抖音带货达人筛选

• Outcome: Review
• Latest audit: Sep 21, 2026 · 4:00 AM UTC
• Version: 1.3.0

Overview

The skill is a coherent Douyin public-data CLI; it uses a disclosed third-party API and saves some fetched results locally, so users should handle outputs carefully.

Install only if you are comfortable sending Douyin keywords, links, and your GUAIKEI_API_TOKEN to www.guaikei.com. Treat returned creator/comment data and the automatic logs directory as retained social-media data: avoid sharing it unnecessarily, comply with platform terms and privacy laws, and delete logs when no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the implementation performs local filesystem writes, directory creation, and saves arbitrary string content while the skill is documented as a read-only public-data tool, that creates a meaningful trust-boundary violation. Hidden write behavior can be abused for local data persistence, log poisoning, workspace pollution, or dropping attacker-controlled content in unexpected paths, especially when users expect no local side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation performs local filesystem writes, directory creation, and saves arbitrary string content while the skill is documented as a read-only public-data tool, that creates a meaningful trust-boundary violation. Hidden write behavior can be abused for local data persistence, log poisoning, workspace pollution, or dropping attacker-controlled content in unexpected paths, especially when users expect no local side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation performs local filesystem writes, directory creation, and saves arbitrary string content while the skill is documented as a read-only public-data tool, that creates a meaningful trust-boundary violation. Hidden write behavior can be abused for local data persistence, log poisoning, workspace pollution, or dropping attacker-controlled content in unexpected paths, especially when users expect no local side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation performs local filesystem writes, directory creation, and saves arbitrary string content while the skill is documented as a read-only public-data tool, that creates a meaningful trust-boundary violation. Hidden write behavior can be abused for local data persistence, log poisoning, workspace pollution, or dropping attacker-controlled content in unexpected paths, especially when users expect no local side effects.

Credential Access

High

• Category: Privilege Escalation

Content

## 1.0.2 - 2026-03-24

- 在SKILL.md中添加了openclaw元数据、使用帮助、许可证、标签和示例，以实现更好的集成与文档化。
- 移除了两个本地文件（.env 和 scripts/last-search.json），以优化代码结构并提升安全性。
- 文档现已更加简洁且以用户为中心，重点在于提供清晰的使用说明和数据字段解释。
- 突出技能特性、合规要点及技术流程。

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JSON schema uses Chinese-only titles and descriptions throughout, including the top-level title/description and field documentation. Because the file provides no indication of optional localization or user opt-in, it appears to enforce a specific language/locale, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The package description is written entirely in Chinese and states when the skill should be used, but it does not indicate any language choice or opt-in for users who may operate in other languages. This creates a natural-language locale constraint that is not documented as region-specific or optional.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The README presents all usage instructions, warnings, and operational guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation explicitly supports collecting creator profile data, public works, and comment content/interaction data, but provides no warning about privacy expectations, lawful basis, retention, or platform terms restrictions. In a creator-matching skill, that omission can normalize large-scale scraping and downstream profiling of individuals, increasing the risk of privacy misuse and non-compliant data handling.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code sends user-provided video URLs and an authentication token to external API endpoints via requestApi, which is a safety-relevant network operation. The file contains only developer-facing docstrings and no confirmation prompt, user-facing disclosure, or visible warning that these values will be transmitted.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI writes fetched comment data to a local JSON file automatically, but this file may contain sensitive or regulated data such as usernames, comment text, and engagement metadata. Because the write happens without explicit user consent, warning, or an opt-in flag, operators may unintentionally persist scraped social-media data to disk where it can be retained, copied, or exposed through backups, shared workstations, or loose file permissions.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Multiple user-visible strings in this file are fixed in Chinese, including authentication, error, empty-result, and success messages. This enforces a specific language for all users without offering a locale choice or documenting a justified region-specific constraint.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI writes the full scraped result set to a local JSON file automatically after successful execution, without any explicit user consent, warning, or opt-in control. Because the returned data may include creator profile details, post metadata, and other collected content, this creates an avoidable local data-retention risk: sensitive or regulated data can persist on disk, be accessed by other local users/processes, or be unintentionally committed, backed up, or exfiltrated later.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists the full output payload, including the user's raw keyword, cleaned keyword, request parameters, and returned results, via `log.taskWrite(...)`. While the function docstring mentions saving logs, there is no user-facing warning near execution time or confirmation that potentially sensitive search data will be stored on disk.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This JavaScript file uses Chinese exclusively in comments and user-facing CLI output, including errors and help text. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file returns multiple user-facing error messages exclusively in Chinese, such as request failures and token validation errors, without any indication that the user can choose a language or that the skill is intentionally restricted to a Chinese-speaking context. The policy requires avoiding forced language or locale choices unless there is explicit opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code emits user-visible status and error messages only in Chinese via string literals. That can violate language/locale policy when the skill does not offer a language choice, fallback, or documented locale restriction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JavaScript file contains multiple user-facing error messages exclusively in Chinese, such as the validation failures for keyword length and invalid characters. Because the file provides no user opt-in for language selection and no indication that the skill is intentionally limited to a Chinese-language context, it creates a language/locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The schema's title and property descriptions are written entirely in Chinese, which imposes a specific language on users or downstream tooling without any stated opt-in, fallback, or region-specific justification. This matches the language/locale policy concern for natural-language content in config files.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This JSON schema uses Chinese-only titles and descriptions such as the title and field descriptions, but it does not indicate that the schema is intentionally limited to Chinese users or offer any language/locale choice. Under the policy, hard-coding a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The title and descriptions are written entirely in Chinese, and the file does not indicate that the skill is intended only for Chinese-speaking users or that other language options are available. This can be a natural-language locale policy concern when a skill implicitly forces a specific language without opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This JSON schema contains natural-language titles and descriptions exclusively in Chinese, such as the schema title and many field descriptions. Because no opt-in, alternate locale, or justification for a Chinese-only interface is provided in the file, it may violate a language/locale policy requiring user choice or documented locale constraints.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The schema title and description are written only in Chinese, which can impose a language-specific experience without any stated user opt-in or documented locale limitation. Under the policy criteria, language constraints should either offer choice or clearly justify the locale-specific scope.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This markdown file uses Chinese throughout, including the title and all release notes, with no indication that the user can choose another language or that the language restriction is region-specific. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16