Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
快手用户需求洞察与产品机会分析
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently fetches public Kuaishou data through a disclosed third-party API and saves results locally, with no evidence of hidden or destructive behavior.
Install only if you are comfortable sending Kuaishou search terms or URLs to guaikei.com with your GUAIKEI_API_TOKEN. Treat the saved logs as retained research data: exclude them from source control, delete them when no longer needed, and avoid using the tool for private, login-only, or sensitive content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README states that all task results are automatically saved under
logs/, but it does not warn that these results may contain scraped URLs, search keywords, comment text, and engagement metadata. In this skill’s context, the data being collected is public, but automatic local persistence can still create unintended retention, disclosure, or compliance risks if logs are shared, committed to source control, or accessed by other users on the system.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document title and all usage instructions are presented only in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative language is provided. The file does not indicate that the skill is region-specific or that Chinese is a documented requirement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes the full comment-analysis output, including fetched comment data and request metadata, to a local JSON file after execution. For a tool described primarily as fetching and analyzing public data, silent persistence expands data retention and creates unnecessary exposure if the host is shared, monitored, or later compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code emits user-facing status and error messages only in Chinese (for example at L07, L11, L35, and L37). That creates a language/locale policy issue because the skill forces a specific language without user opt-in or any documented justification for a locale-specific scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple user-visible error strings are fixed in Chinese, such as request failures, timeout messages, and token validation guidance. This enforces a specific language without any indication of user opt-in or a documented region-specific justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs outbound HTTPS GET and POST requests and sends authentication data in the TOKEN header, plus request parameters and JSON payloads. Within this file there is no confirmation prompt, logging, comment, or docstring disclosing that user or system data may be transmitted to a remote service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The package description at L04 presents the skill entirely in Chinese, which may impose a specific language on users without stating that Chinese is optional or region-specific. Under the policy criteria, language-specific natural-language content can be a violation when no user choice or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file contains only Chinese-language natural-language content, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the language/locale policy check, forcing a specific language without user choice can be a policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The functions send a user-provided
urlto remote API endpoints and include atokenfor authentication, which is a network operation involving potentially sensitive user or system data. While retry errors are logged, there is no confirmation prompt, user-facing notice, or explanatory comment/docstring in this file disclosing that this data is transmitted.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
Both exported functions accept a token and pass it into outbound API calls, indicating handling of credential material. In this file there is no inline documentation, warning, or disclosure describing the sensitivity of the token or that it will be used for authenticated remote requests.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code sends user-provided search data and a token to remote API endpoints via postJson/getJson, which is a safety-relevant network operation for a code file. While retry errors are logged, there is no confirmation prompt, user-facing disclosure, or comment/docstring here explaining that user input and credentials are transmitted over the network.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script saves comment data to disk without an explicit warning or consent path in this code path. Even if the source data is public, users may not expect persistent local storage, which can create privacy, compliance, or operational issues when handling large-scale scraped comment datasets.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest frames the skill as operating on public Kuaishou data for insight generation, while this file additionally depends on a separate API token from the process environment. Although likely needed for the backend service implementation, credential access is not part of the user-facing purpose and is an extra capability beyond the stated analytical scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code reads a sensitive credential from process.env.GUAIKEI_API_TOKEN and uses it to perform API operations, but the file itself does not include a confirmation prompt, warning comment, or docstring disclosing that credential access occurs. Under the code-file criteria, sensitive environment-variable access should have some visible disclosure unless already documented elsewhere.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI writes full fetched results to a local JSON file using a filename derived in part from user input. Even though the data is from public Kuaishou sources, local persistence can create unintended data retention, expose scraped data to other local users/processes, and surprise operators because storage behavior is not clearly disclosed in the CLI flow.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The tool silently writes retrieved results to disk without explicit user-facing disclosure in this file. Hidden persistence is risky because users may assume the command only prints results, while the saved JSON may remain accessible on shared systems or be collected by backups and other processes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The CLI writes full search output to a local JSON file whose filename includes the user-supplied keyword. In this skill’s context, search queries and returned public-content analytics may still be sensitive business research data, and persisting them to disk without clear opt-in or warning can leak information to other local users, backups, or logs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains user-facing error messages, comments, and generated help text entirely in Chinese, which effectively imposes a specific language on users. The file does not offer a language/locale option or indicate that the skill is intentionally region-specific, so it may violate the language/locale policy for natural-language content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The thrown error string is hard-coded in Chinese (
重试${maxAttempts}次后失败). This imposes a specific language in user-visible output without offering a locale choice or documenting that the skill is intentionally region-specific.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code emits user-facing warning and info strings only in Chinese ("警告: 你的 GUAIKEI_API_TOKEN 未正确配置" and "已使用配置的私有TOKEN"). For a general utility module, this imposes a specific language on users without opt-in or any documented region-specific justification, matching the locale-policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains Chinese-only natural-language strings in the module comment and printed banner text, which imposes a specific language on users. The file does not offer a language choice or document that the skill is intentionally region-specific, so this appears to violate the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains multiple user-facing error strings in Chinese, such as the validation failures and examples. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue, and this file provides no indication that the skill is intentionally region-specific or configurable.
- Content
Static analysis
No suspicious patterns detected.