Security audit
Security checks for vulnerabilities and agentic risk
The skill retrieves public Douyin data through a disclosed third-party service and saves results locally, with no material security concerns found.
Install if you accept sending your queries to www.guaikei.com and its API charges. Protect the provider token and manage saved results in logs/, which include retrieved profile and comment information. Output timestamps use Beijing time.
Referenced artifact was not completely inspected
- '这个博主最近 30 条作品 → node src/douyin/post-cli.js --url "https://www.douyin.com/user/MS4wLjABxxx" --limit 30'
Referenced artifact was not completely inspected
- '看看这个对标账号多少粉丝、多少获赞 → node src/douyin/post-cli.js --url "https://www.douyin.com/user/MS4wLjABxxx" --limit 0'
Referenced artifact was not completely inspected
| 品牌 / 投放 | 监控对标账号的发文节奏与内容策略 | `post-cli.js` |
Referenced artifact was not completely inspected
| 博主作品、主页、对标账号、粉丝数据 | `node src/douyin/post-cli.js` | 主页链接或 `sec_uid` |
Referenced artifact was not completely inspected
### 4.2 博主作品 `post-cli.js`
Referenced artifact was not completely inspected
- '这条视频的评论区都在说什么 → node src/douyin/comment-cli.js --url "https://www.douyin.com/video/xxx" --limit 40'
Referenced artifact was not completely inspected
| 舆情 / 客服 | 判断一条视频的评论区在骂还是在夸 | `comment-cli.js` |
Referenced artifact was not completely inspected
| 某条视频/图文的评论 | `node src/douyin/comment-cli.js` | 视频链接或 `aweme_id` |
Referenced artifact was not completely inspected
### 4.3 视频评论 `comment-cli.js`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- 技能重命名为“douyin-search-keyword”。
- 在SKILL.md中添加了openclaw元数据、使用帮助、许可证、标签和示例，以实现更好的集成与文档化。
- 移除了两个本地文件（.env 和 scripts/last-search.json），以优化代码结构并提升安全性。
- 文档现已更加简洁且以用户为中心，重点在于提供清晰的使用说明和数据字段解释。
- 突出技能特性、合规要点及技术流程。
Without declared permissions the skill's intent is opaque and cannot be validated.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
### 4.3 视频评论 `comment-cli.js`
| 参数 | 缩写 | 必填 | 取值 | 默认 |
| --------- | ---- | ---- | -------------------------------------------------------------------------------------- | ---- |
| `--url` | `-u` | ✅ | `douyin.com/video/xxx`、`douyin.com/note/xxx`、`v.douyin.com/xxx`，或纯数字 `aweme_id` | — |
| `--limit` | `-l` | | 1–10000 | 10 |
The schema requires output timestamps to use Beijing time and an unpadded year/month/day format. This imposes a locale-specific output convention without offering a user choice or explaining a region-specific requirement.
The call to log.writeResultLog persists the complete output, including retrieved posts and any profile information. The visible messages announce retrieval completion but do not disclose local persistence, and no comment or confirmation explains this additional action.
No suspicious patterns detected.