T09 · Insecure Skill Coding Practices
Error
- Location
douyin-uploader.js:400- Finding
Chromium Is Launched with Browser Sandboxing Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Douyin Automation
Security checks for vulnerabilities and agentic risk
Overview
This Douyin uploader is purpose-aligned but needs review because it can automatically publish to a public account while retaining local login state and launching Chromium with sandboxing disabled.
Install only if you are comfortable with an agent-controlled tool posting to your Douyin account by default. Prefer using --no-publish unless you intentionally want immediate publication, keep the skill directory private, do not commit douyin-cookies.json or chrome-user-data, run it as an unprivileged user, and review/pin dependencies before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
douyin-uploader.js:29- Finding
Persistent Browser Authentication Profile Is Not Explicitly Permission-Hardened
- Content
View full analysis
{ }); ``` No equivalent explicit permission setup or verification is applied to `chrome-user-data`. ### Technical Analysis The Skill uses a persistent Chromium user-data directory under the project directory. Chromium profiles can contain cookies, authentication tokens, browsing state, cached responses, local storage, and other account-related data. Although `douyin-cookies.json` is changed to mode `0600`, the profile directory is not explicitly created with mode `0700`, and its ownership and permissions are not checked before Chromium uses it. Protection therefore depends on the process umask, project-directory permissions, operating-system defaults, and any pre-existing directory at that path. The persistent profile also expands the amount of authentication state retained on disk. This is unnecessary if the explici ...[truncated 1488 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:31- Finding
Dependency Installation Is Not Reproducibly Locked
- Content
View full analysis
**Note / 说明**: Only installs puppeteer, no external repo cloning needed / 仅安装 puppeteer 依赖，无需克隆外部仓库。 ``` No `package-lock.json` is present in the audited project structure. ### Technical Analysis The dependency uses a caret range, allowing npm to select later semver-compatible Puppeteer releases. Without a committed lockfile, the complete transitive dependency graph and package integrity values are not fixed. Two installations of the same audited source can therefore resolve to different third-party code. The documented use of `npm install` reinforces mutable resolution rather than requiring a reviewed lockfile through `npm ci`. Puppeteer installation may also retrieve browser components as part of its normal package installation behavior, increasing the externally supplied code and binary surface. This is a supply-chain hardening issue. The audit did not identify a malicious current package, dependency-confusion name, typosquatted package, or unsafe non-registry URL. The risk arises because future installation content is not identical to the content reviewed. ### Attack Path 1. An attacker compromises a permitted future package release, a transitive dependency, a registry account, or an associated browser distribution channel. 2. The compromised version remains compatible with the declared `^23.11.1` range or is selected transitively. 3. A user follows `SKILL.md` and runs `npm install`. 4. npm resolves and downloads dependency content that was not represented in the audited project. 5. Malicious lifecycle code may execute during ...[truncated 893 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code saves live Douyin session cookies to a local JSON file, creating a reusable bearer token for account access if the file is stolen by another local user, malware, or a later-compromised process. Although permissions are tightened to 0600, there is no explicit just-in-time user consent or strong protection such as encryption or OS credential storage, so session theft remains plausible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The uploader proceeds to click the publish button automatically whenever autoPublish is not set to false, without a final confirmation step showing the exact content being released. Because publishing is an externally visible, hard-to-reverse action, automation mistakes, bad inputs, or misuse by another caller can cause unintended public posting from the user's account.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code presents natural-language user interaction text such as SMS verification notices and input prompts only in Chinese. This imposes a fixed language on users without opt-in or a locale-selection mechanism, which matches the policy's language/locale violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code includes natural-language strings in Chinese for the script description and usage, indicating a fixed language choice. The file does not offer any language selection or explain a justified region-specific requirement, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The natural-language description prominently presents the skill as a Douyin-specific uploader and includes only Chinese-language wording for its user-facing capability summary. This may indicate a locale/language constraint without any explicit opt-in or alternative language choice, which can conflict with language/locale policy expectations.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
Using a caret range for puppeteer allows installation of newer dependency versions that were not explicitly reviewed with this skill, which weakens build reproducibility and can unexpectedly introduce vulnerable or breaking releases. In an automation skill that drives a browser and may handle authenticated sessions, dependency drift modestly increases supply-chain risk.
- Content
json "manage": "node scripts/manage.js" }, "dependencies": { "puppeteer": "^23.11.1" } }
Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language strings present the skill exclusively in Chinese (for example, the title and usage comment) without offering a language choice or documenting that the script is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file includes Chinese-only natural-language documentation for the script title, usage, and commands. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content