Security audit

抖音私信发送

Security checks across malware telemetry and agentic risk

Overview

The skill is meant to send Douyin private messages, but it can send from a logged-in browser without a final confirmation and includes an under-scoped local browser profile script.

Review carefully before installing. Use only with a dedicated Douyin automation browser profile, avoid sensitive messages, and require the agent to confirm the exact recipient and message before sending. Treat the optional person-relation-manager install as a separate dependency decision.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to install another skill by running a shell command, even though installing software is outside the core task of sending a Douyin DM. This expands the attack surface and creates a supply-chain risk: a user asking to send a message could indirectly trigger installation of additional code or capabilities they did not explicitly request.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script hard-codes a local Playwright browser profile directory under a specific user home path, causing it to reuse an existing authenticated browser context and any stored cookies or session state. This is dangerous because the skill can act as the logged-in Douyin account without an explicit authentication step, and on another machine it may fail unpredictably or encourage operators to point it at sensitive personal profiles.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases are broad enough to activate on common language about Douyin messaging, increasing the chance the skill runs when the user did not intend this specific automation. Because the skill performs an external side effect—sending a private message—overbroad activation can cause unintended outreach or privacy-impacting actions on the user's behalf.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The procedure sends an irreversible private message without requiring a clear pre-send warning or confirmation of recipient and message content. In this context, the skill automates real communications on a third-party platform, so mistakes can immediately leak sensitive information, damage relationships, or enable abuse if the wrong user profile is selected.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script automatically presses Enter to send the DM immediately after filling the message, with no preview, confirmation, or last-step user approval. Because sending a private message is an irreversible external action, any wrong recipient selection, malformed content, or prompt/argument manipulation results in unintended outbound communication from the user's account.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.