Security audit

TikTok数据技能 · TikTok搜索 · KOL 作品 · 作品评论

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed TikTok public-data API wrapper that uses a provider token, sends requested TikTok queries or URLs to guaikei.com, and saves JSON logs locally.

Install only if you are comfortable using a third-party TikTok data provider. Keep GUAIKEI_API_TOKEN private, review guaikei.com terms and privacy handling, and periodically delete temp log files if scraped public comments or creator metadata should not be retained locally. The publisher should clarify the IP-attribution/location wording.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码块的实际行为聚焦于 TikTok 单视频评论获取：解析 --url 和 --limit 参数，规范化视频链接，使用 API token 创建并查询评论任务，返回评论结果。它没有体现任何关键词搜索视频、按点赞/相关度排序、按发布时间筛选，也没有实现按主页链接或用户名批量获取博主公开作品列表、最新/最热排序等能力。因此，若把该代码块视为对整个技能描述的实现，则描述明显宽于实际实现，存在能力层面的不一致。另一方面，代码没有发现超出描述范围的敏感或额外能力；写本地日志属于实现细节，不构成主要用途偏离。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码块仅包含 scripts/utils/args.js，一个通用的命令行参数解析与帮助文本生成模块。它处理诸如 --help、flag 别名、数值校验、默认值、重复参数检测、位置参数冲突和帮助信息构建等通用 CLI 行为。代码中没有任何与 TikTok 平台交互、网络请求、公开数据读取、视频搜索、用户主页抓取、评论抓取、结构化 TikTok 数据输出相关的实现。因此，这段代码的实际用途与声明描述的核心能力存在明显不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向 TikTok 公开数据抓取与分析的技能，核心能力应涉及网络请求、TikTok 数据解析和结构化结果输出。但提供的代码片段只是一个日志工具函数 taskWrite，用于校验文件名和内容、生成安全文件名、在系统临时目录创建 logs 目录并写入文件。它既没有访问 TikTok，也没有实现搜索、作品抓取、评论分析等任何声明中的主要功能。虽然日志写入可能属于辅助实现细节，但就该代码片段本身而言，其实际行为与声明用途明显不一致，且包含未在声明权限中体现的本地文件写入能力。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码片段的实际功能只是本地文件读取与缓存技能名称，属于内部辅助工具。就所提供片段而言，它与声明中的核心能力完全不对应，没有任何网络请求、TikTok 数据处理、搜索、抓取、评论分析或结构化输出逻辑。因此，这个代码片段与声明用途存在明显不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个具体的 TikTok 数据采集与分析技能，核心能力应涉及访问公开 TikTok 内容并返回结构化结果。但提供的代码片段仅是一个辅助模块，用于验证 token 格式并输出 GUAIKEI_API_TOKEN 的配置提示，属于鉴权/配置层面的功能。虽然 token 校验可能是某个更大技能的配套实现细节，但就该代码片段本身而言，其实际行为与声明的核心用途明显不一致，且没有任何与 TikTok 数据读取、搜索、抓取、评论分析相关的逻辑。因此应判定为描述与代码行为不匹配。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill claims it does not collect location data, but elsewhere states that comment-analysis output includes IP attribution/geolocation. This inconsistency can cause operators to unknowingly process personal or quasi-personal data, creating privacy, compliance, and data-handling risk, especially when users rely on the 'no location data' assurance.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This JSON schema is a manifest/config-style file, so SQP-3 applies to its natural-language content. The title and descriptions consistently force a specific language/locale for users and integrators, with no indication that Chinese is optional or that the skill is intentionally region-specific.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The package description is written entirely in Chinese and does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Whitespace Padding

Medium

Category: Prompt Injection
Content: node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>] ``` | 参数 | 缩写 | 作用 | 可选值 | 必填 | 默认 | | ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: | | `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接 | 是 | — | | `--sort` | `-s` | 排序方式 | `0` 相关度 / `1` 最多点赞 | 否 | `0` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly supports collecting public TikTok videos, creator metadata, and comment/user metadata, but provides no privacy, retention, or acceptable-use guidance. Even if the data is public, large-scale collection and downstream AI analysis of user identifiers and comments can create privacy, compliance, and misuse risks for profiling or surveillance.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The manifest says no account login is required and frames the skill as direct read-only access to public data. Here the code requires `GUAIKEI_API_TOKEN` and uses it to create a comment task, which introduces a credentialed backend dependency beyond the stated user-facing purpose.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The CLI reads a credential from `process.env.GUAIKEI_API_TOKEN` and sends it together with the normalized TikTok URL to `createCommentTask` and `getCommentTask`, which are network-facing API calls by context. The file does not provide an explicit warning that user input and credentials will be sent to an external service.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The CLI writes fetched comment data to a local JSON file after printing results, creating an undisclosed secondary data sink. Even if the source data is public, comments and commenter metadata can still be sensitive in aggregate, and silent persistence increases the risk of unintended retention, local exposure, or reuse beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The tool silently saves retrieved comment data to a local file without warning or confirmation, which can surprise users and create privacy/compliance issues on shared systems or automated environments. Because the filename is generated automatically, users may not realize that output persists after execution, increasing the chance of unauthorized local access or over-retention.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The option descriptions and runtime messages are written in Chinese throughout the file, and there is no indication that users can select another language or that the tool is intentionally limited to a Chinese-speaking context. This creates a natural-language locale policy issue under the rule for forced language without opt-in.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The manifest emphasizes that no account login is required and presents the skill as operating on public data. This file still depends on a secret from process.env.GUAIKEI_API_TOKEN to function, which introduces hidden credential handling beyond the user-facing stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI writes the full fetched TikTok results to a local JSON file after displaying them, creating persistent storage of potentially sensitive public-profile and comment-analysis data without clear user consent or retention controls. In a skill marketed as read-only structured output for analysis, silent local persistence expands the data exposure surface to other local users, backup systems, and downstream tooling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The tool silently saves fetched results to a local JSON file without warning the user in this code path, which can surprise users and lead to unintended retention of scraped content and metadata. This is especially relevant for creator/video/comment analysis data, which may later be accessed by other processes, users, or forensic collection on the host.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This code presents command descriptions, help text, and runtime messages exclusively in Chinese, which imposes a specific language on users without offering a locale choice. That matches the natural-language policy concern for forced language/locale behavior.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill requires and reads an environment API token despite the description claiming no login/account is required. This is a trust and security issue because it causes operators to provision secrets unexpectedly; such secrets may then be exposed through surrounding tooling, process environments, crash dumps, or misconfigured execution platforms.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI writes full search output to a local file, which contradicts the declared behavior of only returning structured JSON. Persisting creator/video search data can create unintended data retention, leak potentially sensitive research activity or scraped content to other local users/processes, and broaden the attack surface if logs are collected or synced elsewhere.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest describes a read-only skill that fetches and analyzes public TikTok data and outputs structured JSON for downstream AI use. In contrast, this helper persists content to the local filesystem under a temp logs directory, which is behavior beyond pure read-only data retrieval/analysis as described.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This code emits all user-facing warning and informational text in Chinese, and there is no indication that the skill offers a language/locale choice or that the restriction is region-specific. That creates a natural-language policy issue under the locale/language rule because users are forced into a specific language without opt-in.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The code emits all validation and error messages exclusively in Chinese, such as at L11, L15, L19, L23, L53, L59, and L64. For a general-purpose validation utility, this is a natural-language locale constraint without user opt-in or an explicit documented justification in the file.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16