video-batch-publisher

• Outcome: Review
• Latest audit: Aug 25, 2026 · 2:52 PM UTC
• Version: 1.0.0

Overview

This skill is a real local batch video publishing tool, but it needs Review because it can post publicly using saved browser sessions and includes anti-detection automation patterns.

Review before installing. Use this only on a machine and social accounts where you are comfortable storing reusable browser login sessions locally, and start with draft or a very small test batch. Protect or delete browser_cache when done, review logs/screenshots/output JSON for sensitive content, and consider pinning dependencies and fixing the unsafe subprocess openers before operational use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.path.exists(cover_path):
                # 先尝试用默认程序打开图片
                import subprocess
                subprocess.Popen(f'explorer "{cover_path}"')
            else:
                messagebox.showwarning("提示", "封面文件不存在！")
        except Exception as e:

• Confidence: 90% confidence
• Finding: The GUI builds a command string with untrusted path data and passes it to subprocess.Popen. On Windows, specially crafted filenames or paths containing shell metacharacters can lead to command injection or unintended command execution when the app tries to open a cover file.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
                cover_dir = os.path.dirname(cover_path)
                import subprocess
                subprocess.Popen(f'explorer "{cover_dir}"')
            except Exception as e2:
                messagebox.showwarning("提示", "无法打开文件或文件夹！")

• Confidence: 90% confidence
• Finding: Like the prior explorer call, this fallback path opens a directory using a formatted command string. If cover_dir is influenced by attacker-controlled filesystem names, the string-based subprocess invocation can trigger command injection or unexpected execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if log_files:
                        latest_log = max(log_files, key=os.path.getmtime)
                        import subprocess
                        subprocess.run(['start', '', latest_log], shell=True)
            
            btn_frame = ttk.Frame(result_window, padding="10")
            btn_frame.pack(fill=tk.X)

• Confidence: 98% confidence
• Finding: The code launches the latest log file via subprocess.run with shell=True. Because latest_log comes from the filesystem, an attacker who can create or rename files in that logs directory may inject shell metacharacters and achieve arbitrary command execution when the user clicks the button.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and instructs use of a local Python automation tool that reads files, writes local artifacts, invokes shell commands, and interacts with networked platforms, yet no explicit permissions are declared. That creates a transparency and consent gap: users or orchestration systems may invoke a capability-rich skill without clear gating or sandbox expectations, increasing the risk of unintended file access, local writes, or automated network actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior omits materially relevant capabilities: extra platform support, login-state detection, CAPTCHA handling pauses, and creation of local logs/screenshots/JSON results. This mismatch is dangerous because users may consent to a narrower workflow than the tool actually performs, especially where screenshots, session artifacts, or result files could capture sensitive account or content metadata.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The file explicitly documents and implements anti-detection behavior such as random delays and mouse movement to mimic a human operator and reduce the chance of platform detection. In a batch publisher, this crosses from ordinary automation into evasion of platform controls, which can facilitate policy circumvention, account sanctions, and stealthy large-scale abuse.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The publish routine uses shadow-DOM piercing and coordinate-based fallback clicks to trigger submission controls outside normal interaction boundaries. This bypasses intended UI encapsulation and safety friction, making it easier to force publication even when the page structure or safeguards change, increasing the risk of unintended or unauthorized posting.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation text is broad enough to match common requests about posting videos or packaging publishing tools, which can cause the skill to trigger in contexts where the user did not intend browser automation, local installs, or multi-platform publishing guidance. Over-broad invocation is risky here because the skill drives high-impact actions against third-party accounts and may encourage workflows that violate platform rules.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide explicitly states that platform login state is stored in a local `browser_cache`, but it does not warn users that this may contain reusable authenticated session material tied to their social-media accounts. On a shared or poorly secured Windows machine, another local user, malware, backup operator, or accidental file transfer could reuse that state to access publishing accounts and perform unauthorized actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The base class exposes a generic submit_publish() helper that directly clicks a publish button and can make an externally visible change on third-party platforms without any in-function confirmation gate, dry-run mode, or final user acknowledgment. In the context of a batch video publisher, accidental invocation, bad task data, or downstream automation mistakes can trigger real public posts at scale, making this materially risky even if intentional for product functionality.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code directly clicks the Douyin publish button and then treats navigation or even some error cases as success, without any user-facing confirmation gate immediately before submission. In a batch-publishing tool, this increases the risk of accidental or unintended publication of content, especially if metadata, account context, or scheduling inputs are wrong, because the final action is executed automatically and irreversibly on a real platform.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This workflow proceeds to final submission automatically and returns success without any explicit confirmation gate in this file. Because publishing is irreversible or operationally significant, automatic submission can cause accidental mass posting, wrong-account posting, or release of unreviewed content if upstream inputs are incorrect or manipulated.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This logger persists sensitive operational data to disk and echoes it to the console, including video names, titles, descriptions, error messages, failed video lists, and cover file paths. In the context of a batch publisher handling user-created content across multiple platforms, these fields can contain private content, local filesystem information, tokens or IDs embedded in error text, and business-sensitive publishing metadata; storing them without minimization, masking, retention controls, or explicit user consent increases the risk of local data leakage and inadvertent disclosure.

Ssd 2

Medium

• Confidence: 98% confidence
• Finding: The comments frame the behavior as avoiding detection and imitating human actions, which is a strong indicator of detection-evasion intent rather than mere usability automation. In the context of a multi-platform batch publishing tool, that materially increases abuse potential by helping automated activity blend in and avoid scrutiny.

Ssd 2

Medium

• Confidence: 95% confidence
• Finding: The workflow repeatedly inserts staged human-like delays and mouse movements around key actions, reinforcing intentional evasion of bot detection throughout the publish flow. In a local batch publishing product, this makes large-scale automated posting harder to detect and therefore more dangerous than ordinary browser scripting.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
pyyaml
openpyxl
playwright

• Confidence: 98% confidence
• Finding: The dependency is unpinned, so builds are not reproducible and may silently pull newer package versions with security regressions, breaking changes, or a compromised release. In a local automation tool that processes files and drives browser sessions, this increases supply-chain risk even though the file alone does not prove active exploitation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
pyyaml
openpyxl
playwright

• Confidence: 99% confidence
• Finding: The PyYAML dependency is unpinned, which is especially risky because YAML parsers have a history of unsafe deserialization issues across versions. An unpinned install can unexpectedly introduce a vulnerable or incompatible release, increasing supply-chain and code-execution risk if YAML content is later processed unsafely.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
pyyaml
openpyxl
playwright

• Confidence: 97% confidence
• Finding: The openpyxl dependency is unpinned, so environments may install different versions over time, including versions with parser flaws or incompatible behavior. Because this skill reads Excel tasks from user-managed files, parser-related dependency drift is more relevant than in a purely static utility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
pyyaml
openpyxl
playwright

• Confidence: 95% confidence
• Finding: The playwright dependency is unpinned, which creates supply-chain and stability risk by allowing uncontrolled version changes at install time. Since this tool automates browser interactions for publishing, unexpected dependency changes could affect authentication flows or introduce vulnerable transitive components.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: PyYAML has multiple serious historical advisories involving unsafe deserialization, and the requirement is completely unpinned, meaning a vulnerable version could be installed. In a tool that likely consumes local configuration or task files, unsafe YAML handling could lead to code execution if malicious YAML is introduced into the workflow.

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: openpyxl has had XML entity parsing issues in older versions, and the unpinned requirement leaves open the possibility of installing a vulnerable release. Because this skill explicitly reads Excel task files, malformed workbook content could potentially trigger parser issues, making the dependency context more security-relevant than a dormant library.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if log_files:
                        latest_log = max(log_files, key=os.path.getmtime)
                        import subprocess
                        subprocess.run(['start', '', latest_log], shell=True)
            
            btn_frame = ttk.Frame(result_window, padding="10")
            btn_frame.pack(fill=tk.X)

• Confidence: 98% confidence
• Finding: Using shell=True with a path derived from directory contents is a classic tool-parameter abuse pattern. In the context of a local batch publishing tool that processes files from user-controlled working directories, this becomes more dangerous because attackers can more plausibly influence filenames and trigger code execution through normal GUI actions.

Static analysis

No suspicious patterns detected.