Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently retrieves public Kuaishou data through a disclosed third-party service, with no material security concern found in the bundled code.
Use a dedicated guaikei.com token and submit only queries or links you are comfortable sharing with that provider. Check plan costs before requesting large result sets. Leave optional logging disabled unless needed; enabled logs retain queries and results until removed. The bundled code was fully reviewed, but the provider's live behavior and retention practices were not verified.
Referenced artifact was not completely inspected
- "帮我搜快手里「具身智能」的高赞视频 → node scripts/kuaishou/search-cli.js --keyword \"具身智能\" --sort 2 --limit 20"
Referenced artifact was not completely inspected
- "最近一周最新的快手 AI 教程，要 20 条 → node scripts/kuaishou/search-cli.js --keyword \"AI 教程\" --sort 1 --time 7 --limit 20"
Referenced artifact was not completely inspected
| 找选题、看高赞 | `search-cli.js` | 视频数组。点赞、播放、评论是数字 |
Referenced artifact was not completely inspected
3. 有关键词，且没有上面两类信号 → `search-cli.js`
Referenced artifact was not completely inspected
ut 为空，这是正常现象。短参数大小写都可以。含空格的关键词用双引号包成一个参数。关键词以 `-` 开头时写成 `--keyword=-AI`，或 `node scripts/kuaishou/search-cli.js -- -AI`。完整字段见 `assets/*_cli_req.schema.json` 与 [r
Referenced artifact was not completely inspected
- "这条快手视频评论区在说什么 → node scripts/kuaishou/comment-cli.js --url \"https://www.kuaishou.com/short-video/3xabc\" --limit 40"
Referenced artifact was not completely inspected
| 看评论区 | `comment-cli.js` | 评论数组 |
Referenced artifact was not completely inspected
1. 要评论、留言、舆情，且对象是一条视频 → `comment-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/short-video/{id}`、`v.kuaishou.com/*`、裸的 `3x...` 只能给 `comment-cli.js`。搜索结果里用视频 `id` 或 `url`
Referenced artifact was not completely inspected
| 评论区 | `comment-cli.js`。没说条数用默认 10 |
Referenced artifact was not completely inspected
- "这个快手博主最近 20 条作品 → node scripts/kuaishou/post-cli.js --url \"https://www.kuaishou.com/profile/3xabc\" --sort 0 --limit 20"
Referenced artifact was not completely inspected
- "这个快手博主多少粉丝 → node scripts/kuaishou/post-cli.js --url 123456 --limit 0"
Referenced artifact was not completely inspected
2. 要作品、主页、账号、博主、粉丝 → `post-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/profile/{id}` 只能给 `post-cli.js`
Referenced artifact was not completely inspected
- 纯数字 `user_id` 只能给 `post-cli.js`。搜索结果里用 `user.user_id`，或直接用 `user.url`
Without declared permissions the skill's intent is opaque and cannot be validated.
The quick-start requires a third-party token but does not explicitly explain that search keywords and supplied links are sent to that provider. Users following this README could disclose confidential research interests or investigation targets without understanding the data flow; this is a limited transparency weakness, not evidence of malicious exfiltration.
The natural-language specification fixes timestamps to Beijing time, and the implementation applies UTC+8 unconditionally. Although the constraint is documented, the file offers neither a user-selectable timezone nor a justification for overriding the user's locale preferences.