Security audit

GUAIKEI TikTok达人筛选与KOL推荐

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed TikTok public-data CLI skill that uses a GUAIKEI API token, sends user queries or URLs to guaikei.com, and saves local temp logs without hidden persistence or destructive behavior.

Install only if you are comfortable sending your GUAIKEI_API_TOKEN and TikTok search terms, profile URLs, or video IDs to www.guaikei.com. Results are also saved locally under the system temp directory, so clear those logs if the queries or retrieved public comments are sensitive for your team.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declaration promises TikTok达人 discovery, filtering, content/reach/commercial analysis, and three concrete capabilities around search,作品获取, and评论抓取. The supplied code chunk contains only utility functions for parsing CLI arguments (parseArgs, readValueAfterFlag) and generating help text (buildHelp). It does not access TikTok, make network requests, process creator/video/comment data, analyze engagement, or output the described structured JSON payloads. While argument parsing could be a supporting component of a larger TikTok tool, this chunk by itself does not implement the declared functionality and instead has a materially different immediate purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 代码片段的实际功能仅是本地日志落盘工具，与声明中的 TikTok 达人搜索、作品抓取、评论抓取、互动数据分析等核心能力无直接对应关系。虽然日志记录可被视为辅助实现细节，但当前提供的代码片段本身只体现了文件系统写入能力，且这是声明中未提及的资源访问行为（本地文件系统/临时目录）。因此，就该代码片段而言，描述与行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description forces a specific language/locale in natural-language content and does not indicate that users may choose another language. Under the policy, language constraints should either be optional for users or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/options.md (reported line 14)May include surrounding context.
node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>]

text
| 参数 | 缩写 | 作用 | 可选值 | 必填 | 默认 | | ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: | | `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接 | 是 | — | | `--sort` | `-s` | 排序方式 | `0` 相关度 / `1` 最多点赞 | 否 | `0` |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script persists the full output object, including request details and fetched results, via log.taskWrite(...). Although the skill logs progress messages, there is no user-facing disclosure here that data will be saved to disk, which matters because the operation stores retrieved content and metadata locally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script persists the full search output to disk via log.taskWrite, and the top-level help/output shown to the user does not disclose that results will be saved locally. For a CLI handling user-supplied queries and returned data, this is a safety-relevant file write that should be clearly communicated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file contains multiple natural-language strings in Chinese for validation errors, API failures, auth failures, timeout/network errors, and retry logs. Because the skill does not offer a language/locale choice or indicate that it is intentionally limited to Chinese users, this creates a language-policy concern under the natural-language policy rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code contains natural-language comments and user-visible error messages exclusively in Chinese, such as the validation errors emitted via utils.printError. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON schema uses Chinese-only natural-language titles and descriptions for the CLI parameters, but does not document that the skill is Chinese-only or offer any language choice. That can create a language/locale policy issue for users who are not expecting a forced locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON schema contains natural-language titles and descriptions exclusively in Chinese, which imposes a specific language on users or downstream tooling without indicating that language selection is optional. The policy requires flagging language or locale constraints when they are forced without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This manifest-style JSON file contains user-facing title and description fields entirely in Chinese, including parameter descriptions. Under the policy rule for natural-language violations, this is a locale/language constraint with no opt-in, alternative language, or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON schema includes natural-language title and description text exclusively in Chinese, which can violate a language/locale policy when no user choice or regional scoping is provided. The same pattern continues in property descriptions, indicating the skill is effectively fixed to a single locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest-type JSON schema uses Chinese-only natural-language titles and descriptions for user-facing fields, which can impose a language choice on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative locale, so it may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains user-facing natural-language titles and descriptions exclusively in Chinese, such as the top-level title/description and many property descriptions. For a general-purpose skill artifact, forcing a single language without opt-in or documenting a region-specific scope can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language description forces a single language context without offering an alternative language or documenting that the skill is intended only for Chinese-speaking users. This can violate language/locale policy requirements when users are not given a choice or opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: L115 在“统一输出信封”示例中将 skill_name 写为 tiktok-creator-videos，而当前技能清单名称是 tiktok-creator-screening。这是文档层面对技能意图/身份的直接不一致，可能误导调用方对该技能职责和来源的判断。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code sends user-supplied URL data and an authentication token through requestApi to a remote API, which is a network operation covered by the missing-warning rule for code files. In this file there is no confirmation prompt, user-facing log/print, or comment/docstring disclosing that the skill transmits this data externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This function performs a remote API request that includes URL and limit parameters and uses a token, but the file contains no user-facing warning, print/log, or explanatory comment about the network access. Under the rule, network calls that transmit user or system data should have some form of disclosure unless already clearly documented elsewhere.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI descriptions, help examples, and runtime messages are all presented in Chinese, and the file provides no option to select another language or indication that the tool is intentionally limited to a Chinese-speaking audience. This is a natural-language locale constraint that should be opt-in or explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The command descriptions, help text, and runtime messages are presented in Chinese only, with no indication that users can select another language or locale. This can violate a language/locale policy when the skill is not explicitly documented as Chinese-only or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file contains user-facing natural-language strings in Chinese, beginning with the top-level description and continuing throughout errors and help output. For a general-purpose CLI argument parser, forcing a specific language without user opt-in can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The parser emits all validation errors, warnings, and generated help text in Chinese only. Because this is reusable utility code rather than a clearly region-specific tool, the fixed locale constitutes a natural-language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest describes capabilities around TikTok keyword search, creator works retrieval, and video comment extraction with structured JSON output. This helper instead creates directories under the OS temp folder and writes caller-supplied content to disk, which is an additional persistence behavior not mentioned in the stated skill capabilities.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This file contains user-facing natural language exclusively in Chinese in the function documentation, and the thrown error message at L31 is also fixed to Chinese. Because the file does not indicate that the skill is region-specific or offer any language choice, this may violate language/locale policy requiring opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16