Security audit
Security checks for vulnerabilities and agentic risk
The skill retrieves public Douyin data through a disclosed third-party service and saves results locally as documented.
Use it if you accept sending your queries and links to www.guaikei.com under that provider's terms and pricing. Keep the API token private, choose suitable retrieval limits, and protect or delete saved logs containing inputs and public user data.
Referenced artifact was not completely inspected
- '这个博主最近 30 条作品 → node src/douyin/post-cli.js --url "https://www.douyin.com/user/MS4wLjABxxx" --limit 30'
Referenced artifact was not completely inspected
- '看看这个对标账号多少粉丝、多少获赞 → node src/douyin/post-cli.js --url "https://www.douyin.com/user/MS4wLjABxxx" --limit 0'
Referenced artifact was not completely inspected
| 品牌 / 投放 | 监控对标账号的发文节奏与内容策略 | `post-cli.js` |
Referenced artifact was not completely inspected
| 博主作品、主页、对标账号、粉丝数据 | `node src/douyin/post-cli.js` | 主页链接或 `sec_uid` |
Referenced artifact was not completely inspected
### 4.2 博主作品 `post-cli.js`
Referenced artifact was not completely inspected
- '这条视频的评论区都在说什么 → node src/douyin/comment-cli.js --url "https://www.douyin.com/video/xxx" --limit 40'
Referenced artifact was not completely inspected
| 舆情 / 客服 | 判断一条视频的评论区在骂还是在夸 | `comment-cli.js` |
Referenced artifact was not completely inspected
| 某条视频/图文的评论 | `node src/douyin/comment-cli.js` | 视频链接或 `aweme_id` |
Referenced artifact was not completely inspected
### 4.3 视频评论 `comment-cli.js`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- 技能重命名为“douyin-search-keyword”。
- 在SKILL.md中添加了openclaw元数据、使用帮助、许可证、标签和示例，以实现更好的集成与文档化。
- 移除了两个本地文件（.env 和 scripts/last-search.json），以优化代码结构并提升安全性。
- 文档现已更加简洁且以用户为中心，重点在于提供清晰的使用说明和数据字段解释。
- 突出技能特性、合规要点及技术流程。
Without declared permissions the skill's intent is opaque and cannot be validated.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
### 4.3 视频评论 `comment-cli.js`
| 参数 | 缩写 | 必填 | 取值 | 默认 |
| --------- | ---- | ---- | -------------------------------------------------------------------------------------- | ---- |
| `--url` | `-u` | ✅ | `douyin.com/video/xxx`、`douyin.com/note/xxx`、`v.douyin.com/xxx`，或纯数字 `aweme_id` | — |
| `--limit` | `-l` | | 1–10000 | 10 |
The CLI writes the full result envelope, including retrieved comments and the original input URL, through log.writeResultLog. Its help text, comments, and user-facing messages describe retrieving comments but do not disclose saving this data locally; persistence is not inherent to the stated retrieval purpose.
The command writes the complete result envelope, including the requested URL and returned profile/post data, to a JSON log. The provided file describes and reports retrieval but contains no confirmation, user-facing notice, or explanatory comment disclosing this additional persistence.