Douyin Trend Finder

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 1.0.0

Overview

This skill is a simple Douyin trend-analysis prompt with a disclosed Python dependency and no evidence of hidden execution, persistence, credential access, or destructive behavior.

Before installing, consider using a pinned or controlled dependency source for requests if you need reproducible installs. The skill otherwise appears limited to public trend research and content-analysis assistance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:10

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-18
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Low

Vulnerable Code Snippet:

yaml

"install":
  [
    {
      "id": "requests",
      "kind": "pip",
      "package": "requests",
      "label": "安装依赖：pip3 install requests",
    },
  ],

Technical Analysis

The skill declares the PyPI package requests without specifying an exact version or an integrity hash. Consequently, the package version installed depends on the state of the configured package index at installation time. This prevents reproducible dependency resolution and makes the reviewed skill configuration insufficient to determine the exact code that will ultimately be installed.

The named requests package is legitimate, and the audited file contains no evidence that it intentionally selects a malicious or typosquatted package. Exploitation therefore depends on an external supply-chain event, such as compromise of a package release, compromise or misconfiguration of the package index, or substitution through an untrusted package mirror. The absence of a lock file also leaves transitive dependency versions uncontrolled.

Attack Path

1. A user or automated skill installer processes the dependency declaration.
2. The installer resolves requests and its transitive dependencies from the configured Python package index without enforcing reviewed versions or hashes.
3. An attacker who has compromised the package source, release process, dependency resolution path, or configured mirror supplies a modified package artifact.
4. The installer downloads and installs that artifact.
5. Malicious installation hooks or imported package code execute with the privileges of the installation or runtime process.

This path is conditional; the audited project itself contains no malicious package payload, package-index override, or direct ...[truncated 541 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests to an explicitly reviewed version rather than allowing unconstrained resolution.
• Maintain a lock file that fixes all transitive dependency versions.
• Require cryptographic hashes for downloaded distributions, such as through a hash-locked requirements file and pip install --require-hashes.
• Retrieve packages only from an approved, authenticated package index or controlled internal mirror.
• Periodically scan pinned dependencies for known vulnerabilities and update them through a reviewed process.
• Prefer prebuilt, verified artifacts and perform installation in an isolated, least-privileged environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.