快手运营分析助手

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 3:24 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Kuaishou public-data CLI integration, with expected third-party API use and local result logging.

Install only if you are comfortable sending Kuaishou search terms, profile or video URLs, limits, and your GUAIKEI_API_TOKEN to the third-party API service. Treat the generated logs as potentially sensitive business records and delete or protect them when no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A strong description-behavior mismatch exists if the skill claims platform-data access and analytics but no Kuaishou/API interaction is present and behavior instead targets local/package metadata. This is dangerous because it can mask the real operational surface of the skill, defeat user consent, and undermine security review by hiding what the code actually does versus what operators expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A strong description-behavior mismatch exists if the skill claims platform-data access and analytics but no Kuaishou/API interaction is present and behavior instead targets local/package metadata. This is dangerous because it can mask the real operational surface of the skill, defeat user consent, and undermine security review by hiding what the code actually does versus what operators expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A strong description-behavior mismatch exists if the skill claims platform-data access and analytics but no Kuaishou/API interaction is present and behavior instead targets local/package metadata. This is dangerous because it can mask the real operational surface of the skill, defeat user consent, and undermine security review by hiding what the code actually does versus what operators expect.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares use of an environment variable (`GUAIKEI_API_TOKEN`) but does not define explicit tool scope such as `permissions` or `allowed-tools`. In agent ecosystems, missing scope boundaries can let a skill access secrets or execution features more broadly than intended, weakening containment and reviewability.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill instructions and operational guidance are written entirely in Chinese, and the manifest description is primarily Chinese, with no statement that users may choose another language or locale. Under the policy for natural-language constraints, forcing a specific language without opt-in is a violation unless the locale limitation is explicitly justified.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The package description contains broad activation phrases such as when the user wants to search videos, scrape creator posts, or fetch comments, without clear scope limits, authorization checks, or exclusions. In an agent environment, this can cause over-triggering and invoke data-collection behavior in situations the user did not explicitly intend, increasing the risk of privacy-impacting scraping or policy-violating automation.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The user-facing description is entirely in Chinese and presents the skill as operating in that language without indicating any user opt-in or alternative locale support. This can be a natural-language policy issue if the skill implicitly constrains language behavior rather than offering a choice or documenting that it is intentionally Chinese-only.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that all task results are automatically saved to the logs directory, but it does not clearly warn users that searched keywords, queried profile/video URLs, and collected public-data outputs may persist on disk. In a marketing-intelligence context, those artifacts can expose sensitive business intent, monitoring targets, or scraped datasets to other local users, backups, or downstream tooling.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all usage instructions, parameter descriptions, and examples only in Chinese. Under the policy rule for natural-language violations, forcing a single language without user opt-in or justification is a locale/language policy issue.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script writes fetched comment data to a local JSON file as a side effect after already printing the results to stdout. This can expose collected data to unintended local users, leave residual sensitive or regulated content on disk, and violate least-surprise because the skill description emphasizes structured output but does not disclose persistent local storage.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The CLI writes the full fetched results to a local JSON file after completing a read-oriented operation. Because the data may include creator metadata, post details, and potentially sensitive operational datasets, automatic persistence creates unnecessary local data retention and can leak information to other local users, backup systems, or downstream tooling without the user's explicit consent.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI writes full search output to a local file whose name includes the user keyword, creating undeclared data persistence beyond the stated structured-output behavior. In this skill context, search queries and returned creator/content metadata may be sensitive from a privacy, operational, or compliance perspective, and local retention increases the chance of unintended disclosure on shared hosts or agent environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The tool silently saves search results to disk after presenting itself as a search/output utility, so users may not realize their queries and collected data are being retained. In a data-collection skill that processes public-platform content for monitoring and analysis, undisclosed persistence materially raises privacy and governance risk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The code emits all user-facing status and error messages in Chinese, and nothing in this file indicates that the locale is optional or justified as region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Multiple user-visible error strings are hardcoded in Chinese, such as 请求失败, 响应解析失败, and token-related guidance. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction, which fits the language-policy violation category.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code emits validation and error messages exclusively in Chinese (for example at L05, L10, L14, L18, L23). That creates a language/locale policy concern because the skill forces a specific language without any visible user opt-in or documented region-specific justification in this file.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The natural-language instructions throughout the file require Chinese comprehension, effectively forcing a specific language for use of the skill. The policy allows locale constraints when explicitly documented and justified, but this README does not provide an opt-in language choice or state that the skill is intentionally Chinese-only.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The changelog title and entries are entirely in Chinese, and the file does not indicate that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice or clear justification is a natural-language policy concern.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This code sends a user-provided URL and an authentication token to remote API endpoints via postJson/getJson. While retry errors are logged, there is no confirmation prompt, comment, docstring, or other user-facing disclosure in this file explaining that external transmission occurs.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This code transmits the `url`, `sort`, and `limit` parameters to remote API endpoints via `postJson` and `getJson`. Within this file there is retry logging for failures, but no confirmation, warning, or user-facing disclosure that user-supplied data will be sent over the network.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The `getPostTask` function performs an HTTP request that includes the user-provided `url`, `sort`, and `limit` values and an authentication token. The file contains error logs for retries, but no user-facing notice that these values are sent to a remote service.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This code presents user-facing descriptions, help examples, status messages, and errors entirely in Chinese across the CLI flow. Under the policy rule for natural-language violations, forcing a specific language without opt-in is reportable when no alternative locale or language choice is provided.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The manifest frames the skill as fetching public Kuaishou data such as videos, creator posts, and comments. This file additionally depends on a credential from process.env (GUAIKEI_API_TOKEN), which is a capability outside the user-facing purpose and not justified by the description itself.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The manifest describes a Kuaishou public-data retrieval tool for searching videos, listing creator posts, and fetching comments. In this file, the command reads `process.env.GUAIKEI_API_TOKEN` to obtain credentials for a backend service, which is an additional capability not mentioned in the stated purpose and not directly visible from the manifest description.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The skill's help text and argument descriptions are presented only in Chinese, and the file does not offer any user opt-in or locale selection. This can violate language/locale policy expectations when a skill is used in broader contexts without documented justification.

Static analysis

No suspicious patterns detected.