Security audit
Security checks for vulnerabilities and agentic risk
This skill is meant to send Douyin private messages, but it can act through a live account without a final confirmation and retains or reuses sensitive session data in ways users should review carefully.
Review this skill before installing. Use it only if you are comfortable with an agent operating a logged-in Douyin session, and require manual confirmation of the account, recipient, and exact message before sending. Avoid using the bundled script as-is because it hard-codes a local browser profile and writes screenshots that may expose private messages. Prefer a pinned dependency version or manually provide the Douyin display name instead of installing another skill dynamically.
SKILL.md:76JavaScript Injection Through Unescaped Message Content
SKILL.md:29Unpinned Third-Party Skill Installation
scripts/send_douyin_dm.mjs:21Hard-Coded Browser Profile Path Creates Unsafe Session Coupling
scripts/send_douyin_dm.mjs:41Persistent Screenshots May Disclose Private Conversation Data
The skill directly automates an irreversible external action—sending a private message—without requiring a final explicit confirmation of recipient and content immediately before submission. This is dangerous because a wrong search result, incorrect nickname resolution, or misunderstood prompt can cause unintended communication from the user's account, with social, privacy, and reputational consequences.
The trigger description includes broad phrases such as sending a message or mentioning 'douyin send message', which can cause the skill to activate from ambiguous user requests that do not clearly authorize a Douyin private message action. Because the skill performs a real external action on the user's logged-in account, overbroad triggering increases the risk of unintended message sending.
The example trigger '给 xxx 发消息' is highly generic and does not constrain the action to Douyin, making accidental invocation likely when the user simply wants to draft, discuss, or send a message through another channel. In this skill's context, accidental activation is more dangerous because execution results in an actual private message being sent through a live browser session.
The skill does not clearly disclose that it will access and operate within the user's authenticated Douyin web session, including searching accounts, opening profiles, and interacting with private-message UI elements. This insufficient disclosure increases privacy and account-operation risk because users may not realize the skill is acting in a live signed-in context and potentially exposing sensitive on-screen data.
The script launches Playwright with a hard-coded persistent browser profile path, causing it to reuse whatever authenticated Douyin session and browser state already exist on that machine. In the context of an automation skill that sends private messages, this is dangerous because it can act as the logged-in user without explicit disclosure or isolation, and it also tightly binds the skill to a specific local user environment.
The script uses a persistent browser profile containing local authenticated session data but does not clearly disclose that behavior to the user. In practice, this allows the automation to perform actions as whoever is already logged in, which is especially sensitive for direct messaging because it can impersonate the local account holder and access private account context.
The script sends the private message immediately by pressing Enter, with no confirmation prompt or last-chance review before an irreversible external action. In a messaging skill, this increases the risk of accidental delivery, misuse, or sending messages through an unintended authenticated account.
The script saves a post-send screenshot after transmitting the message, which can capture private message contents, recipient identity, and surrounding chat history. Because the skill's purpose is message sending rather than record collection, this introduces avoidable exposure of sensitive communications.
The file's human-facing documentation and runtime messages are written only in Chinese, which imposes a specific language on users without indicating that it is language-specific or optional. This matches the policy concern for forced language or locale in natural-language content.
When the target user is not found, the script saves a local screenshot for debugging even though the declared purpose is only to send a Douyin DM. That screenshot may capture account information, contact lists, or other page contents unrelated to the requested action, creating unnecessary data retention.
No suspicious patterns detected.