Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it sends user-provided Douyin video links to Jiuma to resolve download URLs and optionally extract text, without local persistence or hidden system changes.
Install only if you are comfortable sending the Douyin link, resolved video URL, and task id to Jiuma's remote service for processing. Avoid using it with private, sensitive, or tracking-bearing links unless you trust that service's handling of the data.
The skill performs network-backed operations against an external platform, but the manifest does not declare any tool scope or permission boundary. This weakens reviewability and user consent because the agent may invoke networked behavior that is not explicitly documented as allowed.
The skill asks users to submit Douyin links and derived final video URLs to an external platform for parsing and transcription, but it does not clearly warn users that their data is being sent off-platform. This creates a privacy and consent risk, especially if shared links contain tracking parameters, private content references, or user-associated metadata.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"share_url": video_url,
}
try:
response = requests.post(url, headers=self.headers, json=payload)
response.raise_for_status()
result = response.json()
response.close()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"share_url": video_url,
}
try:
response = requests.post(url, headers=self.headers, json=payload)
response.raise_for_status()
result = response.json()
response.close()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"share_url": video_url,
}
try:
response = requests.post(url, headers=self.headers, json=payload)
response.raise_for_status()
result = response.json()
response.close()
The skill sends a user-supplied video/share URL to api.jiuma.com for resolution without any explicit notice, consent flow, or privacy warning. Even if remote processing is necessary for functionality, transmitting user-provided links to a third party can expose personal, private, or tracking-bearing URLs and is a real privacy issue when undisclosed.
The skill submits the resolved video URL to a remote text-extraction API, which means the video content or access path is processed by an external service. Because the code provides no clear disclosure, consent, or retention controls, users may unknowingly send potentially sensitive media for third-party analysis.
The natural-language instructions and interaction guidance are presented only in Chinese, which can impose a language requirement on users without opt-in. The file does not state that the skill is intentionally limited to Chinese-speaking users or provide an alternative language option.
User-visible descriptions, help strings, and runtime messages are all presented in Chinese, with no option for the user to select another language. This can violate language/locale policy when a skill forces a specific language without user opt-in or documented justification.
No suspicious patterns detected.