Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a legitimate Kuaishou public-data tool that uses a disclosed third-party API and saves fetched results locally.
Install only if you are comfortable sending Kuaishou keywords, profile/video identifiers, and your GUAIKEI API token to guaikei.com. Review or delete files in the local logs directory when results include comments, creator data, or business research you do not want retained on disk.
For markdown files, missing-warning findings apply when the skill description omits warnings about behaviors that could affect user data or system integrity. L84 states that all task results are automatically saved, but the surrounding documentation does not clearly warn users that analyzed URLs, keywords, comments, and result data will be persisted locally and may need handling or cleanup.
This markdown file presents all usage instructions, parameter descriptions, and examples exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The retry/error message literals are hard-coded in Chinese, which indicates a fixed language choice in user-visible output. The file does not provide an opt-in, localization mechanism, or documentation that this skill is intentionally restricted to a Chinese-language context.
The thrown error message is written only in Chinese, creating another instance of fixed-language user-visible output. Without an explicit locale justification or user choice, this can conflict with organizational language/locale policy requirements.
This retry/error log message is also hard-coded in Chinese and appears intended for user/operator visibility. The file contains no indication that users can choose their language or that the skill is explicitly limited to a Chinese-language environment.
The CLI silently persists fetched comment data to a local JSON file after execution, which may store personal data or sensitive content longer than the user expects. In a data-collection skill, undisclosed persistence increases privacy and data-handling risk, especially on shared systems or when the output directory is later synced, backed up, or exposed.
The CLI sends a user-supplied profile URL together with an API token to external API methods (createPostTask and getPostTask) without any explicit notice or consent prompt about outbound network transmission. While this is functionally expected for a data-fetching tool, the lack of transparency can expose users to unintended disclosure of queried targets and credential use, especially in automated or embedded contexts.
The script writes fetched results to a local JSON file via log.taskWrite without clearly informing the user that retrieved profile-related data will be persisted on disk. This can create unintended local data retention, increasing exposure if the host is shared, monitored, or later compromised.
This code sends a credential-like value in the TOKEN header and transmits serialized request data over the network, but the file contains no user-facing log, prompt, comment, or docstring disclosing that behavior. For code files, network calls that transmit user or system data should be flagged when there is no visible warning and the disclosure is not evident in the file itself.
The GET helper sends a TOKEN header and query parameters, including skill metadata, to a remote host, but there is no confirmation, logging, comment, or docstring explaining that outbound transmission. Under the code-file criteria, network calls that may transmit user or system data should have some form of disclosure unless already clearly documented elsewhere.
The package description is entirely in Chinese, which imposes a specific language in user-facing metadata without offering any language choice or indicating that the skill is intentionally region-specific. Under the stated policy, language/locale constraints should be opt-in or clearly justified.
SQP-3 applies to natural-language policy violations, including forcing a specific language without user opt-in. This README is entirely Chinese and provides no note that the skill supports other languages or that the locale restriction is intentional and justified, which may conflict with organizational language-choice policies.
The entire changelog is presented only in Chinese, and there is no indication that the skill supports user language choice or that the locale restriction is intentional and justified. This can violate language/locale policy when users are not given an opt-in or alternative.
With no manifest or declared purpose, this file presents itself only as a comment-fetching CLI via its argument/help text, but it also depends on a secret from process environment and performs authenticated external operations. In the absence of any declared scope, this networked/authenticated capability is not justified by a stated purpose and should be surfaced for review.
The script's help output and status messages are consistently presented in Chinese, such as the flag description at L018 and other printed strings throughout the file. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
This code persists the full search output, including request metadata and results, to disk via log.taskWrite(...). Although the CLI help mentions token configuration, it does not warn that searches and returned data will be saved locally, and there is no confirmation prompt or user-facing disclosure immediately before the write.
This JavaScript file contains natural-language comments, errors, warnings, and help output entirely in Chinese, including user-facing CLI messages such as missing-argument errors and help text. Under the policy rule for language/locale, this is a violation because the skill enforces a specific language without any opt-in or documented locale constraint.
The code emits user-facing error messages in Chinese only (for example at L07 and L11), and also continues this pattern in later success/error output. This imposes a specific language on all users without offering a choice or documenting a locale-specific constraint, which matches the language/locale policy violation criteria.
The embedded error string is entirely in Chinese and instructs the user to take follow-up action in that language, with no indication of locale choice or opt-in. This can violate the language/locale policy for skills that should not force a specific language without user selection or clear regional justification.
The thrown error string is hardcoded in Chinese (重试${maxAttempts}次后失败). For a general-purpose utility file, forcing a specific language in user-visible text can conflict with organizational language/locale policies when no user choice or justification is provided.
The code emits warning and info messages only in Chinese, which imposes a specific language on users without any visible opt-in or indication that the skill is intended solely for a Chinese-speaking context. This matches the policy concern for language/locale constraints expressed in natural-language strings.
This file contains user-facing text exclusively in Chinese, including the module description and banner content. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint can be a natural-language policy violation.
This code emits multiple user-facing error messages only in Chinese, such as at L05, L10, L14, L18, L23, L50, L54, L59, and L64. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not evident in this file.
