Security audit

Douban Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it exports a user's Douban collection data to local CSV files, with some practical privacy and spreadsheet-safety cautions.

Install only if you intend to export Douban activity data locally. Run the browser scraper only with a browser session you control, choose an output directory deliberately, and do not add the suggested cron job unless recurring sync is wanted. Treat the generated CSV files as containing untrusted external text; import them with formula evaluation disabled or inspect/sanitize them before opening in spreadsheet software.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib.mjs:25
Finding: CSV Formula Injection Through Untrusted Douban and Markdown Fields
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
- `scripts/douban-browser-scraper.mjs` — via Puppeteer CDP, needs a running browser

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill requires environment access and performs network-driven export/sync behavior, but it does not declare an explicit tool scope such as allowed tools or permissions. This weakens least-privilege controls and can cause an agent runtime or reviewer to underestimate that the skill can read environment configuration and fetch remote content, increasing the chance of unintended access or execution in broader contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script navigates an attached browser to Douban pages and extracts user account data, which necessarily sends requests to remote Douban services using the browser's authenticated session. While progress logs exist, they do not clearly warn the user that the script will access account-linked data over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code creates an output directory and writes multiple CSV files containing the user's Douban activity, including titles, dates, ratings, statuses, and comments. Although it logs progress after writing, there is no prior disclosure, confirmation, comment, or docstring warning that personal data will be persisted to disk under the user's home directory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The usage comments instruct the user to run the script while logged in and fetch pages from their Douban account, extracting titles, links, dates, ratings, and comments, then copying the data to the clipboard. Although the file comments describe what the script does at a high level, they do not explicitly warn the user that authenticated account data will be retrieved and exported from the browser session.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file embeds user-facing status labels and trigger-like matching patterns only in Chinese, which indicates the skill is effectively restricted to a single language. Under the policy, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill description explains export and sync behavior but does not clearly warn that it writes and updates local CSV files and suggests ongoing automation via cron. This can mislead users or orchestrators about persistence and local side effects, raising the risk of unintended file modifications or unattended recurring execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The category definitions embed Chinese strings such as '读过', '看过', and '想玩', and the generated output uses these values directly. This imposes a specific language/locale in user-visible output without opt-in or explanation, which can violate language-choice policy expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script's documented purpose is to migrate existing local Douban Markdown files to CSV, but it refuses to run unless DOUBAN_USER is supplied from the environment and uses that value to shape the output path. For a local file-format migration utility, dependency on process environment for user identity is not clearly justified by the stated purpose and expands capability beyond straightforward file conversion.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/douban-browser-scraper.mjs:107

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/douban-rss-sync.mjs:11

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/douban-scraper.mjs:13