T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:67- Finding
API Token Exposure Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
公域流量精准获客与竞品截流系统
Security checks for vulnerabilities and agentic risk
Overview
The skill largely does what it says, but it handles a private API token unsafely and stores public user/comment data for lead generation with limited privacy controls.
Review this before installing if you will use a real Guaikei token or collect comment data. Treat the token as sensitive, rotate it if already used with this version, and avoid collecting or retaining personal/comment data unless you have a lawful, platform-compliant use case and a plan for deletion and access control.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (68)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description centers on精准获客 via comment-section data mining, including competitor interception, customer intent filtering, sentiment conversion, and private-domain traffic guidance. The supplied code does none of that. It only requests
/api/douyin/hot-searchto obtain Douyin trending search/ranking results, with retry and error logging. This is a materially different primary purpose and accesses a different type of resource than described, so it should be flagged as a mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description emphasizes comment-area data mining and marketing-oriented lead acquisition workflows. However, this code chunk only interfaces with Douyin post-related endpoints: it submits a task to fetch published works for a Douyin profile URL and retrieves the resulting post list. There is no evidence of comment collection, comment analysis, user-intent filtering, sentiment handling, private-domain redirection, or other lead-generation logic described in the declaration. The actual behavior is materially narrower and different in purpose from the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description emphasizes a marketing intelligence and lead-generation system built on comment-section data mining, with higher-level business capabilities such as competitor traffic interception, identifying high-intent customers, sentiment conversion, and private-domain funneling. The supplied code does not implement comment extraction, mining, lead analysis, sentiment processing, or conversion workflows. Instead, it provides a narrow Douyin search API wrapper for creating a keyword-based general search task and retrieving the results. The only processing performed is adding author profile links and formatting timestamps. This is a materially different and much narrower behavior than the declared purpose, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code chunk’s actual function is narrow: it validates CLI arguments, normalizes a Douyin URL, uses an API token to create and fetch a comment retrieval task, outputs the comments, and writes results to a local JSON log. This partially aligns with the description only at the level of obtaining comment-area data. However, the declared purpose emphasizes a higher-level lead-generation and marketing tool with capabilities such as competitor interception, intent-customer filtering, sentiment conversion, and private-domain redirection. None of those downstream analysis, targeting, conversion, or routing behaviors appear in this code. Therefore, the description materially overstates the implemented functionality, making it a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description emphasizes precise customer acquisition based on comment-area data analysis and downstream marketing/lead-conversion workflows. The supplied code does not inspect comments, identify prospects, analyze sentiment, or perform lead capture. Instead, it serves as a command-line entry point for obtaining Douyin hot-list/trending data from an API and printing the results. This is a materially different primary purpose from the declared description, so the description does not accurately represent the observed behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description emphasizes comment-area data mining for精准获客, including competitor截流, 意向客户筛选, 舆情转化, and 私域引流. However, the supplied code only parses CLI arguments, validates a Douyin user URL/sec_uid, obtains an API token, creates a 'post' task, retrieves the user's作品列表 (post list), prints JSON output, and saves the result locally. There is no code for collecting comments, analyzing users, filtering leads, performing sentiment analysis, or driving private-domain conversion. The primary implemented behavior is materially different from the declared purpose, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description emphasizes a marketing/lead-generation tool driven by comment-section data mining and downstream conversion use cases. However, the supplied code only implements a CLI for keyword-based Douyin search with sort/time/duration/limit filters, token handling, task creation/retrieval, JSON output, and local logging. There is no visible logic for scraping or analyzing comments, extracting leads, filtering high-intent users, sentiment analysis, competitor interception, or private-domain funneling. While search could be a supporting component of such a system, this code chunk’s actual purpose is materially narrower and different from the declared end-user description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Yes, this is a mismatch. The declared description describes a full marketing and lead-generation capability focused on extracting and analyzing video-platform comment data. However, the supplied code chunk does not implement any of that functionality. It only provides generic custom error classes used for internal error handling. While error utilities can be a supporting implementation detail, this chunk by itself does not substantiate the declared purpose and instead reflects unrelated infrastructure code rather than the advertised skill behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a business-facing marketing and data-mining tool focused on extracting and converting leads from video-platform comment sections. The supplied code chunk, however, only defines a generic helper function
withRetryfor retrying async operations with exponential backoff. It does not access comments, platforms, user data, sentiment signals, leads, or traffic-conversion workflows. While retry logic could be a supporting utility inside a larger system, this specific code chunk's actual behavior is unrelated to the declared primary purpose, so this chunk does not accurately represent the described functionality.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a marketing/data-mining tool for extracting and converting leads from video platform comments. However, this code chunk does not implement any of those behaviors. It is a token management module that checks token format, blocks functionality when the token is invalid, and advertises a website/contact for obtaining a token. While token handling can be a supporting detail, this chunk’s actual functionality is purely access control/licensing-related and does not reflect the declared business purpose. Therefore, for this supplied code chunk, the description does not accurately represent what the code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a specialized short-video marketing and lead-generation tool focused on analyzing comment data and acquiring customers. However, the supplied code chunk contains only generic utility functions for console banner display and colored logging. These utilities may support a larger application, but on their own they do not implement or reflect the declared business capabilities. Therefore, the code behavior in this chunk is materially different from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a marketing intelligence and customer acquisition tool focused on mining comment-section data and converting traffic into leads. The supplied code does not analyze comments, identify customers, screen intent, perform competitor interception, or support any lead-generation workflow. Instead, it purely formats a Douyin hot-list ranking into a markdown-style message. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents the skill as a customer acquisition and comment-mining tool with marketing-oriented lead generation capabilities. However, the supplied code chunk is limited to input validation and presentation utilities: checking keyword length/special characters/URLs, cleaning keywords, validating sort/time/duration/limit parameters, and formatting generic Douyin search results. While formatting mentions '抖音综合搜索结果', there is no logic for collecting comment-area data, analyzing competitors, identifying high-intent customers, performing sentiment-related processing, or driving users to private channels. Therefore, this code’s actual behavior is materially narrower and different from the declared primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a high-level marketing and customer-acquisition tool centered on analyzing comment data and extracting sales leads. However, the supplied code chunk is a narrow validation utility: it standardizes Douyin profile URLs and bounds a numeric fetch limit between 1 and 10000. It does not access comments, perform data mining, analyze competitors, filter prospects, redirect traffic, or implement any customer-acquisition workflow. While validation helpers can be supporting code within a larger system, this chunk by itself does not accurately reflect the declared purpose and instead serves a materially different, low-level input-formatting function.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - 技能重命名为“douyin-search-keyword”。 - 在SKILL.md中添加了openclaw元数据、使用帮助、许可证、标签和示例，以实现更好的集成与文档化。 - 移除了两个本地文件（.env 和 scripts/last-search.json），以优化代码结构并提升安全性。 - 文档现已更加简洁且以用户为中心，重点在于提供清晰的使用说明和数据字段解释。 - 突出技能特性、合规要点及技术流程。
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a tool for精准获客 based on comment-area data mining, competitor interception, intent-customer screening, sentiment conversion, and private-domain lead capture. This file instead implements a '获取抖音热榜入口' flow that calls a hot-list API, handles empty/error responses for '抖音热榜', and prints hot-ranking results, which is materially different from customer-acquisition via comment analysis.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill declares access to an environment variable (
GUAIKEI_API_TOKEN) but does not explicitly scope or document its permissions. Missing tool-scope declarations reduce transparency and make it harder for reviewers or platforms to enforce least privilege, especially for a skill that contacts an external service and writes local logs.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill openly states that outputs are saved under a local
logsdirectory, and its purpose is to collect search, profile, and comment-derived lead data, but it does not prominently warn users that potentially sensitive or regulated personal data will be harvested and stored locally. In a lead-generation context, silent local persistence increases the risk of accidental retention, unauthorized access, compliance violations, and secondary leakage of scraped user data.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON schema contains user-facing title and description text exclusively in Chinese, which can impose a specific language on users without opt-in. The policy specifically calls for flagging language or locale constraints when the skill does not offer a language choice or clearly justify the restriction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a tool for mining comment data to identify prospects, intercept competitors, and convert public traffic, but this schema is titled and documented as input for obtaining a blogger's works from Douyin. Collecting a creator homepage URL/SEC_UID and a work-count limit indicates a content-fetching capability that is materially different from comment-based lead acquisition as described in the manifest.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The provided skill manifest says the skill is for precise customer acquisition based on comment-area data mining, including intent-customer screening and private-domain lead conversion. In contrast, package.json describes it as a Douyin public-data analysis tool for keyword search ranking, creator work scraping, and hot-list monitoring, which shifts the skill from lead-generation/comment-mining into general content analytics and trend tracking.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The metadata explicitly promotes competitor interception and lead-generation behavior without any stated consent, compliance, or limitation language. In the context of a public-traffic customer-acquisition skill focused on comment mining and scraping, this increases the risk of abusive targeting, privacy-invasive collection, and misuse for deceptive outreach.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script entry points show separate capabilities for search, post, comment, and hot-list operations. While comment processing fits the stated purpose, post scraping and real-time hot ranking are broader market-intelligence features not clearly covered by the manifest's emphasis on extracting leads from comment data for customer acquisition.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README promotes monitoring public comment data for lead generation, competitor interception, and private-domain diversion without any warning about privacy expectations, platform terms, consent, or data-use restrictions. In this context, the omission is risky because it normalizes potentially non-compliant collection and profiling of user comments for commercial targeting, which can lead to privacy complaints, policy violations, or abusive outreach.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file announces functionality to fetch and analyze comment content, which can affect privacy expectations and data handling, but the entry provides no warning or disclosure about responsible use, consent, or compliance implications. Under the markdown-specific SQP-2 criteria, user-facing documentation should warn when described behavior could affect user data or privacy.
- Content