Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Kuaishou public-data lookup tool that uses a third-party API token and saves task outputs locally.
Install only if you are comfortable sending Kuaishou search terms, profile URLs, video URLs, and query parameters to guaikei.com with your GUAIKEI_API_TOKEN. Treat the local logs directory as retained analysis data and delete or protect it if the queried topics, profiles, or comments are sensitive.
The package description is entirely in Chinese, which implies a fixed language experience without offering any language choice or documenting that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The package presents itself as a competitor-analysis and monitoring tool, but the exposed npm scripts also enable posting and commenting actions. This mismatch expands the operational capability from passive analysis to active account interaction, which can enable spam, impersonation, or undisclosed automation without clear disclosure to users reviewing only the metadata.
The README states that all task results are automatically saved to a local logs/ directory, but it does not clearly warn users that scraped keywords, profile URLs, comment data, and analysis outputs may persist on disk. This creates a real data persistence and privacy risk, especially on shared workstations or team environments where local files may be retained, synced, or exposed beyond the intended user.
This markdown file presents all usage instructions, parameter descriptions, and examples only in Chinese. Under the language/locale policy, forcing a single language without user opt-in or a documented region-specific justification is a natural-language policy violation.
The script persists the full command output, including requested URL and fetched comments, via log.taskWrite(...). While the file prints status messages, there is no explicit disclosure here that fetched data will be stored on disk, and file writes are a safety-relevant operation under the rule.
The script reads an API token from the environment and sends the normalized profile URL plus parameters to remote post APIs through createPostTask/getPostTask. Although the CLI indicates it is fetching posts, this file does not explicitly warn the user that their supplied URL and request parameters are transmitted to an external service.
The code persists the full command output to disk via log.taskWrite, which is a file-write operation that may store user-supplied URL data and fetched results. While the script prints status messages about task progress, this file does not clearly disclose that a local artifact will be created.
Natural-language descriptions and help text are presented only in Chinese, including argument descriptions and warnings. Under the policy rule, this is a language/locale constraint that does not appear to offer the user any choice or document a justified region-specific limitation.
This code persists the full search output to disk via log.taskWrite(...), which is a file-write operation covered by the missing-warning rule for code files. While the script prints progress messages and mentions token configuration, it does not disclose that results will be saved locally, and there is no inline comment or confirmation around this write.
Multiple user-visible error strings are hardcoded in Chinese, including request failures, timeout messages, and token guidance. This imposes a specific language on all users without any opt-in, language selection, or justification for a locale-specific scope.
This code constructs outbound HTTPS requests that send params, data, and a token-derived authenticated request to a remote host, but the file provides no confirmation prompt, logging, comment, or docstring warning that user or system data may be transmitted. For a utility request layer, this network transmission is not disclosed anywhere in the file itself.
The code accepts a token value and transmits it in the TOKEN HTTP header, and error text references GUAIKEI_API_TOKEN, indicating credential use. There is no inline warning, comment, or other disclosure that the skill handles and sends authentication material to an external service.
The file’s natural-language strings and comments are entirely in Chinese, including user-facing warning and info messages such as the token configuration notice. There is no indication that the user can choose a language or that the skill is limited to a Chinese-specific context, which violates the language/locale policy criteria.
This code emits all user-facing error messages in Chinese, which forces a specific language on users. The file does not indicate that the skill is intentionally region-specific or provide any opt-in or fallback for other locales, which matches the language/locale policy violation criteria.
The entire skill documentation is presented in Chinese and does not indicate that other languages are supported or that the Chinese locale is an intentional, region-specific limitation. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale constraint is explicitly documented and justified.
The file’s title and changelog entries are entirely in Chinese, which can constitute a language/locale policy issue when no user opt-in or documented regional constraint is provided. There is no indication in this file that the skill is region-specific or that users can choose their preferred language.
The retry error message is hard-coded in Chinese, which is a natural-language locale choice visible to users or operators. The file does not provide any opt-in, localization option, or indication that the skill is intentionally limited to a Chinese-speaking context.
The thrown error message is hard-coded in Chinese and may surface to users or calling systems. Without an explicit locale choice or documented regional scope, this creates a language-policy concern under the file-wide natural-language rules.
This retry message is also hard-coded in Chinese and appears to be operator-facing output. The code provides no alternate locale handling or documented justification for restricting output language.
The skill's descriptions, help text, and runtime messages are presented only in Chinese, with no indication of language selection or opt-in. The policy explicitly calls out language/locale constraints as violations when a specific language is forced without user choice.
The command descriptions, examples, and runtime messages are written exclusively in Chinese, which imposes a specific language on all users without any opt-in or locale selection. This is a natural-language policy issue when a skill does not provide a language choice or document a justified locale restriction.
This file contains natural-language comments, help text, and error messages exclusively in Chinese, including the generated help output and thrown errors. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.
The thrown error string is hard-coded in Chinese ("重试...次后失败"). This imposes a specific language in user-visible output without offering a language choice or documenting a justified locale restriction, which matches the natural-language policy violation criteria.
The module’s comment and banner text are written in Chinese, and the banner emitted to users is fixed Chinese-language output. This can violate language/locale policy when a skill imposes a specific language without giving the user any option to choose or opt in.
