Douyin Content Tracker Skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it needs user review because it handles live Douyin login cookies and installs/runs broad external scraping tooling with limited safety warnings.

Install only if you are comfortable giving this tooling access to an authenticated Douyin session. Use a dedicated account and virtual environment, keep .douyin_cookies.json private and out of source control, avoid browser-cookie fallback unless necessary, pin/review dependencies and MediaCrawler, and delete or rotate cookies after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs shell execution, environment variable use, and file reads/writes, yet no permissions are declared. This creates a transparency and consent problem: a user or platform may underestimate what the skill can access or modify, especially because it handles cookies and local files.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation tells users to copy a Douyin cookie file from WeChat into the skill directory without warning that this file contains live authentication material. Reusing session cookies outside their original context can expose account access, enable unauthorized reuse, and normalize unsafe credential handling.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting section recommends using browser cookies with yt-dlp but does not warn users that this pulls authenticated browser session data into a command-line workflow. That can expose private sessions, broaden the attack surface, and lead users to grant unnecessary access to sensitive browser credentials.

Ssd 3

High

• Confidence: 98% confidence
• Finding: These instructions explicitly move authentication cookies from WeChat/Chrome-related storage into the skill workspace for reuse. Storing reusable session material in a project directory increases the chance of accidental disclosure, misuse by other local processes, inclusion in backups, or exfiltration through later tooling.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Telling users to retry with browser cookies encourages reuse of private browser session data to bypass access controls or scraping blocks. Even if intended for convenience, it conditions users to export sensitive session state into broader contexts where it may be captured, logged, or abused.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 采集
playwright
yt-dlp

# 数据处理

• Confidence: 92% confidence
• Finding: The Playwright dependency is unpinned, so installs may pull different versions over time, reducing reproducibility and potentially introducing breaking changes or newly published vulnerable releases without review. In a scraping skill that automates a browser, dependency drift can materially change behavior and expand attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 采集
playwright
yt-dlp

# 数据处理
pandas

• Confidence: 97% confidence
• Finding: yt-dlp is unpinned, which is especially risky because it is an actively changing downloader that processes untrusted remote content and has a history of security advisories. Allowing arbitrary latest-version resolution can introduce vulnerable or behavior-changing releases into a workflow that downloads media from external sites.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yt-dlp

# 数据处理
pandas
jieba

# 音频提取（ffmpeg wrapper，用于获取 ffmpeg 可执行文件）

• Confidence: 88% confidence
• Finding: pandas is unpinned, which creates supply-chain and reproducibility risk even if pandas itself is not the most exposed package in this workflow. Unreviewed dependency drift can still introduce security issues or incompatible behavior into data-processing stages.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 数据处理
pandas
jieba

# 音频提取（ffmpeg wrapper，用于获取 ffmpeg 可执行文件）
imageio-ffmpeg

• Confidence: 86% confidence
• Finding: jieba is unpinned, allowing uncontrolled version changes during installation. While the direct security impact is limited in this context, any unpinned third-party package increases supply-chain exposure and weakens build reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

jieba

# 音频提取（ffmpeg wrapper，用于获取 ffmpeg 可执行文件）
imageio-ffmpeg

# 语音识别
openai-whisper

• Confidence: 90% confidence
• Finding: imageio-ffmpeg is unpinned, and this package is relevant because it helps obtain an ffmpeg executable used for media processing. Uncontrolled upgrades in tooling that fetches or wraps executable binaries can increase risk if a bad release or compromised dependency is pulled.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

imageio-ffmpeg

# 语音识别
openai-whisper

# 其他
python-dotenv

• Confidence: 91% confidence
• Finding: openai-whisper is unpinned, which may introduce unreviewed changes in a package that handles model loading and transcription workflows. Although not inherently malicious, unpinned ML-related dependencies can pull in changed transitive dependencies and expand attack surface unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai-whisper

# 其他
python-dotenv

• Confidence: 89% confidence
• Finding: python-dotenv is unpinned, creating unnecessary dependency drift in code that typically manages environment variables and secrets configuration. Even a small utility package can become a supply-chain entry point if versions are not controlled.

Known Vulnerable Dependency: yt-dlp — 7 advisory(ies): CVE-2023-46121 (yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection); GHSA-3v33-3wmw-3785 (yt-dlp has dependency on potentially malicious third-party code in Douyu extract); CVE-2023-40581 ( yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`) +4 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: yt-dlp has multiple known advisories, and this skill's stated purpose directly uses it for downloading media from Douyin, making the package operationally relevant rather than incidental. Because it processes untrusted remote content and may invoke complex extractor logic, known flaws such as command injection or unsafe third-party code can materially affect the host running the skill.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: python-dotenv is flagged with a low-severity advisory involving symlink following in set_key, and while this requirements file does not prove the vulnerable API is used, including an affected version range can still expose downstream code if that function is invoked. The risk is lower here because exploitation usually requires a local file-system manipulation scenario and specific usage patterns.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

~/DouyinContentTracker/
├── data/                           # 采集数据
│   ├── 周凯谈烘焙_20260321_083047.csv
│   └── cleaned_周凯谈烘焙_20260321_083047.csv
├── audio/                          # 音频文件
│   └── 周凯谈烘焙/
│       ├── 7559900409483300105.m4a    (96 KB)

• Confidence: 88% confidence
• Finding: The YARA hit is triggered by guidance to use --cookies-from-browser chrome, which matches information-stealer behavior because it accesses authenticated browser data. In this skill's context, the behavior appears operational rather than overtly malicious, but it still promotes credential-adjacent access patterns that can expose private session material.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.