Security audit

Douyin Video Analyst

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Douyin video-analysis purpose, but its setup and troubleshooting instructions can expose API keys and read local MCP configuration too broadly.

Install only if you are comfortable with a skill that uses a browser profile, local MCP configuration, and API-backed transcription. Do not run the troubleshooting config-dump command with real credentials unless it is redacted first, avoid pasting API keys into shell commands or support chats, and prefer pinned, reviewed versions of mcporter and douyin-mcp-server.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/troubleshooting.md:12
Finding: MCP troubleshooting procedure exposes configured API credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/setup.md:6
Finding: Unpinned third-party packages are installed and executed
Content: View full analysis
Remediation: View remediation
`. - Pin `douyin-mcp-server` to an exact reviewed version instead of resolving the latest release. - Use lockfiles and registry integrity metadata where supported. - Document the expected package registry and verify package ownership and provenance. - Prefer signed releases, checksums, or reproducible artifacts. - Run MCP dependencies with the minimum necessary filesystem, environment, and network access. - Review and test dependency updates before changing the documented pinned versions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:59
Finding: API keys are propagated through generated shell command text
Content: View full analysis
" mcporter call douyin-mcp.extract_douyin_text \ share_link="https://www.douyin.com/video/" 2>&1 # v1.2.0+（阿里云百炼） DASHSCOPE_API_KEY="" mcporter call douyin-mcp.extract_douyin_text \ share_link="https://www.douyin.com/video/" 2>&1 ``` From `references/setup.md`: ```bash # v1.1.0 验证 DOUYIN_API_KEY="sk-xxx" mcporter call douyin-mcp.parse_douyin_video_info \ share_link="https://www.douyin.com/video/7612354982592343675" 2>&1 # 期望：返回 {"status":"success","title":"...","download_url":"..."} # v1.2.0+ 验证 DASHSCOPE_API_KEY="sk-xxx" mcporter call douyin-mcp.parse_douyin_video_info \ share_link="https://www.douyin.com/video/7612354982592343675" 2>&1 ``` From `references/troubleshooting.md`: ```bash # v1.1.0 DOUYIN_API_KEY="sk-xxx" mcporter call douyin-mcp.extract_douyin_text share_link="..." # v1.2.0+ DASHSCOPE_API_KEY="sk-xxx" mcporter call douyin-mcp.extract_douyin_text share_link="..." ``` ### Technical Analysis The workflow instructs the agent or user to substitute API credentials directly into shell command text. Although environment assignment limits inheritance to the invoked process, the secret still becomes part of the generated command representation. Depending on the execution environment, command text may be retained in shell history, terminal recording, debug output, orchestration logs, audit telemetry, or agent tool-call transcripts. This expands the number of systems exposed to the secret. The documentation also states that `mcporter` automatically loads MCP configuration from the supported configuration files. Therefore, repeatedly placing literal keys into command text may exceed what is ...[truncated 1039 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to read local MCP configuration files and enumerate configured environment-variable keys from user-local paths such as ~/.cursor/mcp.json and ~/.claude.json. Accessing local configuration is not required to analyze Douyin videos, and it expands the skill’s scope into sensitive host inspection that could expose secret-management details or normalize unnecessary local file access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow directs access to sensitive local configuration files but provides no warning, consent boundary, or minimization guidance. Even though it only prints environment key names in the example, reading these files can reveal broader configuration data and conditions the agent to inspect user-local secrets infrastructure without necessity for the stated task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire troubleshooting document is written in Chinese and does not indicate that other languages are supported or that the Chinese-only format is a region-specific requirement. This can violate a language/locale policy when users are not given an explicit opt-in or alternative.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file consistently prescribes the skill behavior and output format in Chinese, but does not indicate that users may choose another language. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructions only in Chinese, beginning with the title and continuing throughout the document. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative language option or justification is provided.
Content: No source excerpt is available for this finding.