ClawHub
Back to skill

Security audit

Douyin Video Search

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do the advertised Douyin video search through TikHub, with expected token and network use but some privacy and polish caveats.

Install only if you are comfortable storing or exposing a TikHub API token to this script and sending your Douyin search terms and filters to TikHub. Avoid using sensitive names, secrets, internal project terms, or private investigative queries as search keywords, and prefer a revocable or quota-limited TikHub token.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill sends user-provided search keywords to the external TikHub API, but the description does not warn users that their queries leave the local environment. Search terms may contain sensitive business, personal, or investigative information, so omitting this disclosure creates a privacy and data-handling risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.