TikTok机会研究

• Outcome: Review
• Latest audit: Sep 23, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

This is a disclosed read-only TikTok research skill that calls an external API and saves local result logs, with no evidence of hidden or destructive behavior.

Install this only if you trust www.guaikei.com with your API token and TikTok search terms, profile URLs, or video IDs. Be aware that result JSON files are saved automatically in the system temp directory and may include public usernames, profile identifiers, and comment text, so delete or protect those logs when the data is sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises TikTok-focused data retrieval and analysis capabilities. However, the supplied code chunk is an unrelated utility module for parsing CLI arguments (`parseArgs`, `readValueAfterFlag`, `buildHelp`). It contains no TikTok API calls, scraping logic, network access, data processing, creator/comment analysis, or market research behavior. This is not merely a supporting implementation detail tied specifically to TikTok functionality; it is a generic utility whose primary purpose differs materially from the declared skill behavior. Therefore, the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a user-facing TikTok analysis/research skill. However, the supplied code chunk only defines `withRetry`, a generic helper for retrying asynchronous operations with exponential backoff, optional error callbacks, and no-retry short-circuit behavior. This is an implementation utility unrelated to the declared end-user capabilities. While such a helper could support a larger TikTok-focused system, this code chunk by itself does not match the declared purpose and has a materially different primary function.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill requires access to the environment variable `GUAIKEI_API_TOKEN` but does not declare an explicit tool scope such as `permissions` or `allowed-tools`. In an agent runtime, missing scope declarations can cause overbroad execution privileges or make the skill's secret access less auditable, which increases the risk of unintended secret exposure or misuse.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list is very broad, including generic phrases like market research, competitor analysis, data analysis, and short-video operations. In an agent environment, overly broad activation can cause the skill to run on loosely related requests, leading to unintended external data access, unnecessary transmission of user queries/URLs to `www.guaikei.com`, and avoidable use of API credentials.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest advertises very broad trigger phrases such as TikTok搜索, 市场调研, 短视频运营, and TikTok数据分析, which overlap with common user intents and can cause the skill to activate in situations beyond narrowly scoped consent. Over-broad activation increases the chance of unintended data collection or execution in contexts where the user did not explicitly request TikTok scraping or monitoring behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description explicitly states that the skill collects TikTok video data, creator information, comment content, commenters, and engagement metrics, but it provides no user-facing warning about privacy, platform policy, retention, or downstream handling of collected data. In a research and monitoring context, this omission can normalize bulk collection of user-generated content and profile data without adequate transparency or safeguards.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The changelog explicitly advertises comment scraping capability but provides no warning about privacy, consent, retention, or platform-policy constraints. In a skill centered on TikTok research, comments can contain personal data, usernames, and sensitive opinions, so normalizing collection without safeguards increases the risk of misuse, overcollection, or noncompliant handling.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>]
```

| 参数        | 缩写 | 作用       | 可选值                                                                                      | 必填 | 默认 |
| ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: |
| `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接                                            |  是  |  —   |
| `--sort`    | `-s` | 排序方式   | `0` 相关度 / `1` 最多点赞                                                                   |  否  | `0`  |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents collection of TikTok profile and content metadata, including author identifiers and URLs, without any privacy, minimization, retention, or acceptable-use warning. In a market-research skill, this increases the risk of misuse for profiling, bulk surveillance, or downstream handling of personal data without safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The comment-fetching interface returns comment text plus commenter identifiers (`user_uid`, `user_nickname`, `user_sec_uid`) and reply counts, but the documentation provides no warning about handling privacy-sensitive user-generated content. This makes large-scale collection and analysis of identifiable user feedback easier without guardrails, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI persists fetched TikTok comment data to a local JSON file automatically, without explicit user consent or a clear warning that potentially sensitive third-party content will be stored on disk. In the context of market research and comment analysis, this increases privacy and data-retention risk because comments may contain personal data, and local files can later be exposed through backups, shared workspaces, or multi-user systems.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script writes the full fetched results to a local JSON log file after execution, creating persistent storage of potentially sensitive research data without any retention controls, redaction, or explicit disclosure. Because the skill handles creator/account research and may collect comments or profile-linked data, silent persistence increases the chance of unintended local data exposure to other users, processes, or backups.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI persists fetched TikTok results to disk without any explicit warning, consent, or confirmation, which can surprise users who expect transient console output only. This is risky because the stored JSON may contain account research results or other data that remains accessible on the host after the command finishes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI persists full search output to a local log file named with the user-supplied keyword, without any visible consent, warning, or minimization. In this skill context, search queries and returned TikTok research data may contain sensitive business intelligence, user interests, or personal data from comments/accounts, so silent retention increases exposure through disk access, backups, shared workstations, or downstream log collection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code includes natural-language strings in Chinese for CLI help and error output, indicating the skill forces a specific language for user interaction. The policy allows locale constraints only when user choice or a clear justified regional scope is provided, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The thrown error messages are user-visible and all written in Chinese, with no mechanism for selecting another language. This creates a natural-language policy issue because the skill imposes a locale on all users without opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The help output strings such as usage labels and option headings are emitted only in Chinese. Because no language choice or locale justification is present, this violates the language/locale policy for natural-language behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code emits multiple hard-coded Chinese messages in exceptions, auth failures, timeout/network errors, and retry logs. Because the file provides no user opt-in, language selection, or documented region-specific constraint, it violates the natural-language locale policy for all file types.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code emits user-facing warning and info strings only in Chinese ("警告..." and "已使用配置的私有TOKEN"). Per the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This file contains natural-language comments and an error message entirely in Chinese, including the user-visible text at L26. The skill does not offer a language choice or document that it is intentionally limited to a Chinese-speaking context, which can violate a language/locale policy requiring user opt-in or clear justification.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: 在输出契约示例中，metadata.skill_version 是当前技能版本，但 metadata.skill_name 却写成了 "tiktok-creator-videos"，与本文件声明的技能名 "tiktok-opportunity-research" 不一致。这会让集成方误判脚本身份，属于文档意图与实际技能标识的直接矛盾。

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: L220 的统一信封示例把 results 展示为数组，而 L230 明确规定 status=empty 时 results 应为 null。二者对消费者处理逻辑有直接影响，属于文档内部对实际输出行为的主动矛盾描述。

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The title and description fields presented to users are written only in Chinese, which can impose a specific language on users without offering an alternative or documenting a locale-specific constraint. Under the policy, forcing a language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This JSON schema includes user-facing natural-language fields such as title and description entirely in Chinese. Because the file provides no opt-in, alternative locale, or justification for a Chinese-only interface, it may conflict with organizational language or locale flexibility requirements.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This JSON schema includes natural-language titles and descriptions only in Chinese, which effectively forces a specific language for users or integrators without any opt-in or documented locale limitation. The policy allows fixed locale behavior only when it is explicitly justified or when users are offered a language choice, neither of which appears here.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16