Security audit
Security checks for vulnerabilities and agentic risk
The skill performs its advertised public Kuaishou research through a disclosed external service, with bounded requests and optional local logging.
Queries and supplied links go to www.guaikei.com using your provider token, so avoid confidential inputs and review its terms and plan limits. Optional logs retain queries and returned public profile/comment data until removed. All bundled files were reviewed to investigate scanner gaps; the external service's behavior and retention were not verified. Output timestamps use Beijing time.
Referenced artifact was not completely inspected
- "帮我搜快手里「具身智能」的高赞视频 → node scripts/kuaishou/search-cli.js --keyword \"具身智能\" --sort 2 --limit 20"
Referenced artifact was not completely inspected
- "最近一周最新的快手 AI 教程，要 20 条 → node scripts/kuaishou/search-cli.js --keyword \"AI 教程\" --sort 1 --time 7 --limit 20"
Referenced artifact was not completely inspected
| 找选题、看高赞 | `search-cli.js` | 视频数组。点赞、播放、评论是数字 |
Referenced artifact was not completely inspected
3. 有关键词，且没有上面两类信号 → `search-cli.js`
Referenced artifact was not completely inspected
ut 为空，这是正常现象。短参数大小写都可以。含空格的关键词用双引号包成一个参数。关键词以 `-` 开头时写成 `--keyword=-AI`，或 `node scripts/kuaishou/search-cli.js -- -AI`。完整字段见 `assets/*_cli_req.schema.json` 与 [r
Referenced artifact was not completely inspected
- "这条快手视频评论区在说什么 → node scripts/kuaishou/comment-cli.js --url \"https://www.kuaishou.com/short-video/3xabc\" --limit 40"
Referenced artifact was not completely inspected
| 看评论区 | `comment-cli.js` | 评论数组 |
Referenced artifact was not completely inspected
1. 要评论、留言、舆情，且对象是一条视频 → `comment-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/short-video/{id}`、`v.kuaishou.com/*`、裸的 `3x...` 只能给 `comment-cli.js`。搜索结果里用视频 `id` 或 `url`
Referenced artifact was not completely inspected
| 评论区 | `comment-cli.js`。没说条数用默认 10 |
Referenced artifact was not completely inspected
- "这个快手博主最近 20 条作品 → node scripts/kuaishou/post-cli.js --url \"https://www.kuaishou.com/profile/3xabc\" --sort 0 --limit 20"
Referenced artifact was not completely inspected
- "这个快手博主多少粉丝 → node scripts/kuaishou/post-cli.js --url 123456 --limit 0"
Referenced artifact was not completely inspected
2. 要作品、主页、账号、博主、粉丝 → `post-cli.js`
Referenced artifact was not completely inspected
- `kuaishou.com/profile/{id}` 只能给 `post-cli.js`
Referenced artifact was not completely inspected
- 纯数字 `user_id` 只能给 `post-cli.js`。搜索结果里用 `user.user_id`，或直接用 `user.url`
Without declared permissions the skill's intent is opaque and cannot be validated.
The standalone quick start requires a third-party API token but does not explicitly explain that search keywords and supplied links are transmitted to that provider. This is a limited privacy-transparency weakness: users may submit confidential research terms or targeting interests without understanding the recipient, although the integration is overt and there is no evidence of malicious exfiltration.
The comment explicitly fixes timestamp output to Beijing time, and the function implements that restriction unconditionally. Although the constraint is documented, this source provides neither a user-selectable timezone nor a justification for overriding the user's locale preferences.