Douyin Video Search

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:28 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Douyin search tool that uses a TikHub API token, with some disclosure and logging weaknesses but no evidence of hidden or malicious behavior.

Before installing, confirm you trust TikHub with your search queries and API token, avoid searching sensitive terms, and be aware that the script currently prints raw response snippets for debugging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/douyin_search.py:88

Finding

Unconditional Logging of Raw API Response Data

Content

View full analysis

Vulnerability Details

File Location: scripts/douyin_search.py, lines 88–89
Vulnerability Type: Uncontrolled exposure of API response data through debug output
Risk Level: Low

Complete Code Snippet:

python

resp = requests.post(TIKHUB_SEARCH_URL, json=payload, headers=headers, timeout=30)
print(f"DEBUG: status_code={resp.status_code}")
print(f"DEBUG: response_text={resp.text[:500]}")
resp.raise_for_status()

Technical Analysis

The script unconditionally prints the first 500 characters of every TikHub API response to standard output. This occurs regardless of whether the user requested raw output with --raw.

API responses may contain search data, provider diagnostics, request identifiers, account-related metadata, or detailed error information. Printing the raw response bypasses the script's normal formatting and data-minimization behavior. It can also contaminate output expected to contain only formatted text or JSON, causing downstream parsers to fail.

The bearer token itself is placed in the HTTPS Authorization header and is not directly printed by the shown code. Sending it to the fixed TikHub endpoint is necessary for the declared API-backed search functionality. The confirmed issue is the unnecessary disclosure of response content after the request.

Attack Path

1. A user or Agent invokes the script to perform a TikHub search.
2. TikHub, an intermediary affecting the response, or an abnormal upstream condition causes sensitive, attacker-controlled, or misleading information to appear within the first 500 response characters.
3. Lines 88–89 print that content to standard output without requiring a debug option.
4. An Agent transcript, automation pipeline, terminal logger, or centralized log collector records the output.
5. Anyone with access to those records may obtain the exposed response data. In addition, attacker-controlled response text may mislead consumers that treat co ...[truncated 721 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional debug statements:

   python

   # Remove these statements:
   # print(f"DEBUG: status_code={resp.status_code}")
   # print(f"DEBUG: response_text={resp.text[:500]}")
   

2. If diagnostics are operationally necessary, require an explicit --debug option and send diagnostics to standard error so standard output remains machine-readable.

3. Log only minimal metadata, such as the HTTP status code and response length. Do not log raw response bodies by default:

   python

   if debug:
       print(
           f"DEBUG: status_code={resp.status_code}, "
           f"response_length={len(resp.content)}",
           file=sys.stderr,
       )
   

4. Redact authorization values, tokens, cookies, request identifiers, and account metadata from any optional diagnostic output.

5. Keep verbose logs disabled by default and document that enabling them may expose API-returned data.

6. Add tests verifying that normal and --raw modes produce no unsolicited debug prefixes or response excerpts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tainted flow: 'headers' from os.environ.get (line 70, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/douyin_search.py (reported line 89)May include surrounding context.

python

try:
        # 文档明确指定使用 POST 方法
        resp = requests.post(TIKHUB_SEARCH_URL, json=payload, headers=headers, timeout=30)
        print(f"DEBUG: status_code={resp.status_code}")
        print(f"DEBUG: response_text={resp.text[:500]}")
        resp.raise_for_status()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool scope or permissions despite clearly requiring network access, reading local configuration, and invoking Python code. This weakens least-privilege controls and can allow broader-than-expected execution or data access if the runtime grants default capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description does not warn users that their search keywords are transmitted to an external third-party API, which creates a privacy and data-handling risk. Users may unknowingly send sensitive terms, internal project names, or personal data to TikHub, especially because the skill is presented as a verified core tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language strings and interface text indicate the skill is designed exclusively in Chinese, but the file does not offer any language selection or explain that it is intentionally region- or locale-specific. Under the policy, forcing a specific language without user opt-in is a locale-policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/douyin_search.py (reported line 14)May include surrounding context.

python

import argparse

# API端点（来自文档）
TIKHUB_SEARCH_URL = "https://api.tikhub.io/api/v1/douyin/search/fetch_general_search_v1"


def load_config():

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The code transmits search terms and an authentication token to an external third-party API. This is central to the skill's purpose and not inherently malicious, but it creates a real data exposure boundary: user queries, usage patterns, and credentials are shared outside the local environment.

Content

Scanner excerpt · scripts/douyin_search.py (reported line 89)May include surrounding context.

python

try:
        # 文档明确指定使用 POST 方法
        resp = requests.post(TIKHUB_SEARCH_URL, json=payload, headers=headers, timeout=30)
        print(f"DEBUG: status_code={resp.status_code}")
        print(f"DEBUG: response_text={resp.text[:500]}")
        resp.raise_for_status()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sends user-provided search keywords together with a bearer token to a third-party service without any explicit notice, consent flow, or privacy warning in the code path. In this skill context, external transmission is inherent to functionality, but users may not realize their queries and associated metadata are being disclosed to TikHub.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.