Security audit

Tiktok Douyin Dl

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent TikTok/Douyin downloader, but its install and update instructions rely on persistent third-party executables and unpinned package installs without integrity verification.

Review this before installing. The downloader purpose is clear and I found no evidence of hidden exfiltration or deception, but you would be trusting third-party release binaries and unpinned dependencies. Prefer verified hashes or signatures, install in an isolated environment, avoid --break-system-packages, and do not run the binaries with elevated privileges.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:61
Finding: Unverified Precompiled Executables Downloaded from an External Release
Content: View full analysis
Remediation: View remediation
douyin-dl" | sha256sum --check - ``` 3. Digitally sign release artifacts or checksums with a documented signing identity, such as Sigstore/Cosign, and provide explicit signature-verification commands. 4. Generate and publish build provenance using a protected CI/CD pipeline. Pin all build dependencies and restrict who can approve releases. 5. Prefer reproducible builds so users can compare locally built artifacts with published binaries. 6. Download to a temporary staging location, verify the artifact, and only then atomically install it into `~/.local/bin`. 7. Document the security behavior of command-line hot updates. Updates should require explicit consent and must undergo the same signature and integrity checks. 8. Avoid recommending execution by privileged users and clearly state that the binaries should run with the minimum necessary permissions. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:46
Finding: Unpinned Python Package Installation from a Third-Party Mirror
Content: View full analysis
Remediation: View remediation
" ``` 2. Use a requirements or lock file containing cryptographic hashes, and install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Create an isolated virtual environment rather than modifying the operating system's managed Python installation: ```bash python3 -m venv ~/.local/share/tiktok-douyin-dl/venv ~/.local/share/tiktok-douyin-dl/venv/bin/python -m pip install --require-hashes -r requirements.txt ``` 4. Remove `--break-system-packages` from the instructions. 5. Prefer the canonical package index or a formally controlled mirror. If a mirror is necessary, document its trust assumptions and verification controls. 6. Pin and verify browser versions and artifacts where the Playwright tooling permits it. 7. Reassess and update pinned versions through a controlled dependency-review process that includes vulnerability scanning and integrity verification. 8. Run installation and browser tooling without elevated privileges and with only the filesystem and network access required for the documented task. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill installs executable files into a persistent user binary directory and triggers a substantial first-run download of Playwright/Chromium, but the user-facing description does not prominently warn about these side effects up front. This can mislead users about trust, disk usage, and the fact that running the tool causes new executable code to be placed on the system, increasing supply-chain and persistence risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The user-facing description and instructions are entirely in Chinese, with no indication that other languages are supported or that the locale restriction is intentional and necessary. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.