Douyin Local Food

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it should be reviewed because its advertised data-analysis command produces hard-coded results instead of analyzing the user's data file.

Install only if you understand this is mainly a templated operations helper. Do not rely on the analyze command for real Douyin business metrics unless it is updated to parse your actual data, and run it in a workspace where report output paths cannot overwrite important files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Unpinned and Unnecessary Third-Party Dependencies Expand the Supply-Chain Attack Surface

Content

View full analysis

Vulnerability Details

File Location: README.md:8-10, also documented in SKILL.md:247-249 and declared in metadata.yaml:86-92
Vulnerability Type: Unpinned and unnecessary third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install pyyaml pandas openpyxl jinja2 markdown

The package metadata similarly declares these dependencies without version constraints or integrity hashes:

yaml

requirements:
  python: ">=3.8"
  dependencies:
    - "pyyaml"
    - "pandas"
    - "openpyxl"
    - "jinja2"
    - "markdown"

Technical Analysis

The installation instructions resolve mutable package versions from the configured Python package index. No exact versions, lock file, or cryptographic hashes are supplied, so users cannot reliably reproduce the reviewed dependency set.

The executable imports yaml but does not use it. It does not import or use pandas, openpyxl, jinja2, or markdown. Requiring these packages therefore exceeds the minimum dependency privileges necessary for the implemented functionality and unnecessarily increases the number of packages and transitive components that execute or become available in the environment.

This does not demonstrate that any currently named package is malicious. The security risk arises because a future compromised release, dependency, package-index account, or configured package source could cause users to install code that was not part of this audit.

Attack Path

1. A user follows the documented installation command.
2. pip resolves the latest versions allowed by the user's configured package index because no versions are pinned.
3. An upstream package, transitive dependency, or package-index release is compromised or replaced after this Skill was reviewed.
4. The compromised package executes installation-time code or is later imported in the user's Python environment.
5. That code runs with the priv ...[truncated 671 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove pandas, openpyxl, jinja2, and markdown unless corresponding functionality is actually implemented.
2. Remove pyyaml and its unused import if configuration loading is not required.
3. If dependencies are needed, pin reviewed versions in a lock file or fully constrained requirements file.
4. Require package hashes, for example through pip install --require-hashes -r requirements.txt.
5. Review and lock transitive dependencies using a dependency-management tool such as pip-tools.
6. Add automated dependency vulnerability and integrity scanning to the release process.
7. Keep README.md, SKILL.md, and metadata.yaml synchronized with the minimal dependency set.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill description, headings, examples, and configuration guidance are presented only in Chinese, which effectively forces a specific language for use of the skill. The file does not offer an alternative language option, user opt-in, or a clear justification that the skill is restricted to a Chinese-speaking or China-only compliance context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises commands that generate output files such as PDF, Markdown, and Excel via local scripts, which implies file-write capability, but it does not declare any tool scope or permissions boundary. In an agent environment, undeclared write capability can lead to unintended file creation or overwriting and weakens reviewability because operators cannot easily determine what filesystem access the skill expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing natural-language instructions entirely in Chinese, including the description, trigger guidance, examples, and cautions. Under the policy for natural-language violations, forcing a specific language without user choice can be a locale/language policy issue unless it is explicitly documented as region-specific or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This Python file contains user-facing descriptions and generated content entirely in Chinese, and the CLI help/output are also Chinese-only. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale constraint that should be documented or made optional.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function is presented as data analysis and accepts a data file path, but it never reads or validates that file and instead returns hard-coded metrics. This can mislead users into making operational decisions based on fabricated results, which is a real integrity issue even though it is not a classic code-execution flaw.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest-style YAML file uses Chinese for keys, descriptions, and operational guidance throughout, but does not document that the skill is China/Chinese-specific or offer any language/locale opt-in. Under the policy, forcing a specific language without user choice or clear justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This YAML template uses Chinese for all comments, field guidance, and example values, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest content is entirely presented in Chinese, including the skill name, capability descriptions, and use cases, but it does not document that the skill is China-specific or that users can opt into this locale/language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.