Security audit

Douyin Video Download

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real Douyin video downloader, but it has review-worthy safety issues around unrestricted URLs, unsafe file paths, disabled browser sandboxing, and privileged installation guidance.

Install only if you are comfortable reviewing or fixing the safety gaps first. Avoid running it with elevated privileges, do not use the sudo yt-dlp one-liner without verifying the binary, restrict inputs to real Douyin HTTPS URLs, use a dedicated output directory, and avoid custom filenames containing path separators or .. components.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: lib/parser.js:143
Finding: Unrestricted URL Navigation and Download Enables SSRF-Like Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/downloader.js:106
Finding: Path Traversal Through the Custom Filename Can Overwrite Arbitrary Writable Files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: lib/parser.js:16
Finding: Chromium Is Launched With Its Security Sandbox Disabled
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:34
Finding: External Executable Installation Uses a Mutable Release Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 该代码确实与“抖音视频下载/无水印下载”这一核心方向一致：它会尝试将 playwm 替换为 play，并基于 videoId 构造 aweme 播放链接，再用 curl 下载，失败后回退到 yt-dlp。但声明中提到的多项关键能力在此代码中没有体现：1) 没有批量处理逻辑，只看到 downloadVideo 的单视频入口；2) 没有任何去重判断或已下载记录管理；3) 宣称智能选择 yt-dlp/Playwright，但代码仅在 curl 与 yt-dlp 之间切换，完全没有 Playwright；4) 因此描述比实际代码覆盖的能力更广，存在明显描述-行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The code clearly matches the general purpose of a Douyin video downloader and does support single and batch modes. However, the description makes specific capability claims—automatic deduplication, watermark-free downloading, and intelligent selection of yt-dlp/Playwright—that are not substantiated by this code chunk. The batch mode simply reads URLs from a file and downloads them one by one. There is also a --concurrent parameter, but the loop awaits each download sequentially, so concurrency is not implemented here. This is therefore a description/behavior mismatch, though the primary purpose remains broadly aligned.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: The chained command combines download and privileged permission changes in one line, which reduces opportunities for inspection and safe validation between steps. While && itself is not malicious, in this context it streamlines execution of an unverified remote binary into a privileged path, increasing operational risk and making accidental unsafe execution more likely.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
### 2. 安装外部工具 (可选但推荐) - **yt-dlp**: 提供最佳下载体验和更高的稳定性。 - **Linux/macOS**: `sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp && sudo chmod a+rx /usr/local/bin/yt-dlp` - **Windows**: 从 [yt-dlp releases](https://github.com/yt-dlp/yt-dlp/releases) 下载 `.exe` 并添加到 PATH。 ## 使用

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
node scripts/download.js "https://v.douyin.com/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
node scripts/download.js "https://v.douyin.com/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
node scripts/download.js "https://v.douyin.com/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
node scripts/download.js "https://v.douyin.com/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
node scripts/download.js "https://v.douyin.com/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
node scripts/download.js "https://v.douyin.com/xxxxx"

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code and comments explicitly describe using Playwright to bypass anti-scraping protections and construct direct no-watermark download URLs. That behavior is dangerous in a skill context because it normalizes deliberate evasion of platform controls, increases legal/compliance risk, and can lead to account, IP, or service abuse even if it is not a classic memory-corruption bug.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The lockfile pins axios 1.13.6, which the static analysis indicates is affected by multiple advisories including SSRF/proxy handling issues and prototype-pollution-related request manipulation. In a video download tool that fetches attacker-controlled URLs or follows redirected content, a vulnerable HTTP client materially increases risk of server-side request forgery, credential leakage, or request/response tampering.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 83% confidence
Finding: form-data 4.0.5 is reported vulnerable to CRLF injection through unescaped multipart field names and filenames. If the skill ever builds multipart requests using attacker-influenced metadata, this can enable malformed requests, header injection, or request smuggling behavior against downstream services.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.24.0 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

Category: Supply Chain
Confidence: 88% confidence
Finding: undici 7.24.0 is flagged for multiple HTTP parsing and response desynchronization issues. Because this package is brought in via cheerio and may be used for remote fetches in a downloader that processes untrusted network responses, these flaws could lead to request confusion, cache/connection poisoning, or cross-request data exposure in certain deployment patterns.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency set permits or resolves to an axios version with known high-severity advisories, including SSRF-related and prototype-pollution/MITM-style issues per the scanner output. In a video download tool that fetches remote URLs and web content, a vulnerable HTTP client is more dangerous because attacker-controlled endpoints, redirects, proxy settings, or crafted responses may be processed during normal operation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation indicates use of shell and environment-dependent capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. This can cause the agent runtime to grant broader-than-expected execution capability, reducing transparency and increasing the chance of unsafe command execution when the skill is invoked.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: Using npx playwright install chromium without a pinned package version allows the resolved Playwright package to vary over time, creating a supply-chain risk. A future compromised or incompatible release could be fetched and executed during installation, especially because npx may download code dynamically.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The instructions recommend downloading an executable from the internet with curl and placing it into /usr/local/bin using sudo. This encourages privileged installation of remote code without signature or checksum verification, so a compromised release, MITM in a misconfigured environment, or user copy-paste error could lead to system-wide code execution as root.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
### 2. 安装外部工具 (可选但推荐) - **yt-dlp**: 提供最佳下载体验和更高的稳定性。 - **Linux/macOS**: `sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp && sudo chmod a+rx /usr/local/bin/yt-dlp` - **Windows**: 从 [yt-dlp releases](https://github.com/yt-dlp/yt-dlp/releases) 下载 `.exe` 并添加到 PATH。 ## 使用

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file contains natural-language strings such as comments and console messages exclusively in Chinese, which imposes a specific language on operators or developers. The policy allows fixed locale behavior only when user choice or a justified locale constraint is provided, which is not present here.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code navigates a browser to a user-supplied URL, which transmits the provided link and browser metadata to external Douyin infrastructure. Although there are console logs about parsing progress, there is no warning or comment disclosing that the skill will contact third-party services and fetch remote page content on the user's behalf.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The response handler inspects network responses from the loaded page and extracts video identifiers from API payloads. This is a privacy-relevant network-data handling behavior, but the surrounding comments only describe technical optimization and do not warn users that third-party response data will be programmatically captured and parsed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language strings for the banner, help text, and usage instructions almost entirely in Chinese. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation when no alternative language selection or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s user-facing description and instructions are consistently presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

Category: Supply Chain
Confidence: 86% confidence
Finding: follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. While this downloader may not primarily handle sensitive bearer tokens, any authenticated outbound requests, cookies, or custom headers used for scraping/downloading could be exposed to attacker-controlled redirect targets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language description forces a specific language in user-facing package metadata, which can violate language/locale policy when no opt-in or scope limitation is stated. The file does not indicate that the package is intended only for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/downloader.js:34