Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently fetches public Kuaishou data through a disclosed third-party API and does not show evidence of hidden posting, account control, persistence beyond local result logs, or malicious behavior.
Install only if you are comfortable using a third-party Guaikei API token and sending Kuaishou keywords, profile URLs, video URLs, and request parameters to www.guaikei.com. Treat the generated logs as retained local data, especially when collecting large comment sets or working on a shared machine.
The primary invocation description and usage cues are written to activate on Chinese phrases such as "搜快手视频 / 看快手博主作品 / 分析快手评论 / 做快手数据分析," while the skill is otherwise presented bilingually. This creates a locale/language constraint without explicitly offering the user a choice of language or documenting that the skill is intentionally limited to Chinese-only operation.
The package metadata markets the skill as a research and analytics tool, but the exposed npm scripts include active posting and commenting capabilities. This mismatch can mislead users or reviewers into granting trust or permissions they would not give to a tool that can perform outward-facing actions on third-party platforms, increasing the risk of unauthorized content publication or account abuse.
The natural-language content across the README is entirely in Chinese, and the document does not indicate that the skill is region-specific or provide users with an option to use another language. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.
The script writes the full fetched comment results to a local JSON file, which can persist potentially sensitive or regulated data without clear user consent, retention limits, or access controls. In a shared workstation, CI runner, or multi-user environment, this can expose scraped content and request metadata to other users or later processes.
The tool stores retrieved comments to a local file without an explicit warning in this file, creating a privacy and transparency issue for users who may expect output only on stdout. Because comments may contain personal data or user-generated content, silent persistence increases the risk of unintended collection and retention.
The script reads an API token from the environment and sends the normalized URL plus parameters to remote task APIs through createPostTask and getPostTask. This is a network operation involving user/system data, but this file does not clearly disclose to the user that their supplied target and token-authenticated request will be transmitted to an external service.
The script persists the full output to disk via log.taskWrite, which is a file-write operation that may store retrieved profile/task data locally. Although the script prints status messages, there is no clear user-facing disclosure here that results will be saved to a file, and no confirmation prompt or comment/docstring warning about this behavior appears in this file.
This JavaScript file contains natural-language comments and user-facing CLI messages entirely in Chinese, including errors and help output. Under the policy rule for language/locale, this effectively enforces a specific language for users without offering a language choice or documenting a justified locale restriction.
This code contains user-facing status and error strings only in Chinese, which imposes a specific language on users without any opt-in or locale-selection mechanism. The file provides no indication that the skill is region-specific or intentionally limited to Chinese-speaking users.
With no manifest available, there is no declared purpose that would justify this module's capability to send authenticated HTTPS GET/POST requests to a remote host. The code builds outbound requests, attaches a token header, and transmits skill-identifying metadata, which is a materially sensitive capability beyond a clearly documented local utility role.
This code sends a provided token in the TOKEN header as part of an outbound HTTPS request, which is a network operation involving credential material. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that authentication data is being transmitted.
The function builds a query string from params and sends it together with a TOKEN header in an outbound HTTPS request. This is a safety-relevant network/data-transmission behavior, but the file contains no user-facing notice or explanatory comment about the transmission.
The file contains natural-language content entirely in Chinese, including module documentation and user-facing warning/info strings. Because there is no indication that this skill is region-specific or that users can opt into the language, this creates a locale-policy concern under the rule for forced language without user choice.
This code emits all user-facing validation errors exclusively in Chinese, such as at L05, L10, L14, L18, L22-L23, and later lines. That creates a language/locale constraint in natural-language output without offering a user choice or documenting a justified region-specific requirement.
The package description and keywords are entirely in Chinese and specifically target the 快手 platform, which can constitute a language/locale restriction in user-facing metadata without indicating any language choice or opt-in. Under the stated policy, natural-language content that forces a specific language should be documented as optional or justified.
The changelog and skill title are entirely in Chinese, and the file does not indicate that this language choice is optional or tied to a documented region-specific requirement. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
This markdown file presents all user-facing instructions, parameter descriptions, and examples exclusively in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
This code sends the provided URL to a remote API via postJson and also supplies an authentication token, but there is no confirmation prompt, user-facing notice, or explanatory comment in the file indicating that user/system data will be transmitted. Under the code-file criteria, network operations that transmit user or system data should include some form of disclosure unless clearly warned elsewhere.
The getCommentTask function performs a network call that includes the user-provided URL and limit, authenticated by token, yet the file contains no user-facing warning or explanatory documentation about this outbound data transmission. This matches the missing-warning criterion for code files when network calls transmit user or system data without any visible disclosure.
No manifest is available to justify capabilities, so the only stated intent here comes from the CLI's apparent role of fetching comments for a Kuaishou video. Reading a secret from process.env introduces credential access that is not documented in this file and is not directly explained by any inline intent statement beyond making backend API calls.
The CLI's descriptions, examples, help text, and runtime messages are presented entirely in Chinese, with no indication that language can be selected by the user. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy issue unless the locale restriction is documented and justified.
Several user-visible error strings are hard-coded in Chinese, including parsing, timeout, and credential-related messages. That enforces a specific language/locale without offering user opt-in or documenting a justified locale restriction.
Both request helpers inject skill_name into outbound query parameters before contacting the remote service. In the absence of any manifest or documentation explaining telemetry, identification, or routing needs, sending identifying metadata is an unjustified capability relative to the unknown stated purpose.
The thrown error string is hard-coded in Chinese (重试${maxAttempts}次后失败). This imposes a specific language in a general-purpose utility file, and there is no indication that the skill is region-specific or that users can opt into this locale.
The module banner and comments are written in Chinese, including the prominent runtime banner text shown to users. This imposes a specific language/locale in user-facing output without any opt-in, selection mechanism, or justification for a region-specific constraint.
