Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill benign because the reported findings point to incomplete inspection and a privacy disclosure gap, with no reported evidence of malicious behavior; confidence is medium.
The verdict is benign, but treat it as a qualified assessment because analysis was partial. Before installing, consider whether you are comfortable sending your search terms and links to the third-party service; avoid confidential research terms unless you have authorization.
Referenced artifact was not completely inspected
- "帮我搜快手里「具身智能」的高赞视频 → node scripts/kuaishou/search-cli.js --keyword \"具身智能\" --sort 2 --limit 20"
Referenced artifact was not completely inspected
- "最近一周最新的快手 AI 教程，要 20 条 → node scripts/kuaishou/search-cli.js --keyword \"AI 教程\" --sort 1 --time 7 --limit 20"
Referenced artifact was not completely inspected
| 找选题、看高赞 | `search-cli.js` | 视频数组。点赞、播放、评论是数字 |
Referenced artifact was not completely inspected
3. 有关键词，且没有上面两类信号 → `search-cli.js`
Referenced artifact was not completely inspected
ut 为空，这是正常现象。短参数大小写都可以。含空格的关键词用双引号包成一个参数。关键词以 `-` 开头时写成 `--keyword=-AI`，或 `node scripts/kuaishou/search-cli.js -- -AI`。完整字段见 `assets/*_cli_req.schema.json` 与 [r
Referenced artifact was not completely inspected
- "这条快手视频评论区在说什么 → node scripts/kuaishou/comment-cli.js --url \"https://www.kuaishou.com/short-video/3xabc\" --limit 40"
Referenced artifact was not completely inspected
| 看评论区 | `comment-cli.js` | 评论数组 |
Referenced artifact was not completely inspected
1. 要评论、留言、舆情，且对象是一条视频 → `comment-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/short-video/{id}`、`v.kuaishou.com/*`、裸的 `3x...` 只能给 `comment-cli.js`。搜索结果里用视频 `id` 或 `url`
Referenced artifact was not completely inspected
| 评论区 | `comment-cli.js`。没说条数用默认 10 |
Referenced artifact was not completely inspected
- "这个快手博主最近 20 条作品 → node scripts/kuaishou/post-cli.js --url \"https://www.kuaishou.com/profile/3xabc\" --sort 0 --limit 20"
Referenced artifact was not completely inspected
- "这个快手博主多少粉丝 → node scripts/kuaishou/post-cli.js --url 123456 --limit 0"
Referenced artifact was not completely inspected
2. 要作品、主页、账号、博主、粉丝 → `post-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/profile/{id}` 只能给 `post-cli.js`
Referenced artifact was not completely inspected
- 纯数字 `user_id` 只能给 `post-cli.js`。搜索结果里用 `user.user_id`，或直接用 `user.url`
Without declared permissions the skill's intent is opaque and cannot be validated.
The quick start requires a third-party token but does not explicitly explain that supplied keywords and profile or video links are transmitted to that provider. Even when the retrieved platform content is public, search terms and selected targets can reveal confidential campaign plans or competitive research, making this a privacy disclosure gap rather than evidence of malicious exfiltration.
The comment explicitly requires Beijing time and a fixed regional date format, which the function implements unconditionally. Although the constraint is documented, the source provides neither user opt-in nor a reason that this regional setting is required.