Security audit

TikTok运营分析助手｜关键词搜索 · 博主作品 · 视频评论（无需登录 / 不封号）

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed TikTok public-data API wrapper with local result logging and no evidence of hidden execution, exfiltration beyond the stated API service, or destructive behavior.

Install only if you are comfortable sending TikTok keywords, creator/video URLs or IDs, and your GUAIKEI_API_TOKEN to www.guaikei.com. The returned public profile/comment data is saved locally in temp logs, so review local retention practices and de-identify user-facing exports when using the data commercially or externally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises concrete TikTok data-access capabilities: searching content, fetching creator works, and retrieving comments with engagement metadata. However, the provided code is a reusable utility module for CLI argument parsing (`parseArgs`, `readValueAfterFlag`, `buildHelp`). It contains no network access, no TikTok-specific logic, no scraping or API calls, no data extraction, and no JSON assembly for TikTok entities. This is not merely a supporting implementation detail in the context of the declared capability set, because the entire supplied chunk is infrastructure code unrelated to the claimed end-user behavior. Therefore the description does not accurately represent what this code chunk actually does.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description focuses on TikTok data acquisition features: searching videos by keyword, fetching public posts from creator profiles, and scraping comments with structured JSON output. The supplied code does none of that. Instead, it performs local file I/O by creating a dated log directory in the OS temp folder and writing provided content to a sanitized filename. This is an undeclared capability involving filesystem access. While logging can be a supporting implementation detail in a larger system, this specific code chunk’s actual behavior is purely logging/storage and does not implement or directly reflect the declared TikTok data functions. Therefore, for this chunk, the description does not accurately represent the code’s behavior.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises multiple TikTok data acquisition and analysis capabilities. The supplied code chunk does not implement any of those behaviors. Instead, it is a small utility that accesses the local filesystem, reads package.json, extracts the package name, caches it, and returns a fallback name on error. This is materially different from the declared primary purpose. While utility code can be a supporting detail, this chunk by itself shows no evidence of the advertised TikTok-related functionality, and its actual behavior is unrelated metadata lookup rather than TikTok content/search/comment retrieval.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares access to a sensitive environment variable (`GUAIKEI_API_TOKEN`) but does not define an explicit tool scope such as `permissions` or `allowed-tools`. In an agent environment, missing scope boundaries can lead to broader-than-intended execution privileges and makes review of secret access less enforceable.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list includes broad marketing/analysis phrases such as '热点追踪', '爆款挖掘', and '短视频运营', which can cause the skill to activate on requests outside its stated TikTok-only scope. Over-broad invocation increases the chance of unintended external data transmission to the third-party API, including user keywords or URLs that were meant for another platform or a different tool.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The description includes broad trigger phrases such as competitor analysis, data analysis, public opinion monitoring, and trend tracking, which can overlap with common user requests outside a narrowly scoped TikTok intent. In an agent-routing context, this can cause over-activation of the skill, resulting in unintended invocation, data access, or interference with more appropriate tools.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: A description written entirely in Chinese without explicit language or locale constraints can lead to misrouting or incorrect activation behavior in multilingual environments. This is less severe than direct code execution risk, but it can still cause users to invoke a skill they do not understand or prevent reviewers and routing systems from accurately assessing its scope.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The README says users can 'directly tell the AI in natural language' and gives examples like '看看 @username 最近发了什么' and '这条视频评论区主要在讨论什么？'. These phrases are broad everyday requests and the document does not define precise trigger boundaries, required context, or negative examples, which could lead to unintended activation in general conversation.

Whitespace Padding

Medium

Category: Prompt Injection
Content: node scripts/tiktok/search-cli.js --keyword <关键词> [--sort <排序>] [--time <时间>] [--limit <数量>] ``` | 参数 | 缩写 | 作用 | 可选值 | 必填 | 默认 | | ----------- | :--: | ---------- | ------------------------------------------------------------------------------------------- | :--: | :--: | | `--keyword` | `-k` | 搜索关键词 | 2–100 字符；不可含 `< > " ' &`，不可含 http 链接 | 是 | — | | `--sort` | `-s` | 排序方式 | `0` 相关度 / `1` 最多点赞 | 否 | `0` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly supports collecting comments and persistent account identifiers such as `author_uid`, `author_sec_uid`, `user_uid`, and `user_sec_uid`, but the documentation provides no privacy, retention, consent, or permitted-use guidance. In a data-collection skill, that omission increases the risk of misuse for profiling, surveillance, or non-compliant processing of personal data.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The CLI's descriptions and runtime messages are presented in Chinese only, such as the flag description and other user-facing strings throughout the file. This imposes a specific language on users without any visible option to select locale or language, matching the language/locale policy concern.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI writes fetched comment results to a local JSON file automatically after execution. Because comment data may include commenter identities, content, and interaction metadata, silent persistence increases the risk of unintended retention, local disclosure, and mishandling of scraped data beyond what users may expect from a command that appears to only print structured JSON.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The tool stores comment results to a local JSON file without any user-facing notice or consent in this file. This is dangerous because operators may unknowingly accumulate potentially sensitive public-comment datasets on disk, creating privacy, compliance, and workstation exposure risks if the files are later accessed by other users or processes.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code presents descriptions, examples, and operational messages exclusively in Chinese, including argument help text and the main function description. Under the policy for natural-language violations, forcing a specific language without user opt-in or a documented regional justification is a reportable locale-policy issue.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persists full search output, including user-supplied keywords and returned TikTok data, to a local file automatically without clearly warning the user or offering consent/opt-out. In a data-collection skill that may handle sensitive research terms, competitor monitoring data, or comment content, silent local retention increases privacy and data exposure risk if the host machine, workspace, or log directory is later accessed by others.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This file contains user-facing natural-language strings such as error messages, comments, and help text entirely in Chinese, including the generated CLI help output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The manifest describes a read-oriented TikTok operations tool focused on searching videos, fetching creator posts, and scraping comments, with structured JSON output. This helper instead creates directories under the OS temp folder and writes caller-provided content to disk, which is a persistent side effect not reflected in the stated skill behavior.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This code returns user-facing strings entirely in Chinese, including operational guidance and support instructions. That enforces a specific language/locale in the skill's responses without offering user choice or documenting a justified locale restriction.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The code emits all user-visible warning and informational text in Chinese only. This can violate language/locale policy expectations because the skill forces a specific language without offering the user a choice or documenting a justified locale restriction.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This code emits validation errors only in Chinese string literals, which can force a specific language on users regardless of their locale or preference. The file does not indicate that the skill is intentionally region-specific or provide any opt-in or fallback language behavior.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The manifest description presents the skill behavior and invocation guidance entirely in Chinese, effectively imposing a language constraint without documenting user opt-in or a justified region-specific requirement. Under the policy, language restrictions should either be optional for the user or explicitly justified.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The example output contract shows `skill_name` as `tiktok-creator-videos`, which does not match the actual skill name `tiktok-yunying-zhushou`. Identity mismatches in machine-readable examples can confuse agents, break trust assumptions, or cause downstream routing/auditing errors if consumers rely on this field for verification.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The title and descriptions are written entirely in Chinese, which can impose a specific language on users without any stated opt-in or alternative. Under the policy, language-specific natural-language content should either offer a choice or clearly justify the locale constraint.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This JSON schema includes human-facing title and description text exclusively in Chinese. Because SQP-3 applies to all file types and flags forced language/locale choices without user opt-in, this appears to impose a specific language without documenting a justified locale constraint or offering alternatives.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The title and property descriptions are written exclusively in Chinese, which can impose a language constraint on users or downstream tools consuming this schema. There is no indication that the skill is region-specific or that users can opt into a preferred language, so this appears to be a natural-language locale policy issue.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16