Douyin Web Control

• Outcome: Pass
• Latest audit: Jun 5, 2026 at 11:01 AM UTC
• Version:
  0.1.3

Overview

This skill is a disclosed Douyin web-control helper with sensitive but purpose-aligned browser, account-action, screenshot, and recording capabilities.

Install only if you trust the external douyin-web-cli project and intend to let an agent operate your Douyin web session. Confirm before any public account action, and treat screenshots or recordings as sensitive because they can capture private page content or system audio.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The feature matrix explicitly documents screen and audio recording capability but does not mention consent, privacy boundaries, or capture risks. In an agent skill that automates Douyin web control, this increases the chance that upstream agents invoke recording on live sessions containing personal data, private messages, or system audio without clear user awareness.

VirusTotal

63/63 vendors flagged this skill as clean.