ClawHub
Back to skill

Security audit

Douyin Data Exporter

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it handles sensitive API tokens and business export data with under-scoped disclosure and unsafe file/CSV handling.

Review this skill carefully before installing. Only use it with tokens you are authorized to use, avoid passing bearer tokens on the command line, store exports in a protected location, and do not open generated CSV files in a spreadsheet unless remote text fields have been sanitized. The DOU+/BOSS export should be considered a separate sensitive business-data capability, not just a video export feature.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
export.py:68
Finding

User-Controlled Account Name Permits Path Traversal in Exported Files

Content
View full analysis
Remediation
View remediation
str: sanitized = re.sub(r"[^A-Za-z0-9 _-]", "_", value).strip() if not sanitized: raise ValueError("Account name does not contain any safe characters") return sanitized[:100] def safe_output_path(filename: str) -> Path: destination = (OUTPUT_ROOT / filename).resolve() try: destination.relative_to(OUTPUT_ROOT) except ValueError: raise ValueError("Output path escapes the designated output directory") return destination ``` Use the sanitized account name for every generated filename and use `safe_output_path()` immediately before every file write. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
export.py:73
Finding

Spreadsheet Formula Injection Through Exported Video Metadata

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tainted flow: 'headers' from os.getenv (line 102, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · export.py (reported line 104)May include surrounding context.

python
return {"error": "TIKHUB_TOKEN 未在 config.json 或环境变量中配置"}
    headers = {'Authorization': f'Bearer {TIKHUB_TOKEN}', 'Accept': 'application/json'}
    try:
        response = requests.get(url, headers=headers, params=params, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'headers' from os.getenv (line 102, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The skill accepts a user-supplied Dou+ bearer token and sends it to a separate external service to export advertising/lead data that is outside the stated homepage-video export scope. This creates an overbroad credential-use path and can facilitate unauthorized data extraction if an operator provides a powerful token without understanding the extra capability.

Content

Scanner excerpt · export.py (reported line 136)May include surrounding context.

python
headers = {"Authorization": f"Bearer {token}", "Accept": "application/json, application/vnd.ms-excel"}
    params = {"customerId": customer_id}
    try:
        resp = requests.get(url, headers=headers, params=params, timeout=60, stream=True)
        print(f"请求URL: {resp.url}", file=sys.stderr)
        resp.raise_for_status()
        content_type = resp.headers.get('Content-Type', '').lower()

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose says the skill exports Douyin homepage video data, but the documentation also includes exporting advertising/DOU+ order data, contacting an additional external service, and reading authentication tokens from environment variables or local configuration. This broader behavior materially expands data access and credential exposure beyond the stated purpose, creating a transparency and over-privilege problem.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The implementation materially exceeds the declared purpose of exporting homepage video data by also exporting Dou+ advertising or lead order data. This scope mismatch is dangerous because users may grant access expecting one data operation while the code performs a broader, more sensitive export against another business domain.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope or permissions even though its documented behavior involves environment-variable access, local file writes, and external network requests. This weakens user consent and sandboxing expectations, making it easier for the skill to access sensitive tokens and export data beyond what a minimally scoped skill should be allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill explicitly exports user video data and potentially advertising-order data to local files but does not warn users that these outputs may contain sensitive or business-confidential information. In practice, this increases the chance of accidental disclosure through insecure storage, sharing, or retention of exported datasets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions tell users to obtain and supply bearer tokens and customer identifiers but provide no warning that these are sensitive credentials that must not be hardcoded, logged, or shared. This can lead to token leakage through command history, screenshots, saved scripts, or improperly secured environment/config files, enabling unauthorized API access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · export.py (reported line 39)May include surrounding context.

python
sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding='utf-8')

# API 接口
API_BASE = "https://api.tikhub.io/api/v1"
USER_POST_VIDEOS_URL = f"{API_BASE}/douyin/app/v3/fetch_user_post_videos"

def get_config_value(key: str, default: str = None) -> str:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script reads TIKHUB_TOKEN from config.json or environment variables and also accepts a douplus token via CLI, but it does not disclose that credentials are being consumed for outbound requests. Under this rule, sensitive credential access should have some visible explanation, prompt, or documentation when not otherwise clearly warned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill writes exported Douyin and possibly Dou+ data to persistent local files in the workspace without any retention controls, sensitivity labeling, or user-facing disclosure. This can lead to unintended exposure of scraped account data or business export data to other local users, tools, backups, or later processes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Accepting a separate Dou+ token and customer ID introduces a hidden secondary capability unrelated to the primary stated function. In context, this increases risk because it enables collection of additional sensitive business data through credentials the user may not realize are being exercised by this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.