ClawHub
Back to skill

Security audit

alexliutkdownload

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: download a Douyin video, store it temporarily, upload it to cloud storage, and return a share link.

Install only if you want Douyin videos downloaded locally and uploaded to a cloud link. Use it only for media you have permission to save or share, expect files under /tmp and cloud retention for about 30 days, and clean up local or shared copies when the content should no longer be accessible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tainted flow: 'req' from requests.get (line 60, network input) → urllib.request.urlopen (network output)

Medium
Category
Data Flow
Content
output = f"/tmp/douyin_{video_id}.mp4"
        req = urllib.request.Request(video_url, headers={'User-Agent': HEADERS['User-Agent']})
        
        with urllib.request.urlopen(req) as resp, open(output, 'wb') as f:
            while True:
                chunk = resp.read(8192)
                if not chunk:
Confidence
92% confidence
Finding
The script fetches a share page, extracts a playback URL from untrusted remote content, and then performs a second network request to that derived URL without validating the destination host, scheme, or content type. This creates a server-side request/redirect risk and allows unbounded downloading of attacker-influenced content, which is more concerning in an agent skill that auto-processes user-supplied links.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill performs networked actions, including uploading content through a local gateway proxy, but does not declare corresponding permissions. Missing permission declarations reduce transparency and prevent meaningful policy enforcement or user review of what the skill can exfiltrate or transmit. In this context, the skill is explicitly designed to move downloaded media off-host, so undeclared network capability is a real security and governance issue.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The user-facing description does not clearly warn that the downloaded video will be uploaded to cloud storage and returned as a shareable link. This matters because users may assume the action is a local download only, while the skill actually republishes content externally, creating privacy, copyright, and unintended sharing risks.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The skill notes local storage in /tmp, but the description does not warn users that media is written to disk before upload. Temporary local storage can expose content to other local processes, persist longer than expected, or leak through shared environments, even if the direct impact is lower than external upload.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The script makes external HTTP requests and writes the downloaded file to /tmp automatically, with no consent prompt, size limits, or cleanup controls. In this skill's context, where a user sends arbitrary Douyin links and the agent downloads/uploads content, this can lead to disk exhaustion, privacy/compliance issues, and unexpected network/file system side effects.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
PORT=${AUTH_GATEWAY_PORT:-19000}
curl -s -X POST http://localhost:$PORT/proxy/qclaw-cos/upload \
  -H 'Content-Type: application/json' \
  -d '{"localPath":"<视频路径>","conflictStrategy":"ask"}'
```
Confidence
97% confidence
Finding
The skill transmits a local file path to an upload endpoint, resulting in external transfer of downloaded media to cloud storage. Even though the endpoint is reached through localhost, it is a proxy to a cloud upload service, so this is still data exfiltration from the local environment to an external system. In this skill's context, the transmission is intentional functionality, but it remains security-relevant because it can expose user-requested content beyond the local host.

Static analysis

No suspicious patterns detected.