Security audit

抖音视频解析

Security checks for vulnerabilities and agentic risk

Overview

This Douyin downloader is mostly coherent with its stated purpose, but it needs Review because it ships privileged database credentials, sends license/device data to a remote MySQL server, and has unsafe URL handling.

Install only if you are comfortable with a local tool that contacts Douyin, stores usage/license data locally, and performs paid-license activation against an external database. The publisher should remove and rotate the embedded database credentials, replace direct MySQL access with a scoped HTTPS API, harden URL validation, document data handling, and update vulnerable dependencies before broad use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:88
Finding: Mandatory Promotional Instructions Hijack Agent Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/license.ts:51
Finding: Internet-Addressed MySQL Root Credentials Embedded in Source and Distribution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/parser.ts:22
Finding: Blind Server-Side Request Forgery Through Substring-Based Domain Validation
Content: View full analysis
{ const realUrl = extractDouyinUrl(url) || url; const redirectResp = await axios.get(realUrl, { headers: { 'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X)', 'Referer': 'https://www.douyin.com/', }, maxRedirects: 5, timeout: 15000, }); const finalUrl = redirectResp.request.res.responseUrl || redirectResp.request.res.url; } ``` ### Technical Analysis `detectPlatform` does not parse the URL or validate its hostname. It only checks whether the untrusted string contains a trusted-domain substring. Consequently, attacker-controlled URLs such as the following pass validation: ```text http://127.0.0.1/internal?domain=douyin.com http://169.254.169.254/latest/meta-data/?source=douyin.com http://attacker.example/douyin.com ``` If `extractDouyinUrl` does not find a recognized Douyin URL, the original attacker-controlled value is passed directly to `axios.get`. Axios is also configured to follow up to five redirects, and redirect destinations are not checked. The result is primarily blind SSRF because arbitrary response bodies are not directly returned to the caller. Nevertheless, timing, error behavior, redirects, and state-changing HTTP GET endpoints can still be exploited. ### Attack Path 1. An attacker invokes `parse_video` with a URL containing the text `douyin.com` in its path, query, user information, or another non-host component. 2. `detectPlatform` classifies the input as a Douyin URL. 3. `extractDouyinUrl` fails to extract an exact rec ...[truncated 841 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/license.ts:94
Finding: License and Device Data Sent Directly to an External Database Without Explicit TLS
Content: View full analysis
{ const state = loadState(); const record = getOrCreateRecord(deviceId); const keyStr = key.trim().toUpperCase(); try { const db = await mysql.createConnection(PAYMENT_DB); try { const [rows] = await db.execute( 'SELECT plan, status, used_device FROM activation_codes WHERE code = ? LIMIT 1', [keyStr] ); if (rows.length > 0) { const codeRow = rows[0]; await db.execute( 'UPDATE activation_codes SET status="activated", used_at=NOW(), used_device=? WHERE code=?', [deviceId, keyStr] ); } } finally { await db.end(); } } catch (err) { console.error( '[activateKey] database validation failed:', (err as Error).message ); } } ``` The database configuration shown elsewhere in the same file does not specify an `ssl` option. ### Technical Analysis The Skill connects directly from the user's machine to an external MySQL server and submits the activation code and device identifier. No explicit TLS configuration or certificate-validation policy is present in the connection configuration. A desktop or agent-side package should not be given direct database access. This design exposes the database service to every client and makes it difficult to enforce authentication, request authorization, rate limits, privacy controls, and protocol-level hardening. The SQL statements use placeholders, so SQL injection is not established. The weakness is the direct database architecture and sensitive-data transport rather than query construction. ### Attack Path 1. A user or agent invokes `activate_subscription`. 2. The supplied license code ...[truncated 860 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/license.ts:19
Finding: License Keys and Device Records Stored in Plaintext Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/license.ts:60
Finding: Universal Hardcoded Activation Codes Allow Paid-Plan Bypass
Content: View full analysis
= { 'DEMO-BASIC-2026': { plan: 'basic', expiresAt: '2027-01-01' }, 'DEMO-PRO-2026': { plan: 'pro', expiresAt: '2027-01-01' }, }; ``` The fallback activation path trusts these shared values: ```ts const keyInfo = VALID_KEYS[keyStr]; if (!keyInfo) { return { allowed: true, reason: UPGRADE_MESSAGES.invalidKey(), remaining: PRICING.free.quota - record.count, plan: 'free', isPaid: false, }; } record.plan = keyInfo.plan; record.keyData = { key: keyStr, expiresAt: keyInfo.expiresAt }; state[deviceId] = record; saveState(state); ``` ### Technical Analysis The package includes globally reusable activation values in source code and compiled JavaScript. When database lookup fails or does not find a code, activation falls back to these values and grants a paid plan locally. Because every package recipient can inspect the keys, they provide no authentication. The Pro key grants an unlimited plan until its hardcoded expiration date. The fallback also means a database outage does not fail closed; it enables a client-side entitlement path based on public constants. ### Attack Path 1. An attacker reads `src/license.ts`, `dist/license.js`, or the CLI help output. 2. The attacker obtains the shared Pro activation code. 3. The attacker invokes `activate_subscription` or the CLI `activate` command with that value. 4. The local state record is changed to the Pro plan. 5. Subsequent `parse_video` calls bypass usage limits until the hardcoded expiration date or local state is changed. ### Impact Assessment Any package user can obtain paid or unlimited functionality without purchasing an individual entitlement. The bypass affects the local ...[truncated 179 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (56)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file hardcodes live remote MySQL connection details, including a root username and plaintext password, inside client-distributed license code. Anyone with access to the package can extract these secrets and directly access or abuse the payment database, leading to database compromise, unauthorized data access, tampering with activation records, or broader infrastructure impact if the account is overprivileged.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation routine transmits the user-provided license key and device identifier to a remote database-backed service without any visible user disclosure, and it also updates remote state to bind the key to a device. In the context of a local agent skill, this hidden outbound licensing telemetry increases privacy and trust risk, and combined with the exposed database credentials, it materially worsens the danger by enabling unauthorized manipulation of activation state.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.16.0 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: axios 1.16.0 is flagged with multiple high-severity advisories including SSRF-adjacent proxy bypass and denial-of-service conditions. In a tool that likely fetches remote Douyin content, a vulnerable HTTP client is especially relevant because attacker-controlled URLs, redirects, proxy behavior, or malformed payloads may be reachable during normal operation.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: fast-uri 3.1.0 is associated with host confusion and SSRF-related parsing flaws. This matters in software that processes external URLs because incorrect canonicalization can let attackers bypass hostname validation, redirect protections, or internal-network restrictions.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: form-data 4.0.5 has a CRLF injection issue in multipart field names/filenames, which can corrupt generated HTTP requests or enable header/request smuggling in downstream integrations. If this skill uploads or relays files or metadata derived from untrusted inputs, the affected package could turn user-controlled values into malformed outbound requests.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.16 — 16 advisory(ies): CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie); CVE-2026-71848 (Hono: Algorithmic Complexity DoS in Language Middleware) +13 more

High

Category: Supply Chain
Confidence: 95% confidence
Finding: hono 4.12.16 is flagged with numerous advisories affecting routing, cookies, and denial of service. Because the MCP SDK includes Hono-based server functionality, these issues are materially relevant if the skill exposes HTTP/SSE endpoints or uses middleware paths influenced by remote clients.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: ip-address 10.1.0 has advisories involving leading-zero parsing ambiguity and HTML-emitting methods. The host parsing issue can matter indirectly through rate limiting or network validation logic, though the XSS portion is less likely unless the library's HTML-rendering helpers are used in a UI context.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.25.0 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: undici 7.25.0 has multiple high-severity advisories including response queue poisoning, information disclosure, and desynchronization issues. Since cheerio depends on undici and this skill likely performs remote fetches/scraping, a vulnerable HTTP stack substantially raises the risk of SSRF-like abuse, cross-request contamination, or service instability when processing attacker-controlled endpoints.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.16.0 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The manifest permits a known vulnerable axios release, and axios is typically used for outbound HTTP processing of attacker-influenced inputs such as URLs, headers, proxy settings, or parsed response bodies. In an MCP service that likely fetches remote Douyin-related content, known axios flaws could enable denial of service, proxy bypass, or unsafe handling paths depending on how requests are constructed.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This code embeds credentials for a remote MySQL payment database directly in the client-side license module, allowing anyone with source or package access to recover and misuse them. Because the credential is for the root account and the code performs remote activation lookups and updates, compromise could expose, alter, or destroy the payment/licensing backend and all activation data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill description, commands, tool explanations, pricing, and user-facing quota message are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking/regional audience. Under the stated policy, a skill that effectively forces a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly accepts user-supplied URLs and an optional device_id, and the documentation says it directly requests Douyin pages to extract content, but it does not clearly warn users that their input will be sent over the network to third-party services. This creates a transparency and privacy risk: users may unknowingly submit sensitive share links or persistent identifiers, and operators may process more data than users reasonably expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This .js file contains user-facing natural-language strings entirely in Chinese, including the banner, help text, prompts, and status/error messages. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and this file provides no indication of alternative language support or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The shipped CLI exposes a reset command that invokes resetUsage() directly, while the help text labels it as debug-only. Any user can run this command locally to clear usage counters, which undermines quota enforcement and any licensing or billing controls that depend on those counters.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's comments, display name, description, and all user-facing upgrade/status messages are written only in Chinese. This creates a language/locale policy concern because the skill appears to enforce a single language without any opt-in, fallback, or explicit documentation that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The tool schema describes device_id as optional and explicitly says it is used for usage tracking, but the file provides no confirmation prompt, privacy notice, or other user-facing disclosure about collecting or transmitting that identifier. This is a safety-relevant data handling behavior for a code file and should be surfaced clearly to users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code silently creates and writes a persistent state file in the user's home directory containing license and usage information without any visible disclosure or consent flow. While not code-execution dangerous, it creates an undisclosed local tracking artifact and may expose license data or usage history to other local users or processes if file permissions are not tightly controlled.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The code comment describes a 'simple device fingerprint' and constructs an identifier from hostname, platform, and architecture. In the absence of a manifest declaring host-identification or telemetry behavior, collecting host identity attributes is an additional capability beyond basic license key validation and usage counting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code sends the user-supplied URL to an external service via HTTP requests, which can disclose user-provided data and browsing targets. Although there are developer-facing console logs, there is no user-facing warning, confirmation, or inline documentation explaining that the input will be transmitted over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The parser fetches metadata and fallback HTML from Douyin-controlled endpoints using the derived video ID, which is still based on user input and may reveal what content the user is analyzing. The file contains console logging for developers, but no user-facing notice or descriptive comment warning that the skill contacts remote services to retrieve video information.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code intentionally transforms Douyin playback/download URLs to remove watermark indicators such as replacing '/playwm/' with '/play/' and changing watermark query values. This goes beyond ordinary metadata extraction and enables circumvention of platform-applied content markings, which can facilitate unauthorized redistribution and policy evasion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The package description at L04 frames the skill as a Douyin video parsing/downloading service, which would plausibly require HTTP/network libraries. However, the additional MySQL dependency indicates database access capability that is not obviously required by that stated purpose and is not otherwise explained in the available manifest context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-facing comments, banner, help text, and command feedback are written only in Chinese, which forces a specific language/locale on all users. The file does not provide any option to select another language or indicate that the tool is intentionally limited to a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI exposes a reset command that resets usage counters and is reachable by any user without authentication, confirmation, or environment gating, even though the help text says it is for debugging only. In a tool that enforces free-tier limits and paid plans, this directly undermines licensing and quota controls by allowing users to restore their allowance on demand.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This TypeScript config file contains natural-language strings exclusively in Chinese, including the display name, description, comments, and upgrade/status messages. Under the policy rules, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.