douyin push video

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:01 AM UTC
• Version: 1.0.0

Overview

This Douyin posting skill does what it claims, but it handles powerful account tokens in plaintext with weak safeguards.

Review this before installing if you plan to use real Douyin credentials. Use a throwaway or narrowly scoped token where possible, avoid running the helper in logged terminals or CI, do not commit .env, restrict its file permissions, and revoke or rotate the token after use. The observed issues support Review, not malicious classification, because the sensitive behavior is tied to the stated Douyin posting purpose and no hidden exfiltration or destructive behavior was found.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/get-douyin-token.js:67

Finding

OAuth Access and Refresh Tokens Exposed in Plaintext Console Output

Content

View full analysis

` to exchange an OAuth authorization code. 2. The script prints the complete access token and refresh token to the console. 3. Terminal output is captured by a CI system, remote administration platform, process supervisor, session recorder, or another user with access to the terminal history. 4. An attacker extracts the bearer credential from the retained output. 5. The attacker invokes the Douyin API using the stolen token. 6. If the granted scopes include `video.create`, the attacker may upload or publish content as the authorized user. A stolen refresh token may enable renewed access, subject to Douyin's token validity and revocation rules. ### Impact Assessment An attacker can obtain the OAuth privileges granted to ...[truncated 408 chars]

Remediation

View remediation

value ? `${'*'.repeat(Math.max(0, value.length - 4))}${value.slice(-4)}` : '(missing)'; console.log('open_id:', openId); console.log('access_token received:', maskSecret(accessToken)); console.log('expires_in(seconds):', data?.expires_in); ``` 4. If credentials must be passed to another process, use an operating-system secret manager, protected file descriptor, or another channel designed for secrets rather than standard output. 5. Ensure CI and process-management systems redact known token fields. 6. Document token revocation and rotation procedures and advise users to revoke credentials immediately after suspected disclosure. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get-douyin-token.js:72

Finding

OAuth Access Token Persisted Without Enforced Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section explicitly instructs the agent to write user-provided openId and accessToken into a persistent project file and retain them for later use. Storing live OAuth credentials in workspace files materially increases the risk of credential theft, unintended reuse across tasks, exfiltration by other tools or prompts, and accidental publication.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

项目中的 `index.js` 会自动读取 `.env`，无需用户再手动设置环境变量。

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill normalizes taking authorization outputs and writing them into .env via script-assisted flows, reinforcing long-term retention of sensitive tokens instead of minimizing exposure. Because this occurs during an OAuth exchange, users may be nudged into unsafe storage at the moment fresh credentials are issued, when compromise would immediately enable account actions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins form-data to 4.0.5, which the static analysis identifies as affected by CVE-2026-12143, a CRLF injection issue in multipart field handling. In a Douyin-posting skill that uploads user-supplied files and metadata, multipart construction is central functionality, so if any attacker-controlled field names or related multipart parameters reach this library, it could enable malformed request smuggling or header/body injection against downstream HTTP processing.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill depends on form-data 4.0.5, which is flagged with a CRLF-injection vulnerability in multipart field names. In a video-uploading skill that constructs multipart requests to external APIs, malformed or attacker-controlled field names could potentially corrupt request boundaries or inject unintended headers/parts, making this context more relevant than a purely local-use package.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 4)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 78)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 82)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 139)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 151)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 172)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 179)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get-douyin-token.js (reported line 2)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get-douyin-token.js (reported line 4)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get-douyin-token.js (reported line 26)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get-douyin-token.js (reported line 40)May include surrounding context.

js

/**
 * 用抖音授权码 code 换取 open_id 和 access_token，并可选择写入 .env
 * 用法：node scripts/get-douyin-token.js <code> [--write]
 * 依赖 .env 或环境变量：DOUYIN_CLIENT_KEY、DOUYIN_CLIENT_SECRET
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 18)May include surrounding context.

js

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const root = path.resolve(__dirname, '..');
config({ path: path.join(root, '.env') });

const code = process.argv[2];
const shouldWrite = process.argv.includes('--write');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get-douyin-token.js (reported line 14)May include surrounding context.

js

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const root = path.resolve(__dirname, '..');
config({ path: path.join(root, '.env') });

const code = process.argv[2];
const shouldWrite = process.argv.includes('--write');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

When --write is used, the script stores the Douyin open_id and access token in plaintext inside the project's .env file. In the context of a posting skill, these credentials are powerful enough to act on the user's Douyin account, so plaintext storage increases the risk of compromise through accidental commit, local file disclosure, backup leakage, or over-broad file permissions.

Content

Scanner excerpt · scripts/get-douyin-token.js (reported line 78)May include surrounding context.

js

if (data?.refresh_token) console.log('refresh_token:', data.refresh_token);

if (shouldWrite) {
  const envPath = path.join(root, '.env');
  let envContent = '';
  if (fs.existsSync(envPath)) {
    envContent = fs.readFileSync(envPath, 'utf8');

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill directs the agent to use environment-file writes and external OAuth/network flows, but it declares no explicit tool scope or allowed-tools boundary. This creates an authorization gap where a host agent may perform sensitive actions without clear least-privilege constraints or user-visible permission framing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the agent to persist openId and accessToken in a project .env file and even says they 'will be kept' for future use, but it provides no warning about credential sensitivity, token lifetime, leakage risk, or file access exposure. Persistent local storage increases the chance of accidental disclosure through source control, logs, backups, or other tools reading the workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language interface is entirely in Chinese, including the top-level description and later CLI usage/errors, but it does not state that the skill is China/Chinese-only or provide user opt-in for language. The policy explicitly flags language or locale requirements that are imposed without user choice or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get-douyin-token.js (reported line 51)May include surrounding context.

js

grant_type: 'authorization_code',
});

const res = await fetch('https://open.douyin.com/oauth/access_token/', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: body.toString(),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prints OAuth access tokens and refresh tokens directly to stdout, which can expose credentials through terminal history, shell logging, CI logs, remote session transcripts, or screen sharing. In a skill designed to publish to a user's Douyin account, these tokens grant account/API access, so accidental disclosure can enable unauthorized posting or further token abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill description and operating instructions are written entirely in Chinese and present Chinese reply examples, but do not state that language is optional or user-selectable. This can create a language/locale policy issue if the agent follows the skill by default for users who did not opt into Chinese responses.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:135

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/get-douyin-token.js:37

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: index.js:136