global-content-search

SUSPICIOUS: the stated purpose matches content search, but the implementation footprint is broader than necessary because it depends on several external CLIs, uses a third-party Guaikei fallback for Xiaohongshu, and permits arbitrary adapter execution via DOUYIN_COMMAND. This looks more like an ecosystem integration skill than overt malware, but install trust and credential/data routing are only partially aligned with the read-only search claim.

No direct malicious behavior (e.g., explicit data theft/exfiltration, backdoor/persistence, or obvious malware routines) is evident in this module. However, it is security-critical because it executes local processes and includes two high-impact risk patterns: arbitrary local command execution driven by process.env.DOUYIN_COMMAND, and a shell invocation in commandExists() using sh -lc with interpolated text (shell-injection-prone if ever fed attacker-controlled data). Inputs extracted from caller-provided URLs/keywords are forwarded to external CLIs and must be treated as untrusted. If the runtime environment and CLI dependencies are not tightly controlled, this module could be abused for local command execution, even though the file itself does not appear to contain overt malware.