Security audit

TikTok市场趋势洞察｜关键词搜索 · 博主作品 · 视频评论（无需登录 / 不封号）

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed, read-only TikTok data skill that calls a third-party API and saves fetched public results locally.

Install only if you are comfortable sending TikTok search terms, target URLs or IDs, and your GUAIKEI_API_TOKEN to www.guaikei.com. Be aware that successful runs save result JSON files under the system temp directory, so clear those logs if the research topic or fetched public comments are sensitive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该代码片段是一个与业务无关的底层工具模块，用于解析命令行参数并生成帮助文档。它没有出现任何 TikTok 相关 API、网页抓取、作者/视频/评论数据处理、结构化市场分析输出等行为。根据评估标准，这不是“支持性实现细节”层面的轻微偏差，而是主功能与声明用途明显不一致：声明描述的是一个 TikTok 数据采集与分析技能，而实际代码仅是通用 CLI 参数工具。因此应判定为描述与行为不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是 TikTok 数据获取与分析能力，但实际代码并未执行任何 TikTok 搜索、作品抓取、评论抓取、市场分析或 JSON 数据整理逻辑。相反，该代码访问本地文件系统，创建目录并写入日志文件，这属于未在描述中声明的能力。虽然日志功能可能是配套实现细节，但从该片段本身看，其行为与所宣称的核心用途没有直接对应关系，且涉及本地资源访问，因此应判定为描述与代码行为不一致。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill requests access to an environment secret (`GUAIKEI_API_TOKEN`) but does not declare an explicit tool/permission scope. That weakens reviewability and least-privilege enforcement, making it easier for a skill to access secrets without a clear machine-readable authorization boundary.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad generic phrases like market research, competitor analysis, and short-video operations that are not uniquely TikTok-specific. This can cause accidental invocation in unrelated contexts, unnecessarily exposing user prompts, URLs, or business data to an external API and using the API token when the user did not intend TikTok data collection.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This manifest-style JSON file contains user-facing title and description fields entirely in Chinese, which imposes a specific language on users without any opt-in or stated regional justification. Under the policy, locale or language constraints should either be optional for the user or clearly documented as region-specific.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The entire README, including usage examples and user-facing instructions, is written only in Chinese, and it directs users to 'directly talk to AI' using Chinese example prompts. There is no indication that other languages are supported or that the Chinese-only constraint is an intentional, justified region-specific limitation, which can violate language/locale choice policy.

Whitespace Padding

Medium

Category: Prompt Injection
Content: node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>] ``` | 参数 | 缩写 | 作用 | 可选值 | 必填 | 默认 | | ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: | | `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接 | 是 | — | | `--sort` | `-s` | 排序方式 | `0` 相关度 / `1` 最多点赞 | 否 | `0` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: This code sends a user-provided TikTok URL and a token to remote API endpoints via requestApi in both task creation and task query flows. The file contains no confirmation prompt, logging, comment, or docstring disclosing that network transmission of potentially sensitive input and credentials occurs.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The command descriptions and runtime messages are presented in Chinese only, and the file does not offer any language or locale selection. That can violate a language/locale policy when users are not given opt-in or an alternative language path.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists fetched TikTok results to a local JSON file after displaying them, which creates an additional data-retention channel beyond the obvious stdout behavior. Even though this appears intended for logging/debugging, it can expose scraped account/content data to other local users, backup systems, or downstream processes without explicit user awareness.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code silently writes fetched TikTok results to disk without an explicit warning or user-controlled save action at the point of use. This can lead to unintentional storage of potentially sensitive scraped data, increasing privacy, compliance, and local disclosure risk in a market-intelligence workflow that may process competitor monitoring and comment data.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This JavaScript file uses Chinese for developer comments and all user-facing CLI messages, including errors and help output. Because the skill does not offer any language selection or document a justified locale restriction, it violates the policy against forcing a specific language without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The user-visible error and success messages in this file are written only in Chinese, which imposes a specific language on users without any visible opt-in or documented locale restriction. The policy specifically calls out language or locale constraints that are forced without user choice.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This code contains multiple natural-language strings and documentation in Chinese, including user-facing errors such as "请求失败" and "GUAIKEI_API_TOKEN 无效, 请检查环境变量". Under the policy, forcing a specific language without offering a language choice or documenting a justified locale constraint is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This JavaScript file contains all user-facing validation and error messages in Chinese, and there is no indication that the skill offers a language choice or that it is intentionally limited to a Chinese-only audience. That creates a natural-language locale policy concern because the skill effectively forces a specific language without user opt-in.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The file forces a single language for operational instructions, examples, and support messaging, but does not indicate that the skill is region-specific or provide user opt-in for Chinese. Under the policy, a language/locale constraint should either be justified or offer the user a choice.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: SKILL.md 在 L002 将技能名声明为 `tiktok-market-insight`，但输出契约示例在 L216 写成 `tiktok-creator-videos`。这不是单纯省略信息，而是对外部可见标识的直接矛盾，可能误导调用方按错误技能名解析或审计结果。

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: This JSON schema contains user-facing natural-language fields such as title and description entirely in Chinese, with no indication that language selection is optional or configurable. Under the policy rule for language/locale constraints, this is a natural-language policy concern because it fixes one language without documented opt-in or justification.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: This JSON schema contains multiple natural-language titles and descriptions exclusively in Chinese, such as the title and per-field descriptions. Under the language/locale policy, forcing a specific language without opt-in or documented justification is a policy concern because users of the skill may not be able to understand the schema metadata.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The title and descriptions are written entirely in Chinese, which imposes a specific language on users of the schema. Under the policy criteria, this is a natural-language locale/language constraint, and the file does not indicate that the skill is region-specific or that users can opt into another language.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: This JSON schema contains user-facing natural-language title and description strings exclusively in Chinese, and additional property descriptions throughout the file are also Chinese-only. For a general-purpose skill artifact, forcing a specific language without user opt-in or documented locale constraint can violate language/locale policy expectations.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: This JSON schema uses Chinese titles and descriptions throughout, such as the top-level title/description and property descriptions, which imposes a specific language on downstream users or tools. The policy allows fixed locale only when it is clearly documented and justified or when users can opt in, neither of which is present in this file.

Vague Triggers

Low

Confidence: 88% confidence
Finding: The package description and trigger wording are very broad, covering many common TikTok research, analysis, and monitoring requests without clear boundaries or disambiguation criteria. In an agent environment, this can cause over-triggering, leading the skill to activate on loosely related prompts and perform unintended external data collection or analysis actions.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The entire skill changelog is presented only in Chinese, and the file does not indicate that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or justification is a natural-language policy issue.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese and does not mention any option for another language or user-selected locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16