Security audit

TikTok带货达人筛选

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed, read-only TikTok data CLI that uses a third-party API token and saves result logs locally, so users should review the privacy and logging tradeoffs before use.

Install only if you are comfortable sending TikTok search terms, profile/video URLs or IDs, and your GUAIKEI_API_TOKEN to www.guaikei.com. Expect result JSON files, including public comments and creator identifiers, to be saved under the system temp directory; clean them up if they contain sensitive research context and confirm your use complies with TikTok terms and applicable privacy rules.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个较完整的TikTok达人筛选与内容/评论/市场分析工具，但给出的代码片段只涉及“作品/帖子”级别的数据任务：提交一个TikTok post URL，指定排序和数量限制，然后查询任务结果。代码中没有任何与达人搜索、达人画像、互动/带货效果评估、评论采集分析、竞品账号监控或市场研究逻辑相关的实现。虽然声明中包含“获取TikTok视频数据、抓博主作品”等场景，与帖子/作品查询有部分表面相关性，但该代码的实际主功能明显更窄，且与声明的核心能力（达人筛选与合作候选推荐）不一致，因此应判定为描述与行为存在实质性不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: 声明描述的是一个范围很广的TikTok达人筛选与分析能力集合，包括KOL筛选、合作优先级判断、评论分析、市场研究和热点挖掘等。但这段代码的实际功能非常有限，只是创建并查询“关键词搜索”任务，然后对搜索结果做少量字段加工。代码中没有看到按点赞/类目/市场筛选、达人互动和带货效果分析、评论抓取、竞品监控或舆情分析的实现。因此，实际行为仅覆盖了声明中的一小部分“TikTok搜索/获取作品结果”相关内容，无法支撑其主要宣称能力，属于明显的描述与行为不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, this is a mismatch based on the supplied code chunk. The description claims substantial TikTok-focused discovery, scraping, filtering, analytics, and prioritization capabilities. However, the code shown is only a constants/config file and contains no logic that carries out any of those behaviors. The only observable behavior is declaring generic network-related settings and a non-TikTok base domain (www.guaikei.com). While a constants file can be a supporting part of a larger implementation, evaluating this chunk alone, it does not substantiate the declared purpose and instead points to generic external service configuration unrelated to the specific TikTok-analysis functionality described.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: 声明描述的是一个较完整的TikTok达人筛选与分析工具，核心应包括达人搜索、条件筛选、互动/带货效果分析和候选排序。给定代码却只实现了“根据博主主页URL或sec_uid获取作品列表”的CLI流程：参数解析、URL规范化、调用创建/查询作品任务接口、输出结果并写日志。它确实与声明中的“获取TikTok视频数据、抓博主作品”部分有一定相关性，但无法支撑声明中的主要能力，尤其是达人筛选、合作优先级、评论分析和市场研究等。因此描述与实际行为存在明显能力范围不一致，属于实质性不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 声明描述的是一个较完整的TikTok达人筛选与市场研究分析技能，重点在KOL候选发现、数据分析和优先级判断。给出的代码块仅实现了基于关键词的TikTok搜索CLI，支持排序、时间和数量参数，并返回搜索结果。虽然“TikTok搜索/获取作品数据”与声明中的部分触发词有弱相关，但该代码没有看到达人识别、达人维度筛选、评论获取、市场/类目过滤、合作评分、竞品监控或舆情分析等核心能力。因此代码行为只覆盖了声明中的一个基础子能力，无法支撑其主要宣称用途，属于明显的描述与实际行为不一致。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是面向 TikTok 达人筛选与内容/评论/市场分析的业务能力，预期应包含与 TikTok 搜索、数据抓取、达人评估、评论分析或竞品监控相关的实现。而提供的代码仅实现了一个与具体业务无关的通用 CLI 参数解析模块（parseArgs、readValueAfterFlag、buildHelp）。它不访问 TikTok、不处理达人或视频数据，也不执行任何分析或筛选逻辑。虽然这类工具代码可能作为更大系统的辅助组件存在，但就当前代码块本身而言，其行为与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 代码片段实际仅实现日志落盘功能，使用 fs/path/os 在本机临时目录中创建 `tiktok-guaikei/logs/日期` 路径并写入文件。声明的用途则集中在 TikTok 达人筛选、评论/作品获取、市场调研、竞品分析等数据分析能力。虽然日志记录可能属于辅助实现细节，但这里代码表现出的核心能力是本地文件写入，而声明中既未提及此类资源访问，也未体现日志保存功能。基于给定片段，代码行为与声明用途不一致，应判定为描述与行为存在明显偏差。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码片段只是底层通用工具模块，用于异步任务重试和错误处理，不涉及TikTok数据访问、筛选逻辑、互动/带货效果分析、评论或作品抓取等声明中的核心能力。根据评估标准，虽然辅助实现细节本身不一定需要逐一在描述中声明，但当前提供的代码片段与声明的主要用途几乎完全无关，无法支撑所述技能功能，因此应判定为描述与实际行为不匹配。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares access to an environment secret (`GUAIKEI_API_TOKEN`) but does not define an explicit tool scope such as permissions or allowed-tools. That creates unnecessary ambiguity about what execution capabilities the skill is expected to have and weakens least-privilege controls around secret access and command execution.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match generic marketing, research, and content-analysis requests beyond clearly TikTok-specific tasks. Over-broad activation can cause unintended invocation of a networked skill that sends user queries and URLs to a third-party service, increasing accidental data disclosure and unnecessary secret usage.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The manifest description includes very broad trigger phrases such as market research, competitor analysis, comment monitoring, hotspot tracking, and generic TikTok search terms, which can overlap with many ordinary user requests. In an agent-routing system, this can cause the skill to be invoked outside its intended scope, potentially exposing users to unintended data collection or causing the agent to perform actions the user did not explicitly request.

Whitespace Padding

Medium

Category: Prompt Injection
Content: node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>] ``` | 参数 | 缩写 | 作用 | 可选值 | 必填 | 默认 | | ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: | | `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接 | 是 | — | | `--sort` | `-s` | 排序方式 | `0` 相关度 / `1` 最多点赞 | 否 | `0` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documentation explicitly supports bulk collection of TikTok profile, post, and comment data, including user identifiers and comment text, but provides no privacy, retention, consent, or lawful-use guidance. In a market-research and creator-screening context, this omission increases the risk of overcollection, misuse of personal data, and noncompliant downstream processing of public-but-personal information.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI writes full comment retrieval results to a local JSON file automatically, with no opt-in, warning, retention control, or redaction in this file. Because TikTok comments and associated metadata may contain personal data or sensitive market-research output, this creates a privacy and data-handling risk if the file is stored insecurely, shared unintentionally, or collected by other local processes.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: User-facing descriptions, help examples, status messages, and error text are presented only in Chinese throughout the file. This creates a language-policy issue because the skill fixes a locale without any opt-in, selection mechanism, or justification for a Chinese-only audience.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI writes the full task output to a local JSON file after execution, including request details and scraped TikTok results, without any visible notice, consent, or opt-out in this file. In a data-collection skill, silent persistence increases privacy and data-handling risk because users may assume the tool only prints results to stdout, while sensitive or proprietary research data is also retained on disk.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: Descriptions, examples, and notices in the command help are presented only in Chinese, and the rest of the CLI output follows the same pattern. This imposes a fixed language/locale on all users without any opt-in, selection mechanism, or documented region-specific justification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The CLI persists full search output, including user query terms and returned TikTok content, to a local JSON file without any notice, consent flow, retention limit, or redaction. In this skill’s context, queries may reveal business research, competitor monitoring targets, or sensitive marketing intent, so local persistence can expose confidential operational data to other local users, backups, or log collection systems.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code emits multiple natural-language strings such as "请求失败", "响应解析失败", and other Chinese-only messages in exceptions and retry logs. Because the file does not provide any user opt-in, language selection, or documented region-specific justification, it violates the language/locale policy for natural-language behavior.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The AuthError message "GUAIKEI_API_TOKEN 无效, 请检查环境变量" is a user-facing diagnostic string in Chinese only. Credential and setup failures are especially important to communicate clearly, so forcing one locale without opt-in is a policy violation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: Validation errors like "path 必须是非空字符串" and retry log output containing "重试" are natural-language strings that will surface to users or operators in a fixed language. The file gives no indication that users can choose their preferred language or that the skill is restricted to a Chinese locale.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The warning and info strings at L22 and L26 are written only in Chinese, which can force a specific language on users without opt-in. The file does not indicate that this skill is intentionally limited to Chinese-speaking users or provide any language-selection mechanism.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: L216 在输出 JSON 示例中将 `skill_name` 写为 `tiktok-creator-videos`，而该文件清单与全文都在描述 `tiktok-creator-match`。这不是单纯的省略信息，而是对实际技能身份的直接矛盾，可能误导调用方基于错误技能来源做路由或审计。

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This JSON schema contains user-facing natural-language fields such as title and description entirely in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the file clearly documents that it is intentionally region-specific, which this schema does not.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The title and description fields force a specific language in natural-language metadata, which can violate language/locale policy when no user opt-in or documented regional scope is provided. The file contains no indication that this schema is intended only for a Chinese-language or region-specific context.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16