The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill hardcodes a fallback API token ('e10adc3949ba59abbe56e057f20f883e') in lib/key.js, which is used if the environment variable GUAIKEI_API_TOKEN is not provided. This token is functionally a shared secret exposed in the source code.
[DATA_EXFILTRATION]: Sensitive credentials (API token) are transmitted to the external domain www.guaikei.com as URL query parameters in lib/douyin.js. Transmitting tokens in URLs is an insecure practice as they are frequently logged by servers, proxies, and browser history.
[DATA_EXFILTRATION]: The skill automatically writes search results, including the user's search keyword and associated metadata, to a local file scripts/last-search.json in scripts/search.js. This creates a local history of potentially sensitive research data.
[EXTERNAL_DOWNLOADS]: The skill initiates network requests to fetch data from www.guaikei.com, which is an unverified third-party service not associated with the primary vendor infrastructure.
[PROMPT_INJECTION]: The skill ingests untrusted user input from command-line arguments and uses it in filesystem paths for lock files and in network requests without robust sanitization.
Ingestion points: process.argv in scripts/search.js.
Boundary markers: None.
Capability inventory: Filesystem writes (idempotency lock files and search logs) and network operations (HTTPS requests to an external API).
Sanitization: Basic character filtering using a regular expression in lib/douyin.js that allows periods and spaces, which may lead to minor filesystem side effects.

douyin-search-keyword