Security audit

Douyin Video Forge Felix

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with Douyin video production, but it needs review because it can create persistent scheduled jobs and run broad web/video automation without enough user control.

Install only after reviewing the scheduling behavior. Do not allow automatic cron creation unless you have seen the exact dates, task count, workflow steps, API usage, and removal method. Use a dedicated environment, pin dependencies where possible, avoid running the installer over a modified local copy without backup, and treat downloaded Douyin media, comments, transcripts, and Kling API credentials as sensitive operational data.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

Location: SKILL.md:488
Finding: Persistent Unattended Execution Through Automatically Created Cron Jobs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:209
Finding: Shell Command Injection Risk in Agent-Constructed Command Templates
Content: View full analysis
" ``` ```bash python3 ~/.openclaw/skills/douyin-video-forge/scripts/kling_api.py generate \ --prompt "" \ --duration 10 --aspect-ratio 9:16 --mode pro ``` ```bash python3 ~/.openclaw/skills/douyin-video-forge/scripts/kling_api.py generate-with-image \ --prompt "" \ --image "" \ --duration 10 --aspect-ratio 9:16 --mode pro ``` ### Technical Analysis The Skill instructs an Agent to replace quoted placeholders with values obtained from users, generated content, browser results, or downloaded resources and then execute the result as Bash. Double quotes do not safely contain an attacker-controlled value if the value itself can include a double quote followed by shell syntax. Shell substitutions such as `$(command)` also remain active inside double-quoted shell text if they become part of the final command source. Merely displaying a placeholder inside quotes therefore does not establish safe argument separation. The risk is particularly relevant because video URLs are collected from web content and prompts are synthesized from user and browser-derived text. Remote page content must be considered untrusted. The Python CLI itself uses structured argument parsing, but that protection does not prevent injection that occurs earlier while constructing the Bash command. ### Attack Path 1. An attacker supplies a crafted video URL, reference value, or content that becomes part of a generated prompt. 2. The crafted value contains a quote terminator and shell syntax, for example a pattern equiv ...[truncated 1145 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/kling_api.py:111
Finding: Server-Side Request Forgery and Resource Exhaustion Through Arbitrary Video URLs
Content: View full analysis
str: """If the value is a URL, download it to a temporary file.""" if path_or_url.startswith(("http://", "https://")): tmpdir = tempfile.mkdtemp(prefix="kling_") local_path = os.path.join(tmpdir, "downloaded.mp4") with httpx.Client( timeout=httpx.Timeout(120.0), follow_redirects=True, ) as client: resp = client.get(path_or_url) resp.raise_for_status() with open(local_path, "wb") as f: f.write(resp.content) return local_path return path_or_url ``` ### Technical Analysis The `extract-frame` workflow accepts a user-controlled path or URL. For any value beginning with `http://` or `https://`, the script performs an outbound request without validating the hostname, resolved IP address, port, response content type, redirect destination, or response size. Because redirects are enabled, validating only the initial textual URL would not be sufficient. An external endpoint could redirect the client to a loopback, private-network, or link-local destination. The entire response is buffered in `resp.content` before being written. A sufficiently large response can therefore consume substantial memory in addition to disk space. The downloaded content is subsequently supplied to `ffprobe` and `ffmpeg`, expanding the attack surface to complex media parsers. The request does not attach Kling authorization headers, so this function does not directly transmit the Kling JWT to the arbitrary destination. ### Attack Path 1. An attacker causes the Agent to invoke: ```bash python3 scripts/kling_api.py extract-frame \ --video "http://attacker-controlled-or-internal-address/resource" ``` 2. `download ...[truncated 1164 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:50
Finding: Unpinned Runtime Dependency Installation and Upgrade Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (36)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 179)May include surrounding context.
卸载

bash
rm -rf ~/.openclaw/skills/douyin-video-forge

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 179)May include surrounding context.
卸载

bash
rm -rf ~/.openclaw/skills/douyin-video-forge

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是“抖音短视频全链路自动化制作”工作流，重点包括采集抖音数据、分析热点、生成脚本、调用可灵生成视频并拼接成片。但给出的代码块仅是一个可灵 API CLI 封装，核心功能限于视频生成、状态查询、连通性检查和从视频中提取单帧。代码中没有任何抖音相关域名、浏览器控制、页面抓取、热点分析、脚本生成、素材拼接或成片逻辑，因此其主要用途与声明存在明显偏差。此外，代码还具备下载远程视频并用 ffmpeg 提帧的能力，这属于未声明的附加功能。综合来看，描述不能准确代表该代码实际行为。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向抖音推广视频制作的端到端自动化能力，核心应包括浏览器采集抖音数据、热点分析、脚本生成、视频生成与拼接。而提供的代码仅包含一个 transcribe.py，其功能是加载 faster-whisper 模型，对本地音频文件执行语音识别并以 JSON 输出结果。代码没有任何与抖音、浏览器自动化、热点采集、视频生成、可灵API、剪辑拼接相关的逻辑，也没有网络访问或平台集成行为。因此该代码的实际主用途与声明用途存在显著且实质性的偏差，应判定为不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The auto-activation trigger list is overly broad and can cause the skill to engage on common topics like videos, projects, or analysis without clear user intent. Over-broad activation increases the chance that powerful capabilities such as shell, network, downloads, and scheduling are invoked in contexts where the user did not knowingly request them.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · install.sh (reported line 56)May include surrounding context.
sh
fi cp -R "$SCRIPT_DIR" "$SKILL_DIR" # 清理安装目录中不需要的文件 rm -rf "$SKILL_DIR/.git" "$SKILL_DIR/.env" "$SKILL_DIR/.DS_Store" rm -rf "$SKILL_DIR/mcp_server" success "已安装到 $SKILL_DIR"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · install.sh (reported line 56)May include surrounding context.
sh
fi cp -R "$SCRIPT_DIR" "$SKILL_DIR" # 清理安装目录中不需要的文件 rm -rf "$SKILL_DIR/.git" "$SKILL_DIR/.env" "$SKILL_DIR/.DS_Store" rm -rf "$SKILL_DIR/mcp_server" success "已安装到 $SKILL_DIR"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · install.sh (reported line 57)May include surrounding context.
sh
cp -R "$SCRIPT_DIR" "$SKILL_DIR" # 清理安装目录中不需要的文件 rm -rf "$SKILL_DIR/.git" "$SKILL_DIR/.env" "$SKILL_DIR/.DS_Store" rm -rf "$SKILL_DIR/mcp_server" success "已安装到 $SKILL_DIR" # --- 4. 完成 ---

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file states '所有错误消息使用中文' as a blanket requirement for all error messages. This is a language policy constraint presented as mandatory behavior, and the document does not offer user opt-in, language selection, or a documented regional/compliance justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guideline '所有用户可见文本使用中文' forces a specific language for all user-visible output. Under the policy, language restrictions should either provide user choice or be clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The PRD explicitly plans anti-detection capabilities including Camoufox, fingerprint randomization, proxy rotation, cookie pools, and automated CAPTCHA handling to avoid platform defenses during scraping. This goes beyond ordinary browsing automation and materially increases the skill's capability to evade access controls, abuse third-party services, and facilitate large-scale unauthorized data collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The migration guide states that rerunning bash install.sh will automatically clean up old MCP-related files, but it does not clearly describe what will be removed or whether backup/confirmation is required. In an agent-skill setting, vague cleanup behavior can lead to unintended deletion of configuration or user-modified files, especially when users are encouraged to execute the script directly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill description, examples, and usage are entirely framed in Chinese and instruct users to interact via natural-language requests, but the document does not state whether other languages are supported or that Chinese is a justified region-specific limitation. This can constitute a language/locale policy issue because it effectively forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README documents automated browsing, downloading, transcription, external API use, and output generation, but does not clearly warn users about privacy, consent, copyright, and data-handling implications. In a workflow that collects third-party platform content and may process audio/video through local or remote components, omission of these disclosures can lead to unsafe or noncompliant use.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell commands, accesses environment variables, and relies on networked tools/APIs, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens containment and review because an agent may be allowed to use broader capabilities than users expect, including downloading content, calling external APIs, and processing local files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The transcription command hard-codes --language zh, and the skill content is written as if Chinese is the fixed operating language. There is no user choice or documented justification that the skill is limited to Chinese-only operation, which is a locale/language policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs automatic creation or modification of persistent local cron job state, which changes system behavior beyond the immediate user request. Persistence mechanisms are security-sensitive because they can cause unattended future execution, repeated network access, and ongoing file changes without granular per-run approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The markdown explicitly states that scheduled jobs will be created automatically and written to a local cron job file, without a prominent warning or consent gate. Silent persistence is dangerous because it enables repeated execution after the initial interaction, potentially consuming resources, contacting external services, or processing data in the background.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill content is written as a fixed Chinese script template, including narration, prompts, and output conventions, with no indication that users may request another language or opt into this locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill file is written in Chinese and instructs the user to copy the text directly into Seedance, but it does not mention that the content is Chinese-only or offer any language/localization choice. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer unconditionally deletes any existing skill directory with rm -rf "$SKILL_DIR" before reinstalling, with no confirmation, backup, or validation beyond the computed path. This can cause irreversible data loss if the user has local modifications, generated assets, or misconfigured path variables, and set -e does not mitigate that risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and introductory text state the document is the core reference for an LLM agent generating Douyin content, and the entire skill guidance is presented only in Chinese. This creates a language/locale constraint for the skill without offering the user a choice or documenting a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and core operating instruction are entirely in Chinese, and L003 tells the agent to use this knowledge base to generate scripts based on user needs without any indication that language should match user preference. This creates a natural-language policy concern because the skill appears to impose a specific language/locale by default rather than offering user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring and all CLI/user-facing messages are written in Chinese, and the skill does not indicate that the locale is fixed or provide any opt-in/selection mechanism. This creates a natural-language policy concern because the skill implicitly enforces a specific language for all users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function will fetch any attacker-controlled HTTP(S) URL and store the response locally, which creates a server-side request forgery style primitive if this script runs in a privileged environment. In agent or automation contexts, this can be abused to reach internal services, download unexpected content, or consume bandwidth and disk without sufficient restriction.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:179

Overview

A.I.G

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tool Parameter Abuse

卸载

Tool Parameter Abuse

卸载

Tp4

Tp4

Vague Triggers

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Natural-Language Policy Violations

Natural-Language Policy Violations

Ssd 4

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Undeclared Tool Scope

Natural-Language Policy Violations

Context-Inappropriate Capability

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Context-Inappropriate Capability

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.