中文 EN
Start Review
Skill Trust Decision

guaikei-douyin-pull-video-comments

发现两处明确的文档欺骗行为：代码在运行时违反SKILL.md规范输出官网链接和微信号，但无恶意代码执行

Install decision first Source: ClawHub Scanned: 22 days ago
Files 33
Artifacts 10
Violations 0
Findings 2

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

10 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

What drove the risk score up

文档欺骗-官网链接 +15

SKILL.md禁止运行时输出官网链接，但token.js第25行在令牌无效时输出'www.guaikei.com'

文档欺骗-联系方式 +15

SKILL.md禁止运行时输出联系方式，但request.js第67行在认证失败时输出微信号'13395823479'

无恶意代码 +-5

代码结构清晰，无shell执行、凭证收割、混淆等恶意行为

Most important evidence

Medium Doc Mismatch

令牌无效时输出官网链接

SKILL.md明确禁止运行时输出官网链接，但src/utils/token.js第25行代码在GUAIKEI_API_TOKEN无效时输出了'快速获取通道: www.guaikei.com'，违反文档规范

src/utils/token.js:25
移除此行输出，仅保留中性错误消息'技能已暂停'
Medium Doc Mismatch

认证失败时输出微信号

SKILL.md规定'联系方式仅出现在readme.md，不在运行时输出'，但src/utils/request.js第67行在HTTP 401/403时输出了微信号'13395823479'

src/utils/request.js:67
修改错误消息为中性表述，移除微信号

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
logs/目录写入已在SKILL.md声明
Network Pass
Declared READ
→
Inferred READ
仅访问www.guaikei.com API
Shell Pass
Declared NONE
→
Inferred NONE
纯Node.js内置模块
Environment Pass
Declared READ
→
Inferred READ
仅读取GUAIKEI_API_TOKEN

Suspicious artifacts and egress

Medium External URL
https://www.douyin.com/user/MS4wLjABxxx

SKILL.md:120

Medium External URL
http://json-schema.org/draft-07/schema#

assets/comment_cli_req.schema.json:2

Medium External URL
https://v.douyin.com/xxx

references/options.md:48

Medium External URL
https://www.douyin.com/video/xxx

references/options.md:71

Medium External URL
https://www.douyin.com/user/$

src/api/comment.js:16

Medium External URL
https://www.douyin.com/note/xxx

src/douyin/comment-cli.js:37

Medium External URL
https://www.douyin.com/note/

src/validate/comment.js:10

Medium External URL
https://www.douyin.com/video/

src/validate/comment.js:12

Medium External URL
https://www.douyin.com/user/

src/validate/post.js:10

Medium External URL
https://v.douyin.com/

src/validate/post.js:12

Dependencies and supply chain

There are no structured dependency warnings.

File composition

33 files · 2625 lines
JavaScript 21 files · 1803 linesJSON 8 files · 421 linesMarkdown 4 files · 401 lines
Files of concern · 5
src/utils/token.js JavaScript · 36 lines
令牌无效时输出官网链接
SKILL.md Markdown · 153 lines
https://www.douyin.com/user/MS4wLjABxxx
src/utils/request.js JavaScript · 173 lines
认证失败时输出微信号
src/douyin/comment-cli.js JavaScript · 168 lines
https://www.douyin.com/note/xxx
references/options.md Markdown · 86 lines
https://v.douyin.com/xxx · https://www.douyin.com/video/xxx
Other files · search-cli.js · readme.md · post-cli.js · keyword.js · args.js · search_cli_resp.schema.json +1

Security positives

代码结构清晰，无恶意代码执行
仅使用Node.js内置模块，无第三方依赖风险
无shell执行、eval、base64解码等高危操作
无敏感文件路径访问（~/.ssh、~/.aws等）
日志写入有安全文件名清理
令牌仅从环境变量读取，不落盘