Douyin To Obsidian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.2

Overview

The skill matches its stated Douyin-to-Obsidian purpose, but it ships a live-looking Groq API key and uses high-impact shell-style workflows with weak scoping for user and page-supplied content.

Review before installing. Replace the bundled config with your own empty or user-owned settings, revoke or remove the exposed Groq key, confirm that audio can be sent to Groq, and avoid running the shell examples with unsanitized Douyin URLs, titles, transcripts, or generated markdown. Prefer pinned/local dependencies and confirm the Obsidian vault path before allowing writes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:4

Finding

Hardcoded Groq API Credential in Distributed Configuration

Content

View full analysis

/config.json'))['groqApiKey'])") curl -s https://api.groq.com/openai/v1/audio/transcriptions \ -H "Authorization: Bearer $GROQ_API_KEY" \ -F file="@/tmp/douyin_audio.mp3" \ -F model="whisper-large-v3" \ -F language="zh" \ -F response_format="verbose_json" ``` Storing credentials in plaintext configuration violates secret-management best practices. Removing the key in a later revision is insufficient if it remains in repository history, package caches, logs, or previously distributed copies. ### Attack Path 1. An attacker downloads or otherwise gains read access to the Skill package. 2. The attacker opens `config.json`. 3. The attacker extracts the plaintext `groqApiKey`. 4. The attacker sends authenticated requests directly to Groq using the stolen bearer credential. 5. Requests consume the legitimate owner's quota and may continue until the key is revoked. ### Impact Assessment The exposed credential can grant unauthorized access to the Groq API under the associated account. Potential consequences include: - Unauthorized A ...[truncated 475 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:55

Finding

Shell Command Injection Through Untrusted URLs and Generated Note Content

Content

View full analysis

" ``` ```bash curl -L -H "Referer: https://www.douyin.com/" -o /tmp/douyin_audio_raw.m4a "" ``` ```bash obsidian vault="" create path="/抖音-{标题简称}-{YYYYMMDD}.md" content="<组装好的markdown>" silent ``` ```bash obsidian vault="" property:set name="tags" value="[抖音,视频笔记]" file="<路径>" obsidian vault="" property:set name="created" value="YYYY-MM-DD HH:MM" file="<路径>" obsidian vault="" property:set name="source" value="douyin" file="<路径>" ``` The affected values can originate from user input, local configuration, or remotely controlled Douyin page content: - The original Douyin URL is supplied by the user. - The media URL and title are extracted from a remote page. - The vault and folder values are read from user-editable configuration. - The Markdown content includes a remote title, transcript, summary, and source URL. - The note path is derived partly from the remote title. ### Technical Analysis The instructions construct shell command strings by interpolating untrusted values into double-quoted arguments. Double quotes do not make arbitrary data safe for shell evaluation. Embedded quote characters can terminate an argument, while command substitutions such as `$(...)` and backticks may still be evaluated by a shell. The filename rule removes a limited set of characters from the title, but this is not a complete shell-escaping strategy. Moreover, no equivalent protection is specified for the full Markdown passed through the `content` argument. Transcript or page text can contain quotes, dollar signs, backticks, newlines, and other shell-sensitive content. The vulnerability becomes exploitable when the Agent or runtime implements these documented examples by assembling and executing a shell command. Sa ...[truncated 1780 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:174

Finding

Unpinned Global Installation of a Third-Party npm Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

1e. 清理

bash

rm -f /tmp/douyin_audio_raw.m4a /tmp/douyin_audio.mp3
agent-browser close

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

| 问题 | 解决 |
|------|------|
| config.json 不存在 | 首次使用会自动询问并创建 |
| Groq API Key 未配置 | 提示用户在 douyin-transcribe/.env 中配置 |
| agent-browser 未安装 | `npm install -g agent-browser` |
| 音频 URL 为 null | 等几秒重试；或用户需登录抖音网页版 |
| curl 下载的音频无法播放 | 检查 Referer header 是否带上 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says it will write config.json and create notes in the user's Obsidian vault, but it does not present this as a clear side-effect requiring informed consent. Silent creation or modification of local files and notes can lead to unwanted data persistence, misfiling, or disclosure within synced vaults.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill uploads extracted audio to Groq's external transcription API but does not clearly warn the user that media-derived content will leave the local environment. This creates a privacy and consent risk, especially because the source material may contain personal, sensitive, or copyrighted speech.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This skill explicitly transmits user-derived audio content to an external third-party service at api.groq.com. External transmission is expected for cloud transcription, but without strong disclosure and consent controls it presents meaningful privacy, compliance, and data-handling risk.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

直接调用 Groq Whisper API（不走 transcribe.js，避免脚本内部路径冲突）：

bash

GROQ_API_KEY=$(python3 -c "import json; print(json.load(open('<skill目录>/config.json'))['groqApiKey'])")
curl -s https://api.groq.com/openai/v1/audio/transcriptions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -F file="@/tmp/douyin_audio.mp3" \
  -F model="whisper-large-v3" \

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented API call sets language="zh", which hard-codes a specific language/locale behavior. The file does not indicate that users can choose another language or that the skill is intentionally limited to Chinese-only content for a documented reason.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Earlier documentation consistently states that the Groq API key is stored in <skill目录>/config.json and even shows commands reading groqApiKey from that file (L19-L29, L84-L90). The troubleshooting row at L174 instead tells the user to configure it in douyin-transcribe/.env, which conflicts with the rest of the skill's documented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The config hard-codes the folder name as "抖音收藏", which implies a Chinese-language/localized default without any indication of user choice or opt-in. Under the policy criteria, forcing a specific language or locale in natural-language-facing configuration can be a language/locale policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.