Security audit

快手关键词搜索助手

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently retrieves public Kuaishou search, creator-post, and comment data through a disclosed third-party API, with local result logging users should be aware of.

Before installing, confirm you are comfortable sending Kuaishou keywords, profile/video URLs, limits, and your GUAIKEI_API_TOKEN to the GuAikei service. Treat generated logs as retained datasets: delete or protect them if searches, URLs, comments, or competitive research topics are sensitive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill should retrieve real-time Kuaishou public data such as search results, creator works, and comments. However, the provided code is an unrelated utility module for parsing CLI arguments (`parseArgs`, `readValueAfterFlag`) and generating help text (`buildHelp`). It contains no network requests, no Kuaishou-specific logic, no scraping or API access, and no data output beyond parsed arguments/help text. This is a material mismatch in primary purpose and actual capabilities, not merely a supporting implementation detail, because the chunk does not implement any of the advertised Kuaishou data functions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill retrieves Kuaishou public data such as search results, creator works, and comments. However, this code chunk only implements a helper function to write log content to a local file using Node.js fs/path APIs. It accesses the local filesystem, which is not mentioned in the declared purpose, and it does not show any Kuaishou-related networking, scraping, API calls, or structured data retrieval. While logging can be a supporting detail in a larger skill, this supplied chunk by itself does not match the declared primary purpose and instead demonstrates an undeclared local file-writing capability.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises Kuaishou public data access capabilities such as keyword search, creator post listing, and comment retrieval. The supplied code chunk does none of that. It merely uses Node.js fs/path modules to locate and read a local package.json file, then returns its name field. This is a materially different purpose from the declared behavior. While utility code can be supportive, this specific chunk shows only unrelated package metadata access and no evidence of the advertised Kuaishou operations, so the description does not accurately represent the actual code shown.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Automatically saving all task results to logs/ can expose searched keywords, target profile/video URLs, comments, and returned datasets on disk without explicit user warning or consent. On shared machines, CI runners, or synced workspaces, these files can leak competitive intelligence, sensitive research targets, or personal data contained in public comments.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI writes the full fetched comment dataset to a local JSON file after printing results, but this persistence is not apparent from the skill description or from an explicit user consent flow in the script. Because comments may contain personal data or sensitive content, undisclosed local storage increases the risk of unintended retention, later exfiltration, or access by other local users/processes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script saves comment data to a local JSON file without a user-facing warning in this workflow, creating silent data retention beyond the immediate command output. This is risky because comment payloads can include usernames, text, timestamps, or other metadata that users may not expect to be stored on disk.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script persists the full creator-post response to a local JSON file after printing results, which creates undisclosed data retention beyond the stated interactive output behavior. If the returned data contains personal data, identifiers, or sensitive business intelligence, it can remain on disk and be accessed later by other local users, processes, or backup systems.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code performs outbound HTTPS GET and POST requests and includes a TOKEN header plus serialized request data, which can transmit user or system data to a remote service. The file contains no confirmation prompt, logging, comments, or docstring warning users that data and authentication material are being sent over the network.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The functions require a token string and then place it into the outbound HTTP header as TOKEN. Although the code validates presence and reports invalid-token errors, it does not include any warning or documentation that a credential is being consumed and sent to an external endpoint.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This file contains user-facing natural-language text only in Chinese, including warnings and informational output. The policy explicitly flags language or locale restrictions when the skill forces a specific language without user opt-in, and there is no indication here that the skill is region-specific or that users can choose another language.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This JavaScript file contains multiple user-facing string literals in Chinese for validation errors. Because the skill does not indicate that it is China/Chinese-specific or provide any user opt-in for language selection, it appears to force a specific language, which matches the locale-policy violation criteria.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The package description and keywords are entirely in Chinese, which presents the skill in a single language with no indication of user choice or locale scoping. Under the policy rule for natural-language violations, this can be treated as a language/locale constraint that is neither explicitly optional nor justified as region-specific in the file.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: Natural-language policy violations include forcing a specific language without user opt-in. This README presents all instructions and operational guidance solely in Chinese, with no indication of language options or an explicit justification that the skill is intended only for Chinese-speaking users.

Intent-Code Divergence

Low

Confidence: 73% confidence
Finding: The documentation emphasizes '无需部署服务' and lightweight one-click Node.js execution, which suggests minimal external setup. But later sections require contacting the developer or visiting a website to obtain an API token and explicitly require network access, indicating reliance on an external service for core functionality. This is a documentation-level contradiction about operational independence, not merely an omitted detail.

Description-Behavior Mismatch

Low

Confidence: 79% confidence
Finding: The README frames the skill as a public-data Kuaishou analysis tool that does not require logging into Kuaishou or involve user privacy data. However, the usage instructions also require obtaining a GUAIKEI_API_TOKEN from an external vendor service, meaning operation depends on a third-party data/API backend beyond direct public-data access. This is a mild description-behavior mismatch because the dependency is disclosed elsewhere, but the summary claims can lead users to expect a more self-contained public scraping tool.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: This markdown file is entirely written in Chinese, including headings, parameter descriptions, and examples, and it does not indicate that the user can choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a violation unless the locale constraint is clearly justified.

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The manifest frames the skill as a Kuaishou data retrieval tool and does not mention handling credentials or environment-based secret access. Reading `process.env.GUAIKEI_API_TOKEN` adds a credential-access capability that is operationally useful but not justified by the stated purpose alone.

Context-Inappropriate Capability

Low

Confidence: 77% confidence
Finding: The stated purpose focuses on searching Kuaishou public data and returning structured results. This file also depends on a credential loaded from process.env, which introduces secret access not mentioned in the manifest and is not evident from the user-facing purpose alone.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The code reads `process.env.GUAIKEI_API_TOKEN`, which is a sensitive credential access. While the script logs URLs and status messages, this file does not include a user-facing disclosure, confirmation, or comment/docstring warning that credentials will be consumed during execution.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The script writes fetched result data to a predictable local JSON log file without explicit user consent or notice in this file. Silent persistence increases the chance of unintended retention and secondary exposure of scraped creator data through local access, shared workspaces, or log collection systems.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The CLI sends user-provided keywords and search parameters to a remote API but does not clearly warn the user that their query data will leave the local environment. In a data-collection/search skill, this is a genuine privacy/transparency issue because operators may input sensitive names, brands, or investigation terms without realizing they are transmitted externally.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The script persists the full search output to a local JSON file using a filename derived from the keyword, but this behavior is not clearly disclosed to the user. That can expose potentially sensitive search terms and collected results to other local users, backups, or monitoring tools, especially on shared systems.

Natural-Language Policy Violations

Low

Confidence: 98% confidence
Finding: This JavaScript file contains natural-language comments, error messages, and help output exclusively in Chinese, such as the module description, thrown errors, and generated CLI help text. The policy requires flagging language or locale constraints when a skill forces a specific language without offering user choice or documenting a justified regional scope.

Natural-Language Policy Violations

Low

Confidence: 98% confidence
Finding: The code emits user-facing error messages in Chinese only (and also a success message later), with no indication that the skill is limited to Chinese-speaking users or that another locale is supported. This is a natural-language policy concern because it imposes a specific language without user opt-in.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:15