Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Douyin media downloader that discloses its network access, local downloads, batch mode, and automatic dependency setup, with no evidence of credential theft, persistence, or deceptive behavior.
Install and run this only in a dedicated Python environment, update or review the pinned dependencies first, and use a specific output folder. Expect it to contact Douyin-related services and create media files, especially in batch mode.
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
subprocess.run([sys.executable, script, link, '/path/to/output'])
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
subprocess.run([sys.executable, script, '--batch', 'links.txt', '/path/to/output'])
The file pins idna==3.13, which static analysis reports as having known advisories. Because this skill downloads content from user-supplied links and relies on HTTP client dependencies, a vulnerable IDNA library can affect hostname parsing/validation and may enable crafted-domain abuse, misrouting, or security control bypass in network requests.
The file pins urllib3==2.6.3, which static analysis identifies as affected by multiple known vulnerabilities. This is particularly relevant because the skill is a downloader that makes outbound HTTP requests to attacker-influenced URLs; issues in redirects, header forwarding, or decompression handling can increase the risk of SSRF-like behavior, credential leakage across origins, or resource-exhaustion attacks.
The skill clearly performs network access, local file writes, and invokes a Python subprocess, but the manifest does not declare any tool scope or permissions boundaries. This creates a transparency and governance gap: an agent or user may invoke the skill without understanding that it can access the network and create files on disk.
The documentation describes saving media locally and supporting batch downloads, but it does not clearly warn that execution may create multiple files and directories on disk. In agent contexts, missing disclosure about filesystem side effects can lead to unintended overwrites, storage exhaustion, or writing into sensitive locations if the output path is user-controlled.
Auto-installing dependencies via pip is broader than the stated purpose of a downloader and introduces code execution and environment-modification behavior. In the context of an agent skill, this is especially sensitive because users may expect only network fetching of media, not package installation that can alter the host runtime or trigger install-time code from dependencies.
The script automatically invokes pip at runtime when requests is missing, which expands its behavior from media downloading to modifying the local Python environment. Even though it uses a local requirements.txt and --require-hashes, this still executes an external package manager subprocess in the user's environment and can install code-bearing packages, which is risky for an agent skill because it performs system changes without explicit user approval.
_req_file = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "requirements.txt")
if os.path.exists(_req_file):
print("[*] 检测到缺少 requests 库，正在通过 requirements.txt 安装（SHA256 hash 校验）...")
subprocess.run(
[sys.executable, "-m", "pip", "install", "-r", _req_file, "--require-hashes", "-q"],
check=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
if is_image:
r = requests.get(url, headers=HEADERS, timeout=30)
r.raise_for_status()
with open(filepath, "wb") as f:
f.write(r.content)
size_kb = len(r.content) / 1024
print(f"[OK] 下载完成！保存至: {os.path.abspath(filepath)} ({size_kb:.0f} KB)")
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
if is_image:
r = requests.get(url, headers=HEADERS, timeout=30)
r.raise_for_status()
with open(filepath, "wb") as f:
f.write(r.content)
size_kb = len(r.content) / 1024
print(f"[OK] 下载完成！保存至: {os.path.abspath(filepath)} ({size_kb:.0f} KB)")
All user-facing natural-language content in the skill file is Chinese, and there is no indication that the user can opt into another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a skill forces a specific language without user choice.
The skill documentation states that it fetches and resolves user-provided Douyin links over HTTP, but it does not disclose the privacy and network implications. User-supplied URLs and metadata may be transmitted to external services, which matters in environments where outbound requests or URL handling are sensitive.
The file’s human-readable instructions and labels are entirely in Chinese, including the title and update/install guidance. This creates a language-specific constraint in natural language without indicating user choice or a documented regional requirement, which matches the language/locale policy concern.
The docstring/manifest framing suggests a self-contained native Python downloader requiring no extra configuration. In practice, the script may modify the environment by installing packages at runtime, which contradicts that no additional setup is needed in the ordinary sense.
The module docstring and all user-facing guidance are written only in Chinese, and the script's CLI messages likewise assume Chinese-language interaction. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language choice is offered.
No suspicious patterns detected.