中文 EN
Start Review
Skill Trust Decision

guaikei-douyin-trending-videos-and-rankings

文档-行为严重不符：SKILL.md明确禁止运行时输出联系方式，但token.js和request.js在认证失败时输出微信号和官网链接用于引流；存在未声明的外部API端点。

Install decision first Source: ClawHub Scanned: 20 days ago
Files 34
Artifacts 12
Violations 1
Findings 3
Most direct threat evidence
High Doc Mismatch
运行时输出禁止的联系方式

SKILL.md明确声明'令牌无效时仅输出中性错误信息，不输出任何联系方式、官网链接或推广内容'，但代码在认证失败时输出微信ID和网站链接，用于商业引流。

src/utils/token.js:21

Why this conclusion was reached

2/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

12 lower-risk artifacts were extracted and still need context.

Block
Attack chain and severe findings

The report includes 0 attack-chain steps and 2 severe findings.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

What drove the risk score up

文档-行为不符(文档欺骗) +25

SKILL.md明确禁止运行时输出联系方式，但src/utils/token.js:21输出'www.guaikei.com'，src/utils/request.js:57输出'联系微信:13395823479'

未声明的外部API端点 +10

src/config/constants.js定义BASE_URL为'www.guaikei.com'但SKILL.md未声明此第三方服务

日志文件写入 +5

src/utils/log.js写入logs/目录，虽文档注明'日志除外'但最小权限声明未明确filesystem:WRITE

Most important evidence

High Doc Mismatch

运行时输出禁止的联系方式

SKILL.md明确声明'令牌无效时仅输出中性错误信息，不输出任何联系方式、官网链接或推广内容'，但代码在认证失败时输出微信ID和网站链接，用于商业引流。

src/utils/token.js:21
删除此行，或将获取通道信息移至readme.md（用户文档）而非运行时输出
High Doc Mismatch

AuthError中输出微信号码

认证错误时输出完整联系方式，与SKILL.md禁止运行时输出联系方式的规定冲突。

src/utils/request.js:57
将错误信息改为中性描述，如'令牌无效，请检查环境变量配置'
Medium Sensitive Access

未声明的外部API服务

技能连接至www.guaikei.com第三方服务，但SKILL.md仅声明'仅联网 API 服务地址'而未指明具体域名。

src/config/constants.js:6
在SKILL.md环境与权限部分明确声明使用的API服务域名

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred WRITE
src/utils/log.js:34 写入logs/目录；SKILL.md:48仅声明'不写入文件系统（日志除外）'但最小权限部分未明确
Network Block
Declared READ
→
Inferred READ+WRITE
src/utils/request.js:89 postJson方法向www.guaikei.com发送POST请求；SKILL.md未声明此第三方服务
Environment Pass
Declared READ
→
Inferred READ
src/utils/token.js:17 仅读取GUAIKEI_API_TOKEN，未遍历敏感环境变量

Suspicious artifacts and egress

Medium External URL
https://www.douyin.com/user/MS4wLjABxxx

SKILL.md:108

Medium External URL
https://www.douyin.com/video/xxx

SKILL.md:111

Medium External URL
http://json-schema.org/draft-07/schema#

assets/comment_cli_req.schema.json:2

Medium External URL
https://v.douyin.com/xxx

references/options.md:48

Medium External URL
https://clawhub.ai/user/engheng-art

skill-card.md:9

Medium External URL
https://clawhub.ai/engheng-art/skills/guaikei-douyin-trending-videos-and-rankings

skill-card.md:43

Medium External URL
https://www.douyin.com/user/$

src/api/comment.js:16

Medium External URL
https://www.douyin.com/note/xxx

src/douyin/comment-cli.js:37

Medium External URL
https://www.douyin.com/note/

src/validate/comment.js:10

Medium External URL
https://www.douyin.com/video/

src/validate/comment.js:12

Medium External URL
https://www.douyin.com/user/

src/validate/post.js:10

Medium External URL
https://v.douyin.com/

src/validate/post.js:12

Dependencies and supply chain

There are no structured dependency warnings.

File composition

34 files · 2676 lines
JavaScript 21 files · 1803 linesMarkdown 5 files · 452 linesJSON 8 files · 421 lines
Files of concern · 5
src/utils/token.js JavaScript · 36 lines
运行时输出禁止的联系方式
SKILL.md Markdown · 143 lines
https://www.douyin.com/user/MS4wLjABxxx · https://www.douyin.com/video/xxx
src/utils/request.js JavaScript · 173 lines
AuthError中输出微信号码
src/douyin/comment-cli.js JavaScript · 168 lines
https://www.douyin.com/note/xxx
references/options.md Markdown · 86 lines
https://v.douyin.com/xxx
Other files · search-cli.js · readme.md · post-cli.js · keyword.js · args.js · search_cli_resp.schema.json +1

Security positives

仅使用Node.js内置模块，无外部npm依赖，避免供应链攻击风险
未发现凭证收割、环境变量遍历或敏感路径访问行为
未发现base64编码、eval执行或代码混淆等恶意技术
未发现反向shell、C2通信或数据外泄行为
日志文件名使用白名单过滤，防止路径遍历攻击
令牌通过环境变量传入，代码中无硬编码凭证