Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill benign with medium confidence: the completed AIG scan reported no findings, while Skillspector noted purpose-related concerns and incomplete inspection of some files.
The verdict is benign, but the evidence is incomplete: Skillspector reports 62.5% coverage, with 12 files only partially inspected. Before installing, consider that the scanner finding says keywords and links are sent to GUAIKEI, and avoid submitting inputs you consider confidential.
Referenced artifact was not completely inspected
- "帮我搜快手里「具身智能」的高赞视频 → node scripts/kuaishou/search-cli.js --keyword \"具身智能\" --sort 2 --limit 20"
Referenced artifact was not completely inspected
- "最近一周最新的快手 AI 教程，要 20 条 → node scripts/kuaishou/search-cli.js --keyword \"AI 教程\" --sort 1 --time 7 --limit 20"
Referenced artifact was not completely inspected
| 找选题、看高赞 | `search-cli.js` | 视频数组。点赞、播放、评论是数字 |
Referenced artifact was not completely inspected
3. 有关键词，且没有上面两类信号 → `search-cli.js`
Referenced artifact was not completely inspected
ut 为空，这是正常现象。短参数大小写都可以。含空格的关键词用双引号包成一个参数。关键词以 `-` 开头时写成 `--keyword=-AI`，或 `node scripts/kuaishou/search-cli.js -- -AI`。完整字段见 `assets/*_cli_req.schema.json` 与 [r
Referenced artifact was not completely inspected
- "这条快手视频评论区在说什么 → node scripts/kuaishou/comment-cli.js --url \"https://www.kuaishou.com/short-video/3xabc\" --limit 40"
Referenced artifact was not completely inspected
| 看评论区 | `comment-cli.js` | 评论数组 |
Referenced artifact was not completely inspected
1. 要评论、留言、舆情，且对象是一条视频 → `comment-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/short-video/{id}`、`v.kuaishou.com/*`、裸的 `3x...` 只能给 `comment-cli.js`。搜索结果里用视频 `id` 或 `url`
Referenced artifact was not completely inspected
| 评论区 | `comment-cli.js`。没说条数用默认 10 |
Referenced artifact was not completely inspected
- "这个快手博主最近 20 条作品 → node scripts/kuaishou/post-cli.js --url \"https://www.kuaishou.com/profile/3xabc\" --sort 0 --limit 20"
Referenced artifact was not completely inspected
- "这个快手博主多少粉丝 → node scripts/kuaishou/post-cli.js --url 123456 --limit 0"
Referenced artifact was not completely inspected
2. 要作品、主页、账号、博主、粉丝 → `post-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/profile/{id}` 只能给 `post-cli.js`
Referenced artifact was not completely inspected
- 纯数字 `user_id` 只能给 `post-cli.js`。搜索结果里用 `user.user_id`，或直接用 `user.url`
Without declared permissions the skill's intent is opaque and cannot be validated.
The quick-start instructions direct users to configure a GUAIKEI token and execute searches and URL-based queries, but this file does not explain that those inputs are sent to a third-party service. Mentioning the token provider and stating that no Kuaishou login is required do not disclose the privacy implications of transmitting potentially sensitive research keywords or target links.
The comment explicitly fixes timestamp output to Beijing time, and the function implements that locale constraint unconditionally. No user choice or justification for requiring this timezone is provided in this source.