Security audit

TikTok数据技能 · TikTok搜索 · KOL作品 · 作品评论

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed TikTok public-data API wrapper that uses one provider token and saves local result logs, with no evidence of hidden execution or malicious behavior.

Install only if you are comfortable providing a GUAIKEI_API_TOKEN to the skill and sending TikTok queries, profile URLs, video IDs, and result requests to www.guaikei.com. Be aware that successful runs save JSON result logs in the system temp directory, which may include public comments and user identifiers; delete or protect those logs if your workflow involves sensitive research targets or regulated data handling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (48)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 声明描述的是一个覆盖视频搜索、博主作品抓取、评论分析的综合 TikTok 数据技能；但提供的代码片段只处理“post”相关接口，且输入仅见 url、sort_type、limit，没有关键词搜索参数、用户名参数，也没有任何评论接口或评论数据处理逻辑。虽然其中与‘按主页链接获取作品列表’存在部分相近之处，但当前实现更像是针对单个作品/帖子 URL 的任务创建和查询，而非声明中的完整三大能力。因此描述对该代码块的能力有明显夸大，存在不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码块的主功能与声明中的第二项能力“博主作品抓取”基本一致：输入博主主页 URL 或标识，获取作品列表，支持最新/最热排序，并输出结构化 JSON。从资源访问角度看，也属于 TikTok 公开作品数据抓取，没有发现额外越权或明显未声明的敏感操作。但整体描述宣称该技能支持三大能力，而当前代码块只体现了其中一项，且没有任何关键词搜索视频或评论分析相关参数、调用路径、验证逻辑或输出结构。因此如果将此代码块视为该技能的实现，其描述范围明显大于实际行为，构成描述与行为不一致。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向 TikTok 达人/视频/评论数据采集与分析的技能，核心能力应包括对 TikTok 公开内容的查询、抓取或分析。实际代码仅实现了通用 CLI 参数解析与帮助文本生成功能：识别命令行选项、读取参数值、处理默认值/必填项、生成 usage/help 文本等。它不执行任何网络请求、不访问 TikTok、不处理视频/博主/评论数据，也不输出与 TikTok 内容分析相关的结构化结果。因此该代码块与声明用途存在明显的实质性不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是 TikTok 达人/视频/评论数据抓取与分析能力，强调无需登录、只读公开数据、输出结构化 JSON。而实际代码片段并未执行任何 TikTok 数据访问、搜索、抓取、评论分析或 JSON 输出逻辑；它只是在本地文件系统中写入日志文件。虽然日志工具可能属于实现细节，但该代码展示的实际行为涉及未在声明中提到的本地文件写入能力，且与所宣称的核心业务能力无直接对应。因此就该代码片段而言，描述与行为不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向 TikTok 内容检索、抓取和评论分析的技能，核心能力应涉及网络请求、参数处理、公开数据读取和结构化结果生成。但所给代码片段仅是一个本地辅助模块，使用 fs/path 从本地 package.json 读取名称并缓存，失败时返回默认值。它既没有体现声明中的三项核心能力，也没有显示任何与 TikTok 数据处理直接相关的行为。虽然这可能是配套基础设施代码，但就“该代码块实际做什么”而言，与声明用途明显不符，因此应判定为不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个以 TikTok 数据采集与分析为核心的技能，而实际代码片段只是 scripts/utils/utils.js 中的日志辅助函数。该代码仅向 stderr 输出 banner 和彩色日志，不包含网络请求、TikTok 资源访问、数据解析、搜索/排序/筛选、评论抓取或结构化结果生成等与声明核心能力直接相关的实现。虽然这类日志工具可能是完整技能的辅助模块，但就当前提供的代码片段而言，其行为与声明用途明显不一致。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill requires access to an environment secret (`GUAIKEI_API_TOKEN`) but does not declare any explicit tool scope such as `permissions` or `allowed-tools`. That weakens least-privilege enforcement and makes the actual secret-access capability less transparent to reviewers and orchestrators, increasing the chance of accidental overexposure or misuse of credentials.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The manifest description is entirely in Chinese and the file consistently instructs behavior in Chinese, but does not state that the skill is region-specific or provide an opt-in/choice for language. Under the policy, forcing a specific language without user choice is a natural-language locale violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This JSON schema contains user-facing title and description fields only in Chinese, including parameter descriptions and usage text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README includes broad natural-language activation examples such as asking the AI to search TikTok or analyze a creator, but it does not define clear trigger boundaries, required confirmations, or scope constraints. In agent environments, this can cause over-broad invocation from loosely related user requests, leading to unintended third-party API calls, unnecessary data collection, or cost-incurring actions without explicit user intent.

Whitespace Padding

Medium

Category: Prompt Injection
Content: node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>] ``` | 参数 | 缩写 | 作用 | 可选值 | 必填 | 默认 | | ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: | | `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接 | 是 | — | | `--sort` | `-s` | 排序方式 | `0` 相关度 / `1` 最多点赞 | 否 | `0` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly describes collection of TikTok author and commenter identifiers such as user_uid, user_sec_uid, nicknames, and comment text, but provides no privacy, retention, consent, or handling guidance. In a data-collection skill focused on creator and comment analytics, this increases the risk of improper personal data processing, downstream misuse, or policy noncompliance.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: 清单描述明确表示该技能无需登录账号、仅读取公开数据，但本文件的退出码与错误码将 `AUTH_REQUIRED` 和 `Token 缺失或格式错误` 作为常规执行路径，并在重试策略中再次提到该认证错误。这不是单纯的实现细节缺失，而是文档层面对是否需要认证存在直接冲突，可能误导调用方对技能依赖条件的判断。

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The manifest states `无需登录账号，只读公开数据`, which sets an expectation that use of the skill does not depend on credentials from the operator. This code requires `process.env.GUAIKEI_API_TOKEN` and exits if absent, introducing a credentialed capability that is not justified by the stated public-data-only purpose.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script writes the full comment retrieval output to a local JSON file after execution, which contradicts the read-only/structured-output expectation and creates unintended data persistence on disk. Even if the data is publicly sourced, comment content and associated metadata may contain sensitive or regulated information, and silent retention increases leakage, reuse, and compliance risk on shared systems.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script accesses a sensitive credential from process.env.GUAIKEI_API_TOKEN and then uses it to create and fetch remote TikTok post tasks. While the code has operational logging, there is no explicit warning or comment in this file disclosing that it consumes an environment token and transmits request data to external services.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The CLI writes retrieved TikTok results to a local JSON file without clearly disclosing that behavior to the user. This can create unintended local data persistence, exposing collected public data, query history, or potentially sensitive analysis artifacts to other local users, backups, or automated file collection systems.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The manifest explicitly frames the skill as requiring no account login and performing public-data read operations. In this file, execution depends on reading `process.env.GUAIKEI_API_TOKEN`, which introduces a credential-handling capability not justified by the stated user-facing purpose of simple public TikTok search and analysis.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The CLI writes full search results to a local file without any visible opt-in, retention control, or minimization. Even if the source data is public, persisted result sets can include sensitive research targets, operational queries, or collected metadata that remain on disk and may be accessible to other local users, backup systems, or later processes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Search results are silently persisted to local storage after being printed, which creates a hidden data-retention side effect for users expecting stdout-only JSON. This can expose collected content, keywords, and analysis targets through local filesystem access or downstream log collection, especially in shared or automated environments.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file contains user-facing natural-language strings in Chinese, starting with the top-level description and continuing throughout error/help output. Because the skill does not offer a language/locale option or document that it is intentionally region-specific, this creates a language policy issue for users who may expect locale neutrality or opt-in.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: Multiple thrown errors and the buildHelp output use only Chinese text such as parameter validation messages and usage/help labels. This effectively forces a single language for all users without opt-in, which matches the policy-violation category for language or locale constraints.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: Manifest 将技能描述为“无需登录账号，只读公开数据，输出结构化 JSON”，重点是对 TikTok 公开数据的读取与分析。该文件中的 taskWrite 会在本地临时目录创建目录并写入日志文件，属于持久化写操作而非只读数据获取/JSON 输出行为。

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This code contains hard-coded Chinese user-facing error strings, and additional Chinese output appears later in the file. For a general-purpose utility, forcing a specific language without opt-in or a documented region-specific justification violates the natural-language locale policy criteria.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The success and error messages shown to users are fixed in Chinese, with no indication that users can choose another language or that the skill is restricted to a Chinese-language context. This is a natural-language policy issue because the file enforces a locale implicitly through user-visible text.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16