Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill benign with medium confidence: the reported Kuaishou data features appear purpose-aligned, but some code was only partially analyzed and scanners noted scope and privacy-transparency questions.
The verdict is benign, but the evidence is incomplete. Before installing, consider whether you are comfortable sending search terms and links to the third-party service, and avoid using confidential queries or sensitive links.
Referenced artifact was not completely inspected
- "帮我搜快手里「具身智能」的高赞视频 → node scripts/kuaishou/search-cli.js --keyword \"具身智能\" --sort 2 --limit 20"
Referenced artifact was not completely inspected
- "最近一周最新的快手 AI 教程，要 20 条 → node scripts/kuaishou/search-cli.js --keyword \"AI 教程\" --sort 1 --time 7 --limit 20"
Referenced artifact was not completely inspected
| 找选题、看高赞 | `search-cli.js` | 视频数组。点赞、播放、评论是数字 |
Referenced artifact was not completely inspected
3. 有关键词，且没有上面两类信号 → `search-cli.js`
Referenced artifact was not completely inspected
ut 为空，这是正常现象。短参数大小写都可以。含空格的关键词用双引号包成一个参数。关键词以 `-` 开头时写成 `--keyword=-AI`，或 `node scripts/kuaishou/search-cli.js -- -AI`。完整字段见 `assets/*_cli_req.schema.json` 与 [r
Referenced artifact was not completely inspected
- "这条快手视频评论区在说什么 → node scripts/kuaishou/comment-cli.js --url \"https://www.kuaishou.com/short-video/3xabc\" --limit 40"
Referenced artifact was not completely inspected
| 看评论区 | `comment-cli.js` | 评论数组 |
Referenced artifact was not completely inspected
1. 要评论、留言、舆情，且对象是一条视频 → `comment-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/short-video/{id}`、`v.kuaishou.com/*`、裸的 `3x...` 只能给 `comment-cli.js`。搜索结果里用视频 `id` 或 `url`
Referenced artifact was not completely inspected
| 评论区 | `comment-cli.js`。没说条数用默认 10 |
Referenced artifact was not completely inspected
- "这个快手博主最近 20 条作品 → node scripts/kuaishou/post-cli.js --url \"https://www.kuaishou.com/profile/3xabc\" --sort 0 --limit 20"
Referenced artifact was not completely inspected
- "这个快手博主多少粉丝 → node scripts/kuaishou/post-cli.js --url 123456 --limit 0"
Referenced artifact was not completely inspected
2. 要作品、主页、账号、博主、粉丝 → `post-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/profile/{id}` 只能给 `post-cli.js`
Referenced artifact was not completely inspected
- 纯数字 `user_id` 只能给 `post-cli.js`。搜索结果里用 `user.user_id`，或直接用 `user.url`
Without declared permissions the skill's intent is opaque and cannot be validated.
The quick start requires a third-party token but does not explicitly tell users that their search keywords and supplied links are sent to that provider. Although the retrieved social-media data is public, query terms and selected accounts can reveal confidential research or monitoring interests, making this a limited privacy-transparency weakness rather than evidence of malicious exfiltration.
The comment at L02 explicitly requires Beijing time and a fixed date format, and the function implements that requirement unconditionally. Although the constraint is documented, this source provides neither a user opt-in nor a justification for overriding the user's timezone or locale.