抖音账号订阅追踪 GuaiKei 抖音博主洞察

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 0.1.0

Overview

The skill largely matches its Douyin data-analysis purpose, but it handles an API token insecurely and automatically saves collected public user/comment data locally, so it needs review before installation.

Install only if you are comfortable sending Douyin search terms, target URLs, and your GuaiKei API token to www.guaikei.com. Treat the token as sensitive, rotate it if it may have been logged, and avoid using this skill in shared or synced workspaces unless you manage or delete the generated logs directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/utils/request.js:123

Finding

API token transmitted in URL query parameters

Content

View full analysis

&keyword=&... ``` HTTPS encrypts the request target while it is in transit, so a passive network observer cannot ordinarily read it. However, credentials in URLs are commonly retained by infrastructure that records request targets, including: - API server access logs; - reverse-proxy and load-balancer logs; - application performance monitoring and tracing systems; - debu ...[truncated 1833 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/douyin/comment-cli.js:145

Finding

Automatic plaintext persistence of query results and public personal data

Content

View full analysis

Remediation

View remediation

` or `--save`. 2. Do not create result files during the default execution path. 3. When persistence is requested, create directories with mode `0700` and files with mode `0600`: ```js await fs.promises.mkdir(outputDirectory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { mode: 0o600, flag: "wx", }); ``` 4. Redact or omit fields not required for the requested analysis, especially stable user IDs and IP-region labels. 5. Provide configurable retention limits and automatic deletion. 6. Enforce an aggregate storage quota and handle insufficient-disk-space errors safely. 7. Store output outside the source tree in a user-specific application-data directory. 8. Add `logs/` to `.gitignore` and packaging exclusion rules. 9. Clearly notify users before storing personal or user-generated data and document the exact path, fields, retention period, and deletion procedure. 10. Consider encryption at rest where result retention is operationally necessary. 11. Add tests confirming that a normal command does not create persistent files unless the user explicitly requests it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill prominently requires a third-party API token and directs users to obtain service access via an external site or direct contact, while the reviewed artifact does not let us verify the promised capabilities. In an agent ecosystem, this kind of unverifiable commercial token-gating can lead users to exfiltrate operational metadata or trust an opaque external dependency without clear scope, especially when the skill handles public social-media data collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill prominently requires a third-party API token and directs users to obtain service access via an external site or direct contact, while the reviewed artifact does not let us verify the promised capabilities. In an agent ecosystem, this kind of unverifiable commercial token-gating can lead users to exfiltrate operational metadata or trust an opaque external dependency without clear scope, especially when the skill handles public social-media data collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill prominently requires a third-party API token and directs users to obtain service access via an external site or direct contact, while the reviewed artifact does not let us verify the promised capabilities. In an agent ecosystem, this kind of unverifiable commercial token-gating can lead users to exfiltrate operational metadata or trust an opaque external dependency without clear scope, especially when the skill handles public social-media data collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill prominently requires a third-party API token and directs users to obtain service access via an external site or direct contact, while the reviewed artifact does not let us verify the promised capabilities. In an agent ecosystem, this kind of unverifiable commercial token-gating can lead users to exfiltrate operational metadata or trust an opaque external dependency without clear scope, especially when the skill handles public social-media data collection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill prominently requires a third-party API token and directs users to obtain service access via an external site or direct contact, while the reviewed artifact does not let us verify the promised capabilities. In an agent ecosystem, this kind of unverifiable commercial token-gating can lead users to exfiltrate operational metadata or trust an opaque external dependency without clear scope, especially when the skill handles public social-media data collection.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/changelog.md (reported line 72)May include surrounding context.

md

- 技能重命名为“douyin-search-keyword”。
- 在SKILL.md中添加了openclaw元数据、使用帮助、许可证、标签和示例，以实现更好的集成与文档化。
- 移除了两个本地文件（.env 和 scripts/last-search.json），以优化代码结构并提升安全性。
- 文档现已更加简洁且以用户为中心，重点在于提供清晰的使用说明和数据字段解释。
- 突出技能特性、合规要点及技术流程。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases are broad enough to match common requests like analytics, trend analysis, marketing, or content discovery beyond a clearly bounded Douyin-query intent. In an agent setting, overbroad routing can cause the skill to activate on unrelated prompts and send user queries or URLs to a third-party API unnecessarily, increasing privacy and data-minimization risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README states that fetched Douyin data is automatically exported to JSON logs, but it does not clearly warn users that collected video, author, or comment data will persist on local disk. This can create unintended retention of potentially sensitive or regulated content, increasing exposure through shared workstations, backups, log collection systems, or later reuse beyond the user's expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill requires a GUAIKEI_API_TOKEN and directs users to configure it, but the README does not clearly disclose that this credential will be sent to an external third-party service to perform requests. Users may incorrectly assume the token is only used locally, which weakens informed consent and increases the risk of credential misuse, leakage, or trust boundary confusion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is written with a Chinese-only title and the document continues in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This function sends the provided token and video URL to an external API endpoint to create a comment task. While the code has developer-facing comments, there is no confirmation prompt, user-facing log, or other disclosure in this file indicating that user data is being transmitted off-system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This function performs a GET request to a remote API using the token, URL, and limit as request parameters. The operation transmits identifying/request context to an external service, but the file contains no user-facing notice or confirmation about that data sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI persists fetched comment data to a local JSON file automatically, without explicit user consent, visibility, or any controls around where the file is stored. In this skill's context, comment results may contain personal data, usernames, or sensitive moderation/monitoring output, so silent retention increases the risk of unintended disclosure through shared workstations, backups, logs, or later exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code returns error text in Chinese (for example, "请求失败") as part of user-visible exceptions. The file provides no opt-in, fallback, or justification that the skill is intentionally Chinese-only, which creates a natural-language locale policy issue under the language-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The AuthError message is entirely Chinese and appears intended for end users troubleshooting token issues. Because the file does not provide localization or an explicit documented regional scope, this is a language policy violation rather than just an implementation detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-facing strings in this file are entirely in Chinese, including warnings and status messages, with no indication that language is configurable or that the skill is intended only for a Chinese-speaking or region-specific context. This creates a natural-language locale policy issue because the skill imposes a specific language on users without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest-style JSON schema contains user-facing natural language fields such as title and description entirely in Chinese. Because the file provides no opt-in, alternative language, or documented region-specific justification, it may violate language/locale policy requirements for offering choice or documenting constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The schema title and description are written only in Chinese, which can constitute a language/locale policy issue when a skill imposes a specific language without user opt-in or documenting that it is region-specific. In this file there is no accompanying indication that the schema is intentionally limited to Chinese users or Douyin-specific locale requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This manifest-format JSON schema uses Chinese-only natural-language title and field descriptions throughout, with no indication that the skill is intentionally region-specific or that other language/locale options exist. Under the policy rule, forced language choice without opt-in or documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The schema's title and field descriptions are written entirely in Chinese, which imposes a specific language on users and integrators. Because the file does not indicate that the skill is region-specific or provide any language/locale alternative, this appears to violate the language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON schema is a manifest-type file, so natural-language policy checks apply. The title and descriptions consistently force a single language/locale, and there is no indication that this is optional, configurable, or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON schema contains user-facing title and description strings only in Chinese, which can impose a fixed language on users or downstream tools without any opt-in or documented regional justification. The policy specifically flags language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the title and field descriptions, which imposes a specific language on users or downstream tooling. The file does not offer a language choice or explain that the schema is intentionally limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description is entirely in Chinese and presents the skill as a Chinese-only tool, but does not indicate whether users can choose another language or whether the locale restriction is intentional and required. Under the policy, language or locale constraints should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.