Security audit

Douyin Transcriber

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its setup asks users to run an unpinned third-party Docker ASR service that may expose a local transcription endpoint more broadly than intended.

Install only if you are comfortable running a third-party Whisper ASR container. Prefer a pinned image digest, bind the port to 127.0.0.1, add network/resource controls, and avoid sensitive recordings unless you have verified the container and its logging behavior.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Mutable Third-Party Container Image Is Executed Without Version or Digest Pinning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:27
Finding: Unauthenticated ASR Service May Be Published on All Host Network Interfaces
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description is broad enough to trigger on many generic audio or video transcription requests, which can cause the skill to be invoked in contexts the user did not clearly intend. In this skill, broad matching increases the chance that sensitive local media is routed into the workflow and then posted to the ASR HTTP endpoint without sufficient user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The examples show uploading local files via curl to http://localhost:PORT/asr but do not warn that the full contents of local audio or video are being transmitted to a network service. Even though the endpoint is localhost, it is still an HTTP service boundary; users may not realize sensitive recordings are being sent to a containerized service that could log, retain, or expose data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The Docker command relies on the image tag :latest, which is mutable and can change over time without review. This creates supply-chain risk because future pulls may run different or compromised code than originally tested, especially for a service that processes user-provided media files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.