Security audit

GUAIKEI TikTok需求挖掘评论分析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only TikTok data retrieval helper that sends user queries and a configured API token to GUAIKEI and saves fetched public results locally for analysis.

Before installing, confirm you are comfortable sending your GUAIKEI API token plus TikTok keywords, creator URLs, or video IDs to www.guaikei.com. Treat returned comments and usernames as personal/public user-generated data: keep logs only as long as needed, avoid redistributing raw identifiers, and verify platform terms and applicable privacy rules before commercial use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose promises substantial TikTok-facing collection and analytics capabilities, but the provided code only contains generic constants and retry configuration. While configuration files are normal supporting components, this particular chunk does not evidence any of the claimed functionality, and the configured endpoint is not obviously TikTok-related. Based on this code alone, the actual behavior is merely configuration setup, not the described scraping and analysis workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code only implements the third declared sub-capability in a narrow form: it parses a TikTok video URL or ID, requests comment retrieval through API helpers, outputs the fetched comments as JSON, and saves the result locally. It does not perform keyword-based search, does not fetch a creator's public works list, and does not perform any clustering, sentiment analysis, extraction of pain points/feature requests, or generation of a structured demand/opportunity list as described in the declared purpose. There is no evidence here of unrelated or dangerous undeclared behavior beyond local logging, which is a supporting detail. Because the declared description presents a substantially broader multi-capability analytics skill than what this code chunk actually implements, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a TikTok comment collection and analytics skill with multiple data-retrieval capabilities. The actual code chunk is a utility module for parsing CLI arguments (parseArgs, readValueAfterFlag, buildHelp). It contains no network access, no TikTok-specific logic, no scraping or API calls, no comment/content retrieval, and no analysis pipeline. This is not merely a supporting implementation detail unless the evaluation is of the full skill package; based on the supplied chunk alone, the observed behavior is unrelated utility code rather than the declared primary functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk does not implement the declared TikTok comment collection and analysis features. Its sole function is to validate and sanitize a filename, create a dated log directory in the OS temporary folder, and write provided text content to a file. That is a materially different purpose from social media data collection, clustering, sentiment analysis, or demand extraction. While logging can be a supporting detail in a larger system, this specific supplied chunk exposes an undeclared local file-writing capability and none of the declared end-user capabilities, so the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full TikTok data acquisition and analysis tool. However, the provided code chunk is only a generic utility module for printing a banner and colored log messages to stderr. This is not merely an implementation detail of the stated features; none of the advertised data collection or analysis behaviors are present in this code. Therefore, the code chunk does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON schema includes natural-language titles and descriptions exclusively in Chinese, such as the title and multiple property descriptions. Because the policy requires avoiding forced language or locale without user opt-in or documented justification, this is a natural-language policy issue in an otherwise general-purpose schema file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The package description is entirely written in Chinese and presents the skill's behavior in that language without any indication that users can choose another language or locale. This can violate a language/locale policy when the skill implicitly constrains interaction to a specific language without explicit opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README says users can 'directly tell the AI in natural language' and gives examples like '帮我搜 TikTok 上 AI 相关最火的 20 条视频' and '这条视频评论区主要在讨论什么？' without defining exact trigger phrases, boundaries, or negative examples. For a markdown skill description, this is an ambiguous activation description that could overlap with ordinary conversation about TikTok rather than a clearly scoped invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The changelog documents functionality to scrape TikTok comments but provides no warning about privacy, consent, retention, or downstream handling of user-generated data. In this skill’s context, the feature is explicitly used for large-scale demand mining and sentiment analysis, which increases the risk of collecting and operationalizing personal or sensitive user content without appropriate safeguards.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/options.md (reported line 14)May include surrounding context.
node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>]

text
| 参数 | 缩写 | 作用 | 可选值 | 必填 | 默认 | | ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: | | `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接 | 是 | — | | `--sort` | `-s` | 排序方式 | `0` 相关度 / `1` 最多点赞 | 否 | `0` |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly supports bulk collection of TikTok profile, post, and comment data, including user identifiers and interaction metadata, but provides no privacy, retention, lawful-use, or data-handling guidance. In a demand-mining context, this increases the risk that operators will collect and repurpose personal data at scale without adequate safeguards, creating privacy and compliance exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script reads an API token from an environment variable and sends the requested TikTok URL/ID and limit to external comment APIs without an explicit disclosure or consent step in this file. While outbound API use is expected for this skill, the lack of warning reduces transparency and can cause unintentional transmission of request metadata and access credentials in automated environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI writes fetched TikTok comment data to a local JSON file by default, and the output includes user-generated content plus metadata. In a data-mining skill whose purpose is bulk collection and analysis of social comments, silently persisting results increases privacy and data-retention risk, especially on shared machines or CI/agent environments where operators may not expect local storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI persists full search output to a local JSON file containing the queried keyword and returned TikTok data. In a demand-mining skill that collects user comments and interaction metadata, this can create an unintended local data store of potentially sensitive or regulated content without clear notice, retention limits, or access controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and descriptions are presented exclusively in Chinese, which imposes a specific language on users without any visible opt-in or explanation that the skill is intended only for a Chinese-speaking audience. Under the policy, language constraints should either be optional or clearly justified as region- or locale-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JSON schema contains multiple natural-language titles and descriptions only in Chinese, such as the title and field descriptions. Because SQP-3 applies to all file types, this can be a language/locale policy issue when the skill does not offer user opt-in or document a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The title and property descriptions are written entirely in Chinese, with no indication that the skill is region-specific or that another language is available. This can violate a language/locale policy when users are not given an explicit opt-in or documented justification for the locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON schema contains natural-language titles and descriptions exclusively in Chinese, such as the schema title and many property descriptions. Because the file provides no opt-in, alternative locale, or documented region-specific justification, it may violate language/locale policy requirements for skills expected to support broader users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON schema contains user-facing titles and descriptions only in Chinese, which effectively forces a specific language for users of the skill. The file does not indicate that the skill is region-specific or provide any opt-in or alternative language support, so it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: All visible natural-language content in the file is Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. The policy calls for flagging language or locale constraints when a specific language is effectively forced without user choice or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing natural-language instructions only in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no justification or alternative is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language documentation and example human-readable fields are presented exclusively in Chinese, including the example message field and error descriptions, with no indication that users may choose another language. This can violate a language/locale policy when a specific language is imposed without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L098 将该段定义为本技能的“统一输出信封”，但 L115 的 skill_name 却写成 tiktok-creator-videos，与当前技能 tiktok-demand-mining 不符。这会让调用方误解实际返回内容所属技能，属于文档意图与声明对象不一致。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code sends potentially sensitive data to remote API endpoints via requestApi, including an authentication token and a user-provided URL. There is no visible confirmation prompt, warning message, or explanatory comment in this file disclosing that this network transmission occurs.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16