard-coded in Chinese, which imposes a specific language on users/operators without any visible choice or locale configuration in this file. Under the policy, fixed language output without opt-in or documented justification is a natural-language locale violation.
This file contains multiple user-visible messages in Chinese, including the format error and query retry text, with no indication that users can select their preferred language. That creates a locale-specific behavior that is not clearly justified in the file.
This code persists the full search output to disk via log.taskWrite(...), which is a file-write operation covered by the warning requirement for code files. While the script prints progress and mentions token setup in help text, it does not clearly disclose to the user that search requests and results will be saved locally.
