Security audit

Browser Douyin Post

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for posting to Douyin, but it automates live public publishing from a logged-in browser without a hard final confirmation and documents a browser navigation bypass pattern.

Install only if you are comfortable letting an agent control a logged-in Douyin creator session and publish publicly. Confirm the exact account, media file, title, and description yourself before allowing the final publish click, and prefer an isolated browser profile instead of your everyday Chrome profile.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:23
Finding: Browser SSRF Protection Bypass Through JavaScript Navigation
Content: View full analysis
", profile="user", target="host") // Then use JS to navigate (avoids SSRF blocks on navigate action) browser(action="act", kind="evaluate", target="host", profile="user", fn="window.location.href = 'https://creator.douyin.com'") ``` The bypass is also explicitly recommended in the troubleshooting guidance: ```text - **"navigate blocked by SSRF"**: Use `act` + `evaluate` with `window.location.href` instead of `navigate` action ``` ### Technical Analysis The skill explicitly instructs the agent to circumvent the browser tool's SSRF-protected navigation operation by executing JavaScript in an attached browser tab. Assigning a URL to `window.location.href` through unrestricted evaluation provides an alternative navigation channel that does not necessarily apply the URL validation, network-destination restrictions, or audit controls enforced by the dedicated `navigate` operation. The currently hardcoded destination, `https://creator.douyin.com`, is consistent with the skill's declared purpose. However, the documented technique establishes an unsafe security pattern. If the destination becomes influenced by user input, compromised page content, or a modified copy of the skill, the same technique could be used to reach attacker-controlled sites or network locations that the protected navigation operation would reject. ### Attack Path 1. The agent loads the skill and attaches to a Chrome instance using the user's authenticated browser profile. 2. The agent enumerates open tabs and focuses an existing user tab. 3. A maliciously modified instruction, untrusted input flow, or future parame ...[truncated 1438 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation criteria are broad enough to trigger on ordinary requests about Douyin posting or uploads, which can cause the agent to enter a high-risk workflow that culminates in publishing to a live account. Because this skill performs real-world account actions, accidental invocation materially increases the chance of unintended content publication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow clicks the final '发布' button on a logged-in Douyin creator account without a mandatory, explicit confirmation immediately before the irreversible action. In this context, browser automation against a live social-media account makes mistaken publication likely to cause account, reputational, and business harm, especially if the wrong media or title is used.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.