Security audit

Douyin Article

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it handles untrusted remote media text inside a tool-capable agent workflow and has avoidable install, logging, and URL-scope risks.

Install only in a dedicated environment, pin dependencies where possible, avoid global npm installs if you can, do not set SKIP_CERT_CHECK unless you accept the TLS risk, and avoid processing attacker-controlled videos in a session with broad tool access. Redact proxy credentials from logs and restrict input URLs to known hostnames before running the pipeline.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: scripts/03_pack_transcript.py:151
Finding: Remote Transcript Content Is Exposed to the Agent as Untrusted Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/01_fetch.py:238
Finding: Authenticated Proxy Credentials Are Printed Without Redaction
Content: View full analysis
0: import os proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY") if proxy: print(f"🌐 YouTube 走代理: {proxy}", flush=True) else: print(f"⚠️ YouTube 未配置代理（HTTPS_PROXY/HTTP_PROXY 环境变量为空），可能无法访问", flush=True) ``` ### Technical Analysis Proxy environment variables may use URLs containing inline authentication information: ```text https://username:password@proxy.example:8443 ``` The code prints the complete environment-variable value. Consequently, proxy usernames, passwords, access tokens embedded in URLs, query parameters, and internal proxy hostnames can be copied into terminal history, CI logs, orchestration logs, or AI session transcripts. Reading proxy variables is necessary for the declared YouTube functionality. Printing their complete values is not necessary and exceeds the minimum disclosure required to report that proxy routing is enabled. This finding concerns local log disclosure. The reviewed code does not demonstrate that these credentials are deliberately sent to an unrelated external service. ### Attack Path 1. A user configures `HTTPS_PROXY` or `HTTP_PROXY` with embedded credentials. 2. The input batch contains at least one YouTube URL. 3. `01_fetch.py` reads the proxy environment variable. 4. The complete proxy URL is printed to standard output. 5. A party with access to terminal output, CI logs, captured agent sessions, or support bundles obtains the credential. 6. The exposed credentials may then be reused against the proxy until revoked or expired. ### Impact Assessment Exposure may permit unauthorized use of the user's proxy service, consumption of paid bandwidth, access from an allowlisted proxy identity, or discovery of internal netw ...[truncated 222 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/common.py:503
Finding: Substring-Based Platform Validation Allows Requests to Unintended Hosts
Content: View full analysis
bool: """Detect whether a URL belongs to a generic platform supported by yt-dlp.""" url_lower = url.lower() for domain in YTDLP_GENERIC_DOMAINS: if domain in url_lower: return True return False ``` Accepted generic input is retained verbatim: ```python elif platform == "ytdlp-generic": url = line.strip() title = None ``` It is subsequently passed to the generic downloader path: ```python elif platform == "ytdlp-generic": print(f"\n[{item['line']}] 通用平台处理: {item['url']}", flush=True) result = fetch_one_bilibili( item["line"], item, audio_dir, raw_dir, seen_md5, transcript_dir=transcript_dir, ) ``` ### Technical Analysis The allowlist check searches for a domain string anywhere in the input instead of parsing and validating the URL's hostname. It therefore does not establish that the network destination is an approved platform. For example, these forms can satisfy a substring check while targeting a different host: ```text https://attacker.example/path?vimeo.com http://127.0.0.1/resource?vimeo.com https://vimeo.com.attacker.example/video ``` The entire line is then passed to `yt-dlp`. Depending on extractor selection, redirects, and the downloader's handling of the U ...[truncated 1628 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:199
Finding: Installation Instructions Use Unpinned Third-Party Packages
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (45)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CHANGELOG.md (reported line 38)May include surrounding context.
md
## v4.1.1 — 2026-07-15 ### Fixed - **TLS 证书校验默认启用**（ClawHub SkillSpector Tool Parameter Abuse ×4 修复）：`fetch_bilibili.py` / `fetch_youtube.py` 中 4 处 `--no-check-certificates` 硬编码改为 `_cert_flags()` 函数控制，默认启用证书校验。仅当用户显式设置环境变量 `SKIP_CERT_CHECK=1` 时禁用（应对偶发的 B站证书过期问题），禁用为用户明确选择而非默认行为。 - **Description-Behavior Mismatch 修复**：description 的 Do NOT 表述从"视频下载、字幕提取"改为"纯视频文件下载（不转录）、纯字幕提取（不转录）"，明确区分"交付物"与"转录中间步骤"——管线确实会下载音频流作为转录中间产物，但不用于交付视频文件。 - **Description 声明 yt-dlp 通用平台支持**：description 明确列出 Vimeo/TikTok/Twitter 等通用平台，与代码 `ytdlp-generic` 路由一致，消除 scope-expansion 风险。 - **Vague Triggers 收窄**：触发词删除"视频翻译"（过于泛化，可能匹配普通翻译请求）和"批量转录视频"（与"批量转录视频链接"重复，保留后者更精确）。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个端到端的“批量转录多平台视频为 Markdown 逐字稿”技能，而代码片段实际只是后处理流水线中的一个子步骤：为已有 transcript 文件准备翻译 manifest，并读取/更新翻译状态。它依赖已有的 pack_summary.json 和 transcript_*.json，说明前置的抓取、下载、转录已经在别处完成。就该代码片段本身而言，其主要用途是翻译编排，不是批量转录，因此与声明的核心能力和主要目的存在实质不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个面向抖音/B站/YouTube 等平台的批量转录技能，核心能力应包括跨平台提取、音视频转录、字幕探测、双语处理并输出每视频独立 Markdown。当前代码片段是流程中的“阶段 3”，输入是现成的 transcript_*.json 文件，输出是 takes_packed_N.md、boundary-review_N.md 和汇总 JSON。它做的是转录结果的重组、分窗口排版、语言标记、标题启发式分类以及为后续人工/主对话切分提供说明。虽然与“生成结构化 Markdown 转录稿”部分存在一定关联，但其主要行为明显是后处理与切分辅助，而非声明中的批量跨平台转录主功能。因此描述与该代码片段实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个面向多平台的批量音视频转录技能，最终产物应是结构化 Markdown 逐字稿，并强调三层字幕探测、双语对比和在无字幕时继续完成转录。实际代码块只是其中一个辅助模块：它调用 yt-dlp 列出并下载已有字幕或自动字幕，选择优先语言，转换成 SRT/VTT 后再写成 transcript JSON；若字幕不可得，则直接返回失败并提示由其他调用方 fallback 到 Whisper。也就是说，这段代码并不完成“批量转录音视频”为 Markdown 的主目标，而主要执行“字幕拉取/提取”这一被声明特别排除的用途之一。虽然代码中的 fallback 提示与整体系统可能相关，但就本代码块本身而言，描述明显夸大了已实现能力，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向多平台链接输入的批量音视频转录工具，核心能力应包括从平台获取内容、转录/字幕探测、批量处理以及产出 Markdown 逐字稿。而实际代码只是一个辅助脚本，将已有的 SRT 字幕转换成下游兼容的 transcript JSON 数据结构。它依赖现成字幕输入，没有执行真正的音视频转录，也没有任何平台特定提取、批量遍历、双语比较或 Markdown 构建逻辑。虽然这可能是整体流程中的一个支持组件，但就该代码块本身而言，其实际行为与宣称的主要用途存在明显且实质性的偏差。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向多平台音视频的批量转录工具，应包含链接/平台处理、下载或提取音视频、字幕探测或语音转写，并输出 Markdown 逐字稿。实际代码完全没有网络平台处理、媒体下载、音频分析、ASR 转录或 Markdown 生成逻辑。它假设输入已经是 transcript JSON，并仅对其中 segments 做翻译任务编排（prepare/next-batch/apply/render/validate）。这不是对声明功能的简单子步骤说明，而是主功能层面的明显偏离，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The module reads arbitrary local files via helpers like read_json, md5_file, and input parsing, but the finding indicates that file-read capability is not declared in permissions. Undeclared sensitive capabilities are dangerous because they bypass expected trust boundaries and can enable unauthorized access to local data when the skill runs in an agent environment.
Content: No source excerpt is available for this finding.

Unvalidated Output Injection

High

Category: Output Handling
Confidence: 100% confidence
Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
Content: Scanner excerpt · scripts/common.py (reported line 166)May include surrounding context.
python
) def extract_url_from_eval(output: str) -> Optional[str]: """从 agent-browser eval 输出中提取 CDN URL。""" out = clean_clixml(output).strip().strip('"').strip("'") if out.startswith("http") and "douyinvod" in out:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: The code conditionally disables TLS certificate validation for yt-dlp when the environment variable SKIP_CERT_CHECK=1 is set, which permits man-in-the-middle attacks and tampering with downloaded metadata, subtitles, or media. Although this is not the default behavior and appears intended as an operational workaround, it weakens transport security for a network-fetching skill that processes untrusted remote content from public platforms.
Content: Scanner excerpt · scripts/fetch_bilibili.py (reported line 36)May include surrounding context.
python
用于应对偶发的 B 站证书过期问题。禁用为用户显式选择，非默认行为。 """ if os.environ.get("SKIP_CERT_CHECK") == "1": return ["--no-check-certificates"] return [] SCRIPT_DIR = Path(__file__).resolve().parent

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The code conditionally disables TLS certificate validation for yt-dlp when the SKIP_CERT_CHECK environment variable is set. Even though this is not enabled by default, it creates a security downgrade path that allows man-in-the-middle interception or content tampering on untrusted networks, especially because this skill fetches remote media and metadata from external platforms.
Content: Scanner excerpt · scripts/fetch_youtube.py (reported line 34)May include surrounding context.
python
默认启用证书校验（安全）。仅当用户明确设置 SKIP_CERT_CHECK=1 时禁用。 """ if os.environ.get("SKIP_CERT_CHECK") == "1": return ["--no-check-certificates"] return [] SCRIPT_DIR = Path(__file__).resolve().parent

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The text says the previous wording was changed from 'automatically translate non-Chinese content into Chinese', which describes a language policy that forces Chinese output by default. Even though the line documents a fix, the natural-language content in this file still contains the policy-violating phrase without presenting user choice in that quoted prior behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README says bilingual behavior is triggered by the phrase “双语转录”, but it does not define where that phrase must appear, whether exact matching is required, or when similar wording should not activate the mode. This ambiguity could cause unintended invocation because the trigger scope is described only in broad natural language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The English section states that users can trigger bilingual translation with “双语转录” but does not explain the exact input channel, matching rule, or exclusion cases. For a markdown skill description, this is too vague to reliably distinguish intended activation from incidental mention.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
description: | 批量转录抖音/B站/小宇宙/YouTube/Vimeo/TikTok/Twitter 等平台音视频为结构化 Markdown 逐字稿（每视频独立 .md）。三层字幕探测 + 双语对比 + 全平台支持（yt-dlp 1700+ extractor）。触发词：抖音批量转录、B站批量转录、小宇宙转录、YouTube转录、双语转录、批量转录视频链接。Do NOT use for 单视频转录（用 douyin-transcribe）、作者主页抓取、纯视频文件下载（不转录）、纯字幕提取（不转录）。 allowed-tools: "Bash(python:*) Bash(curl:*) Bash(ffmpeg:*) Bash(ffprobe:*) Bash(yt-dlp:*) Bash(agent-browser:*)" model: "claude-opus-4-5" effort: "medium" metadata: author: trae-solo

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description states that non-Chinese content is automatically translated into Chinese, which imposes a specific language/locale behavior by default. Elsewhere the output format also fixes bilingual output as Chinese translation plus original text, with no opt-in or user choice described.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The examples instruct users to fetch, download, transcribe, translate, and write outputs for third-party media across multiple external platforms without any warning about privacy, copyright, terms-of-service, or external network/data handling implications. This is risky because users may unknowingly process personal, proprietary, or copyrighted content and send derived data through multiple tooling stages, increasing compliance and data exposure risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document title and all operational guidance are written exclusively in Chinese, and later instructions assume Chinese output and segmentation conventions. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code hard-codes language="zh" for all transcription requests, which imposes a specific language/locale policy on every input. There is no user choice, opt-in mechanism, or documented restriction showing that this skill is only intended for Chinese-language audio.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The convert_t2s function is defined specifically to convert Traditional Chinese to Simplified Chinese, and later applied to every segment. This changes user content into a preferred script variant without offering a choice or documenting a justified locale-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Every transcribed segment is passed through convert_t2s, so the locale/script transformation is mandatory in normal execution. This is a natural-language policy issue because it enforces a specific script standard rather than preserving or letting the user select the original form.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 技能清单描述该技能会“批量转录…为结构化 Markdown 逐字稿（每视频独立 .md）”，但本文件实际构造并写出的是 transcript_N.json，其中仅包含分段、语言和元数据，没有生成 Markdown 文件。若这是该技能的实际执行阶段之一，单看该代码与对外宣称的最终输出格式存在明显不一致。
Content: No source excerpt is available for this finding.