Security audit

抖音-社媒运营专家 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Douyin analytics workflow that uses Qinghu APIs with user authorization, though users should be aware it may request an API token and export result files locally.

Install this only if you intend to use Qinghu’s Douyin data APIs. Be prepared to provide or configure a Qinghu API token, approve paid tool calls before use, and manage any exported spreadsheet or cached data files the skill creates.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The metadata description says the skill 'must trigger' for broad, common requests like content operations, topic finding, trend checking, audience matching, and calendar planning. That creates overbroad activation conditions that can cause the agent to invoke this skill for generic social-media planning tasks, increasing the chance of unnecessary external API use, data handling, and paid actions without a narrowly scoped match.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example triggers are generic phrases such as asking for hot topics, topic ideas, or a content plan, which overlap heavily with ordinary assistant behavior. In context, this can route routine requests into a skill that is designed to collect external platform data and may lead to credential requests, tool calls, or paid API consumption when a normal text-only answer would suffice.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to export datasets by default and to use cached local file paths, while explicitly telling it not to ask the user whether export is needed. That can cause silent local file creation and persistence of potentially sensitive analytics data without clear user awareness or consent, increasing privacy and data-retention risk on the host machine.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill directs the agent to obtain API credentials from the user or read them from environment variables, but provides no privacy-safe handling guidance. In practice, overbroad triggering combined with credential solicitation can expose secrets unnecessarily, normalize secret collection in routine conversations, and increase the chance of accidental logging or misuse of tokens.

Static analysis

No suspicious patterns detected.