T09 · Insecure Skill Coding Practices
Warning
- Location
helpers/video_analysis.py:19- Finding
Unrestricted outbound HTTP requests permit server-side request forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Douyin Viral Breakdown
Security checks for vulnerabilities and agentic risk
Overview
This Douyin analysis skill matches its stated purpose, but it needs review because it automatically fetches and processes media with weak scoping and under-disclosed third-party data flows.
Install only if you are comfortable with the agent fetching Douyin pages, downloading videos, writing temporary media files, extracting frames, and potentially using third-party parsing or vision services. Prefer running it in a sandbox, require explicit consent before external uploads, restrict requests to known Douyin/media hosts, limit file sizes and duration, and delete downloaded videos and frames after analysis.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
helpers/video_analysis.py:94- Finding
Caller-selected local files can be uploaded to an external vision service
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared purpose is analysis of why a Douyin video became popular, but the implementation expands into metadata extraction, media downloading, and possible upload to third-party analysis services. This mismatch is dangerous because users may consent to content analysis without realizing their provided links, media, or derived data may be transmitted externally or stored locally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The changelog documents capabilities to download videos, extract frames, and analyze visual content, but it does not mention consent, retention limits, or privacy safeguards. In a skill that auto-activates on shared Douyin links, this increases the risk of users not understanding that third-party content may be fetched and processed, creating privacy, copyright, and data-handling concerns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README states that the bot will automatically download remote video content, extract frames, and invoke ffmpeg/image tooling, but it does not disclose or constrain the resulting network access, local file creation, and external program execution. In an agent setting, silent automatic retrieval and processing of untrusted URLs increases the risk of SSRF-like access patterns, disk/resource abuse, and unsafe handling of hostile media files, especially when triggered just by sending a link.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to perform network requests and shell-based media processing, but it declares no explicit tool scope or permission boundaries. This increases the chance of overbroad execution, because a simple video-analysis trigger can lead to fetching remote content and creating local files without clear least-privilege constraints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill references third-party parsing APIs and online parsing sites without clearly warning that user-provided video URLs and related metadata may be shared with external services. This creates privacy and trust risks, especially because such services may log, retain, or further process the submitted links and extracted data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to download user-supplied Douyin videos and write local files for frame extraction, but it does not clearly warn users that network retrieval and filesystem activity will occur. This is dangerous because it can surprise users, increase exposure to untrusted remote content, and create local artifacts without informed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill broadens from video-performance analysis into harvesting comments and commenter metadata, which introduces collection of additional user-generated data unrelated to the core advertised function. This is risky because it expands surveillance and data processing scope without clear necessity, notice, or minimization.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Collecting commenter IP labels is not necessary for explaining why a video went viral and can expose coarse location metadata about third parties. Even if publicly surfaced by the platform, aggregating and processing this metadata creates avoidable privacy risk and exceeds the principle of data minimization.
- Content
Tainted flow: 'url' from requests.get (line 26, network input) → requests.get (network output)
Medium
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The short-link resolution logic follows redirects for a user-supplied URL based only on a substring check for 'v.douyin.com'. This can be bypassed with crafted URLs containing that string in the path or query, leading the agent to make arbitrary outbound requests and follow attacker-controlled redirects, which is a classic SSRF pattern.
- Content
python """从抖音URL提取视频ID""" # 处理短链接 if 'v.douyin.com' in url: resp = requests.get(url, headers={ 'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15' }, allow_redirects=True) url = resp.url
Tainted flow: 'url' from requests.get (line 26, network input) → requests.get (network output)
Medium
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The function performs a server-side HTTP request to a user-controlled URL without validating the scheme, host, or destination. In an agent context, this creates an SSRF primitive that can be abused to reach internal services, cloud metadata endpoints, or other unintended network targets, especially because the skill is supposed to process Douyin links but does not enforce that restriction.
- Content
python 'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15' } resp = requests.get(url, headers=headers) html = resp.text # 从HTML中提取_ROUTER_DATA
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a Douyin video breakdown/analysis skill triggered by a video link, focused on popularity, audience reach, and behavioral psychology. This code adds a separate capability to transmit a downloaded cover image to a third-party multimodal API for generic image analysis, which is not clearly justified by the stated skill purpose and broadens the skill into external content offloading.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function reads a local image file, base64-encodes it, and sends it along with an API credential to a third-party service without any in-code disclosure, consent, or minimization. In an agent skill, silent transmission of user-derived or locally stored content to an external AI provider is a real privacy and data-governance risk even if the destination is legitimate.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The code sends data and authentication material to a third-party endpoint, creating a real external data-exfiltration path if misused or called on sensitive files. Although the endpoint appears legitimate, the lack of user notice, data classification checks, and scope limitation makes this a meaningful privacy/security issue in an agent environment.
- Content
python image_base64 = base64.b64encode(f.read()).decode() # 调用视觉模型 resp = requests.post( "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions", headers={ "Authorization": f"Bearer {api_key}",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The code sends data and authentication material to a third-party endpoint, creating a real external data-exfiltration path if misused or called on sensitive files. Although the endpoint appears legitimate, the lack of user notice, data classification checks, and scope limitation makes this a meaningful privacy/security issue in an agent environment.
- Content
python image_base64 = base64.b64encode(f.read()).decode() # 调用视觉模型 resp = requests.post( "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions", headers={ "Authorization": f"Bearer {api_key}",
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The user-facing changelog entries are written in Chinese, and there is no indication that the skill offers a language choice or that it is intentionally limited to a Chinese-speaking or region-specific context. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The natural-language content of the skill is fully Chinese, including the title, description, and operating instructions, with no opt-in or alternative locale guidance. The policy rule calls for flagging language or locale constraints when a skill effectively forces a specific language without user choice or explicit justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring and most user-facing messages are written only in Chinese, with no indication that language can be selected or changed. This can violate language/locale policy when a skill imposes a single language without offering user choice or documenting a justified regional constraint.
- Content
Static analysis
No suspicious patterns detected.