Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Kuaishou public-data collection tool that uses a Guaikei API token and saves local JSON logs, with no evidence of hidden execution, persistence, or destructive behavior.
Install only if you are comfortable sending Kuaishou keywords, profile/video URLs, requested limits, and your GUAIKEI_API_TOKEN to the Guaikei service. Treat generated logs as retained local business or social-media research data and delete or protect them if they contain sensitive competitive analysis.
This code persists the full command output, including the requested URL and returned comment results, to disk via log.taskWrite. Although the script prints progress messages, there is no clear user-facing warning, confirmation, comment, or docstring in this file disclosing that data will be saved locally.
Lines L183-L186 persist the full output, including request metadata and results, to disk via log.taskWrite. Although the script logs progress and prints output, there is no user-facing warning here that a local file will also be created, and the operation is not otherwise disclosed in comments or docstrings in this file.
This code persists the full search output to disk via log.taskWrite, which may store user-provided keywords and returned results locally. While the script logs progress for search execution, it does not disclose that a file will be created or where data will be stored before performing the write.
This code emits user-facing error messages in Chinese only, such as "日志文件名必须是非空字符串" and "日志内容必须是非空字符串". The file provides no indication that the skill is China-specific or that users can choose their language, which violates the policy against forcing a specific language without opt-in.
The success and failure messages shown to users are hard-coded in Chinese only: "已保存到" and "日志写入失败". Because there is no opt-in, fallback language handling, or documentation justifying a Chinese-only locale, this is a natural-language policy violation.
The error message explicitly tells the operator to check the GUAIKEI_API_TOKEN environment variable, and the request headers use a TOKEN credential for API access. There is no nearby comment, docstring, or user-facing notice explaining that the skill depends on and uses a sensitive token.
With no manifest available, there is no stated purpose that would justify this helper's ability to make arbitrary GET and POST HTTPS requests to a remote host and attach a TOKEN header. This introduces a broad network communication capability that may be unrelated to the intended function of the surrounding skill.
This code performs outbound HTTPS GET/POST requests and includes a TOKEN header plus request data, which can transmit user or system data to a remote service. In this file there is no confirmation prompt, user-facing log, or explanatory comment/docstring disclosing that network transmission and token use occur.
This JavaScript file contains multiple user-facing error strings in Chinese, such as at L05, L10, L14, and L18, with no indication that the skill is intentionally limited to a Chinese-speaking audience or that users can choose another language. That creates a natural-language policy concern because the skill effectively forces a specific language without user opt-in.
The manifest description is written entirely in Chinese and does not indicate that the skill is intended only for Chinese-speaking users or that language selection is configurable. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.
The README states that all task results are automatically saved to the logs/ directory, but it does not warn users that searched keywords, target profile URLs, video URLs, comments, and derived analytics may persist locally. In a data-collection tool focused on competitor monitoring and comment analysis, this can expose sensitive business intelligence or user-generated content to other local users, backups, or accidental sharing.
The title is presented entirely in Chinese and provides no indication that users can choose another language or locale. This can violate language-choice policy when a skill appears to mandate one language without documenting opt-in or regional justification.
The file’s natural-language instructions, headings, parameter descriptions, and examples are all presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill's descriptions and help examples are presented only in Chinese, and the rest of the script also uses Chinese-only user-facing output. That effectively forces a specific language/locale without any visible opt-in or documented regional constraint in this file.
Natural-language strings for flags, examples, errors, and warnings are all Chinese, which effectively forces a specific language for users. There is no indication that the tool is intentionally region-specific or that users can select another language/locale.
This JavaScript file uses Chinese exclusively in comments, thrown error messages, and generated help text, which creates a natural-language locale constraint for users of the CLI. The file does not offer any language choice or explain that the tool is intentionally limited to a Chinese-speaking context.
The 401/403 error path embeds an unrelated external contact channel (a phone/WeChat number) directly in runtime error messages. This creates a social-engineering vector by steering operators toward an off-platform contact during an authentication failure, which is not necessary for secure error handling and is especially suspicious in an agent skill.
The thrown error string on L21 is hard-coded in Chinese ("重试...次后失败"). This creates a language policy issue because the file does not offer a language choice or document that the skill is intended only for Chinese-speaking users or a China-specific context.
This code presents user-facing warning and info messages only in Chinese (for example, the warning about GUAIKEI_API_TOKEN and the info log about using a private token). That creates a language policy concern because the skill imposes a specific language on users without any visible opt-in or alternative locale handling.
