抖音无水印下载器

• Outcome: Review
• Latest audit: Jul 19, 2026 · 3:48 AM UTC
• Version: 1.0.6

Overview

The skill appears to do what it claims, but it should be reviewed because it auto-installs dependencies and pins HTTP libraries with current security advisories.

Install only after reviewing the dependency behavior. Prefer running it in a dedicated virtual environment and output directory, and update the pinned requirements before use. I found no evidence of hidden credential collection, exfiltration, persistence, or destructive actions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

_req_file = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "requirements.txt")
    if os.path.exists(_req_file):
        print("[*] 检测到缺少 requests 库，正在通过 requirements.txt 安装（SHA256 hash 校验）...")
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "-r", _req_file, "--require-hashes", "-q"],
            check=True,
        )

• Confidence: 91% confidence
• Finding: The script automatically invokes pip to install dependencies at runtime via a subprocess. Even though it uses a local requirements.txt and --require-hashes, executing package installation as part of normal tool operation expands the attack surface, can trigger unintended code execution through package install hooks, and is inappropriate for a downloader script handling untrusted environments.

Tainted flow: 'filepath' from requests.get (line 403, network input) → open (file write)

Medium

• Category: Data Flow

Content

if is_image:
            r = requests.get(url, headers=HEADERS, timeout=30)
            r.raise_for_status()
            with open(filepath, "wb") as f:
                f.write(r.content)
            size_kb = len(r.content) / 1024
            print(f"[OK] 下载完成！保存至: {os.path.abspath(filepath)} ({size_kb:.0f} KB)")

• Confidence: 83% confidence
• Finding: The file path used for writing downloaded content is partly derived from remote metadata such as description and author fields. While _safe_name strips many dangerous characters, it does not enforce a non-empty safe basename, reject reserved device names, or canonicalize and verify the final path stays within the intended output directory, so crafted metadata or attacker-controlled output_dir values could cause overwrites or writes to unexpected locations.

Tainted flow: 'filepath' from requests.get (line 403, network input) → open (file write)

Medium

• Category: Data Flow

Content

total = int(r.headers.get("content-length", 0))
            downloaded = 0
            with open(filepath, "wb") as f:
                for chunk in r.iter_content(chunk_size=8192):
                    if chunk:
                        f.write(chunk)

• Confidence: 83% confidence
• Finding: The streaming download path writes to a filepath that is influenced by remote content metadata and user-supplied output directories. Without enforcing that the resolved path remains within a trusted base directory, the script may overwrite arbitrary files accessible to the user if a malicious path is introduced through metadata edge cases or unsafe caller input.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation shows the skill can invoke Python via subprocess, access local files for batch input, and perform network downloads, but it does not declare these capabilities as permissions or clearly scope them. Undeclared powerful capabilities weaken user trust and security review because an agent may execute network, shell, and filesystem actions without explicit consent boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Auto-installing dependencies during execution is risky because it causes code acquisition and execution unrelated to the core media-download action. Even with hash checking, this behavior can surprise users, bypass normal environment controls, and execute installer-time code from packages when the script is run.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The SOP and usage text instruct the skill to download media and save it locally, including creating directories and files, but do not prominently warn about local disk modifications. This can lead to unexpected file creation, clutter, or overwriting risks, especially in automated agent contexts where users may not realize the skill changes the local filesystem.

Known Vulnerable Dependency: idna==3.13 — 2 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA) for Python provides suppor)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The requirements file pins idna==3.13, which is flagged with published advisories. Because this package influences domain-name parsing and normalization in HTTP workflows, a vulnerable version can enable crafted-input handling issues that may affect request routing, validation, or trust decisions in downloader/network code.

Known Vulnerable Dependency: urllib3==2.6.3 — 4 advisory(ies): CVE-2026-44432 (urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API); CVE-2026-44431 (urllib3: Sensitive headers forwarded across origins in proxied low-level redirec); CVE-2026-44431 (urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-o) +1 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The file pins urllib3==2.6.3, which is reported vulnerable to multiple HTTP-client issues including redirect/header forwarding and decompression-bomb related weaknesses. In a downloader skill that fetches remote content from user-supplied links, this is especially relevant because attackers may control endpoints, redirects, or response bodies to trigger credential leakage, SSRF-adjacent abuse, or resource exhaustion.

Static analysis

No suspicious patterns detected.