Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Douyin video downloader that saves a requested video locally and uploads it to cloud storage for sharing, with some practical privacy and validation caveats.
Before installing, be comfortable with requested Douyin videos being downloaded to /tmp and uploaded to cloud storage for about 30 days. Use it for public or non-sensitive videos, and consider adding explicit confirmation, URL allowlisting, and file-size limits if you maintain the skill.
代码的核心能力与声明中的前半部分基本一致：它确实解析抖音链接并下载无水印视频。但声明还明确包含“上传到云盘发给用户”的后续能力，而提供的代码仅下载到本地临时文件并打印路径，没有任何云盘上传、分享链接生成或消息发送逻辑。此外，声明描述的是面向用户消息触发的工具，而代码只是一个接收命令行参数的独立脚本。虽然这不改变其主要下载用途，但说明声明比实际实现更完整，存在实质性功能缺失，因此应判定为描述与行为不完全匹配。
The skill invokes networked behavior but does not declare any explicit tool scope or permissions, which weakens security review and execution-time policy enforcement. In practice, this can let a seemingly simple media utility perform outbound actions such as fetching content and uploading files without transparent capability declaration.
The skill description does not clearly warn users that submitted links and downloaded video files will be uploaded to cloud storage, which creates an undisclosed data-transfer risk. Even if the content is user-requested, silent secondary storage and sharing can expose personal, copyrighted, or sensitive media beyond the user's expectations.
The skill explicitly transmits downloaded content to a cloud-upload endpoint, creating an external data transfer path. In this skill context, that is more sensitive because the tool handles user-supplied URLs and media files, so it may redistribute content to third-party storage without strong consent, policy checks, or content validation.
PORT=${AUTH_GATEWAY_PORT:-19000}
curl -s -X POST http://localhost:$PORT/proxy/qclaw-cos/upload \
-H 'Content-Type: application/json' \
-d '{"localPath":"<视频路径>","conflictStrategy":"ask"}'
The script's only user-facing output is in Chinese, including installation status and usage guidance. This imposes a specific language on all users without any opt-in, fallback, or documentation that the skill is intended only for a Chinese-speaking or region-specific audience.
The manifest description explicitly includes a post-download delivery flow: uploading the watermark-free video to cloud storage and returning it to the user. In this file, the implemented behavior stops after downloading the file locally and printing metadata/path, with no cloud upload or user-delivery logic present.
The script extracts a video URL from untrusted remote HTML/JSON and then performs a second fetch against that URL without validating the destination host, scheme, or response type. If the upstream page is manipulated or parsing is subverted, this creates an SSRF-style primitive or arbitrary remote download path that can be used to make the agent contact unintended endpoints and store attacker-controlled content locally.
output = f"/tmp/douyin_{video_id}.mp4"
req = urllib.request.Request(video_url, headers={'User-Agent': HEADERS['User-Agent']})
with urllib.request.urlopen(req) as resp, open(output, 'wb') as f:
while True:
chunk = resp.read(8192)
if not chunk:
The script makes outbound HTTP requests to Douyin infrastructure using data derived from the user-provided link, but it does not explicitly warn the user that network requests will be made. While network access is functionally necessary here, there is no user-facing disclosure in code comments, prompts, or usage output beyond the general script description.
This Python code performs a network download and writes the result to a local file, but there is no explicit warning, confirmation, or user-facing disclosure before the write occurs. Although the script title mentions download behavior, the code itself gives no advance notice about the output location or that a file will be created automatically.
No suspicious patterns detected.