抖音视频快速转文字

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its transcription purpose, but it has a real command-injection risk and misleading privacy/offline claims that users should review before installing.

Install only if you are comfortable with the skill making external Douyin/MCP and media-download requests, and avoid processing untrusted links or filenames until the script is changed to use structured subprocess arguments instead of shell=True. Prefer an isolated environment and pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/douyin_transcribe_fast.py:29

Finding

Shell Command Injection Through Untrusted Command Arguments

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Remediation

View remediation

" ``` 2. Provide a locked dependency file that pins all transitive dependencies, not only the top-level package. 3. Generate and verify cryptographic hashes for downloaded distributions. Use pip hash checking where feasible: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Install in a dedicated virtual environment under a non-administrative account: ```bash python -m venv .venv ``` 5. Document the expected package index and discourage untrusted mirrors or additional package indexes. 6. Review dependency updates before changing pinned versions, and automate vulnerability and provenance checks in the release process. 7. Avoid recommending administrator or root-level pip installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims 'zero network dependency,' 'offline available,' and that video/audio never leaves the local machine, yet the described workflow requires calling douyin-mcp and downloading media from remote URLs. This is a security-relevant deception because users may make trust decisions based on false privacy and network assumptions, exposing their environment to unexpected outbound requests and remote content handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill exposes broader shell execution capability than needed because all external tooling is launched via a generic shell-based wrapper. In this skill's context, inputs come directly from users and remote parser output, so the gap between intended functionality (transcription) and actual capability (arbitrary shell interpretation) materially increases risk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a true tool-parameter abuse issue because a generic shell-backed subprocess primitive is exposed and fed with user-controlled and externally derived strings. An attacker can abuse crafted input to inject additional shell tokens or commands, turning a transcription utility into an arbitrary command runner.

Content

Scanner excerpt · scripts/douyin_transcribe_fast.py (reported line 31)May include surrounding context.

python

def run_command(cmd, cwd=None, timeout=300):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands, reads generated transcript files, and writes local artifacts like audio.wav, but it does not declare any explicit tool scope or permissions. This increases the chance of over-broad execution in agent environments, making it harder to enforce least privilege and easier for unsafe file or shell actions to occur unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad terms like '转文字' and '提取文案,' which can match many ordinary requests unrelated to Douyin links. In agent systems, overly broad activation can cause the skill to run unexpectedly, leading to unnecessary shell execution, file operations, or network retrieval against user inputs that did not clearly request this workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description does not warn users that processing a Douyin link requires fetching remote video data over the network. Missing this disclosure can mislead privacy-sensitive users and cause unexpected outbound connections and downloads from untrusted remote sources, especially in restricted or monitored environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The command hard-codes --language Chinese, and the workflow later states it returns Chinese text, which imposes a specific language behavior without user opt-in. This is a natural-language locale policy concern because users are not offered a language selection or informed that the output language is fixed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The helper wraps subprocess.run with shell=True and is later used with command strings that incorporate user-influenced values such as the Douyin share link, local file path, model, and output directory. This creates a command-injection sink: crafted input containing shell metacharacters can break out of quoting and execute arbitrary OS commands under the agent's privileges.

Content

Scanner excerpt · scripts/douyin_transcribe_fast.py (reported line 31)May include surrounding context.

python

def run_command(cmd, cwd=None, timeout=300):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The stated description emphasizes local Whisper transcription and high privacy, which suggests processing happens locally without broader external interactions beyond what is necessary. In practice, the code invokes mcporter call douyin-mcp.parse_douyin_video_info to resolve Douyin links and later uses ffmpeg against a remote video_url, meaning it depends on external networked services and remote media retrieval in addition to local transcription.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Whisper command hard-codes --language Chinese, which enforces a specific language/locale behavior regardless of the actual audio or user preference. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.