TikTok高赞视频检索

• Outcome: Review
• Latest audit: Sep 25, 2026 · 11:34 PM UTC
• Version: 1.0.0

Overview

This is a coherent read-only TikTok data tool, but it sends query targets and an API token to a third-party service and saves returned public data in local temp logs.

Install only if you are comfortable using the guaikei.com API service for TikTok public-data retrieval. Treat the API token as a credential, avoid collecting more public personal data than needed, and delete or protect the temp JSON logs when they contain usernames, comments, links, or engagement data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Yes, this is a mismatch based on the supplied code chunk. The declared description presents a fully featured TikTok scraping/search tool with three concrete user-facing capabilities. However, the actual code shown is only a constants/config file containing a non-TikTok base URL plus retry and timeout settings. There is no implemented logic for keyword search, author video collection, comment extraction, filtering, sorting, or structured JSON output. While configuration files can be supporting details, this specific chunk does not substantiate the declared purpose and even references a different domain (www.guaikei.com), which is inconsistent with the description’s TikTok-focused behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a TikTok-focused data acquisition tool with three concrete capabilities: keyword-based high-like video search, batch retrieval of a creator's public works, and comment extraction from videos. However, the supplied code chunk only contains a reusable CLI argument parser (parseArgs, readValueAfterFlag, buildHelp). It handles command-line flags, required/default values, boolean parsing, positional argument conflicts, and help text generation. There is no logic for interacting with TikTok, making HTTP requests, parsing pages/APIs, retrieving video metadata, collecting comments, or outputting the described structured TikTok data. This is a clear description-behavior mismatch in primary purpose, though the code could be a supporting utility within a larger TikTok tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full TikTok data collection and analysis tool with search, creator content retrieval, and comment scraping features. The supplied code chunk does not implement any TikTok-related functionality, network access, scraping, search, sorting, filtering, or JSON content extraction. Instead, it only reads a local package.json file to obtain the package name and falls back to a constant string if that fails. This is materially different from the declared primary purpose, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a TikTok data collection/search tool with multiple scraping and retrieval capabilities. However, the supplied code chunk contains only generic UI/logging helpers that print a banner and colored log messages to stderr. There is no code for accessing TikTok, performing searches, fetching creator works, retrieving comments, sorting/filtering results, or producing structured JSON data. This is a materially different behavior from the declared primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title and descriptions are written exclusively in Chinese, which imposes a specific language on users and integrators without any opt-in, alternative locale, or documented region-specific justification. This matches the policy category for language/locale constraints expressed in natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON schema uses Chinese-only natural-language titles and descriptions throughout, such as the schema title/description and many property descriptions. Because the file provides no opt-in, multilingual alternative, or justification that the skill is intentionally China/Chinese-locale specific, it can violate language/locale policy by imposing a specific language on users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README gives very broad natural-language activation examples such as searching TikTok, analyzing an account's strategy, or summarizing a video's comments, without any boundaries on acceptable use, data minimization, or consent-sensitive contexts. In an agent setting, this increases the chance of overbroad invocation and collection/analysis of third-party content at scale, especially because the skill can retrieve comments and profile-derived data from public accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states that every run automatically persists JSON logs locally, but it does not prominently warn that retrieved TikTok data, request parameters, and metadata may be written to disk. This creates a real data exposure risk because comment content, usernames, links, and analysis targets may remain in temp directories longer than users expect and could be accessed by other local users, backup systems, or downstream tooling.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/options.md (reported line 14)May include surrounding context.

node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>]

text

| 参数        | 缩写 | 作用       | 可选值                                                                                      | 必填 | 默认 |
| ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: |
| `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接                                            |  是  |  —   |
| `--sort`    | `-s` | 排序方式   | `0` 相关度 / `1` 最多点赞                                                                   |  否  | `0`  |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly documents collection of public TikTok author and commenter identifiers, profile links, signatures, and engagement data without any privacy, retention, lawful-use, or minimization guidance. In a scraping/monitoring context, this increases the risk of mass collection, profiling, and downstream misuse of personal data, especially when combined with high collection limits and structured JSON export.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The string literal used for the operation label is fixed to Chinese ("创建任务"), which imposes a specific language in user-visible text. The file does not offer any locale selection, fallback, or justification for restricting output language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The string literal used for the operation label is fixed to Chinese ("查询任务"), which imposes a specific language in user-visible text. The file does not offer any locale selection, fallback, or justification for restricting output language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code presents command descriptions, examples, and notices entirely in Chinese, and later prints additional Chinese status/error messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs outbound HTTPS GET and POST requests, includes a TOKEN header, and sends request parameters and JSON bodies to a remote host. While there is retry logging for failures, there is no confirmation prompt, user-facing disclosure, or warning comment/docstring here explaining that user or system data and credentials may be transmitted externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits user-facing warning and info strings only in Chinese (e.g., the warning about GUAIKEI_API_TOKEN and the info message about using a private token). For a general-purpose skill utility file, this imposes a specific language on users without offering a language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file emits all user-facing validation errors in Chinese via string literals such as at L11, L15, L19, L23, L53, L59, and L64. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This JSON schema contains natural-language title and description fields only in Chinese, and there is no accompanying indication that the skill is region-specific or that language choice is optional. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This manifest file contains all user-facing title and description text in Chinese, but does not state that the skill is region-specific or offer any language/locale choice. Under the policy, forced language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON schema contains natural-language titles and descriptions exclusively in Chinese, such as the title at L004-L005 and repeated field descriptions throughout the file. Under the language/locale policy, forcing a specific language without user opt-in or justification can be a policy violation, and no opt-in or region-specific rationale is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The package description is written entirely in Chinese, which imposes a specific language/locale in user-facing metadata without offering an alternative or documenting that the skill is region-specific. This is a natural-language policy issue because the file gives no indication that Chinese-only usage is intentional or optional.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes this skill as "tiktok-video-search", but the documented unified output example reports skill_name as tiktok-creator-videos. That creates a semantic mismatch between what the skill claims to be and what consumers are told it returns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code sends a token plus user-provided search keywords and filters to remote API endpoints via POST and GET requests. In this file there is no confirmation prompt, user-facing log, or comment/docstring warning that search terms and authentication context will be transmitted over the network.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI writes the full fetched comment results to a local JSON file after printing them, creating an undisclosed secondary storage channel for potentially sensitive or regulated data. Even though the filename is partially sanitized, the behavior increases data retention and exposure risk because comments, usernames, links, and interaction metadata may persist on disk longer than the operator expects and may be readable by other local users, backup systems, or downstream tooling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The flag descriptions and examples are presented only in Chinese, and the rest of the script also uses Chinese-only user-facing output. This can violate a language/locale policy when a skill forces a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16