Douyin Content Tracker Skill

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:04 PM UTC
• Version: 1.0.0

Overview

The skill mostly does what it advertises, but it handles live Douyin session cookies and executes mutable external tooling with several under-scoped security controls.

Install only in an isolated environment, use a dedicated low-risk Douyin account, keep .douyin_cookies.json out of repositories and backups, avoid --cookies-from-browser unless you understand the account risk, and pin/review MediaCrawler plus Python dependencies before running on important machines.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_video.py:268

Finding

Path Traversal Through an Untrusted Creator Name

Content

View full analysis

|]', "_", title) save_path = AUDIO_DIR / blogger / f"{video_id}.m4a" ``` ### Technical Analysis The creator nickname originates in remotely obtained MediaCrawler data and is propagated into the cleaned CSV as the `博主` field. `download_video.py` then uses this field directly as a filesystem path component. The code sanitizes the title into `safe_title`, but that sanitized value is not used when constructing `save_path`. The creator name is neither sanitized nor checked for absolute paths, parent-directory components, path separators, or containment under `AUDIO_DIR`. With `pathlib`, an absolute right-hand operand can replace the preceding base path. Relative values containing `..` can escape the intended directory after path resolution. The destination is later created and passed to ffmpeg, which is invoked with `-y` and can overwrite an existing destination. ### Attack Path 1. An attacker controls a creator nickname returned through the scraped data, or supplies a crafted cleaned CSV. 2. The nickname contains an absolute path or traversal sequence, such as `../../outside`. 3. The ...[truncated 853 chars]

Remediation

View remediation

str: value = re.sub(r'[\\/:*?"<>|]', "_", value).strip() value = value.replace("..", "_") return value[:100] or "unknown_creator" safe_blogger = safe_component(blogger) save_path = (AUDIO_DIR / safe_blogger / f"{video_id}.m4a").resolve() audio_root = AUDIO_DIR.resolve() if save_path.parent != audio_root and audio_root not in save_path.parents: raise ValueError("Audio destination escapes AUDIO_DIR") ``` - Validate and sanitize `video_id` as well, preferably requiring the expected numeric Douyin identifier format. - Consider disabling unconditional ffmpeg overwrite behavior or requiring explicit confirmation before replacing an existing file. - Apply equivalent containment checks to subtitle, CSV, model, and summary destinations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/track_latest.py:75

Finding

Unrestricted Input URLs Permit Internal-Network Requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scrape_profile.py:139

Finding

Douyin Session Cookies Exposed Through Process Arguments

Content

View full analysis

str: """将 .douyin_cookies.json 转为 key=val; key2=val2 格式字符串""" if not COOKIE_FILE.exists(): return "" cookies = json.loads(COOKIE_FILE.read_text(encoding="utf-8")) return "; ".join(f"{c['name']}={c['value']}" for c in cookies if c.get("name")) ``` ```python cookie_str = load_cookie_string() cmd = [ sys.executable, str(MEDIACRAWLER_DIR / "main.py"), "--platform", "dy", "--lt", "cookie" if cookie_str else "qrcode", "--type", "creator", "--creator_id", creator_url, "--get_comment", "no", "--get_sub_comment", "no", "--save_data_option", "jsonl", "--save_data_path", str(save_path), ] if cookie_str: cmd += ["--cookies", cookie_str] result = subprocess.run( cmd, cwd=str(MEDIACRAWLER_DIR), capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=600, ) ``` ### Technical Analysis The complete cookie file is converted into a plaintext HTTP Cookie header and included in the MediaCrawler subprocess argument list. Command-line arguments can be visible through operating-system process inspection, monitoring agents, crash reports, audit tooling, job wrappers, or diagnostic logs. Using a list-form subprocess invocation prevents shell expansion but does not protect the confidentiality of command-line arguments. The cookies are authentication material and may include reusable Douyin session tokens. The cookies are intentionally transmitted to Douyin by MediaCrawler as part of the declared scraping function. The vulnerability is the local exposure channel created by placing those secrets in the process argument vector, not the legitimate authenticated request itself. ...[truncated 918 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/requirements.txt:1

Finding

Unpinned Executable Dependencies and Mutable External Repository

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (55)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

3. 配置环境变量

bash

cp .env.template .env

编辑 .env，至少填写：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 121)May include surrounding context.

3. 配置环境变量

bash

cp .env.template .env

编辑 .env，至少填写：

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on a media acquisition/transcription pipeline for Douyin creators. The supplied code does something materially different: post-processing existing CSV files on disk. It imports pandas, reads CSVs with encoding fallbacks, standardizes schema, cleans engagement metrics and publish times, computes engagement rate, deduplicates by link, and saves cleaned CSVs. There is no scraping, browser automation, network access, audio extraction, ffmpeg/yt-dlp fallback logic, or Whisper transcription. This is a clear description-behavior mismatch with a different primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk does not implement scraping Douyin, downloading audio, browser automation, ffmpeg/yt-dlp fallback, or Whisper transcription. Its primary purpose is maintaining execution context across runs using a local state file and selecting cleaned CSV files for the current batch. While 'daily tracking' is mentioned in the description, this code is specifically about internal run-state/file selection infrastructure, which is materially different from the declared end-user functionality and omits the core advertised capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code chunk does implement part of the declared scraping domain: it targets Douyin creator pages, manages cookies, supports limiting results, and appears compatible with tracking workflows. However, the declared description prominently claims a broader pipeline: downloading audio and transcribing with Whisper, specifically via Playwright+ffmpeg with yt-dlp fallback. None of those capabilities appear in this code. Instead, the code invokes an external MediaCrawler tool to collect creator video metadata, then converts the output to CSV. This is a materially narrower and different behavior than the declared end-to-end scrape/download/transcribe workflow, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full-featured Douyin scraping and transcription workflow, but the supplied code chunk only contains a simple utility for choosing a default filesystem path based on the operating system. This is not merely a supporting implementation detail tied clearly to the declared functionality, because the chunk by itself does not implement or evidence any of the core claimed capabilities. Therefore, the description does not accurately represent what this specific supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

pip install -r scripts/requirements.txt

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash

cd $SKILL_DIR
cp .env.template .env

编辑 .env：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/pipeline.md (reported line 145)May include surrounding context.

bash

cd $SKILL_DIR
cp .env.template .env

编辑 .env：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 120)May include surrounding context.

bash

cd $SKILL_DIR
cp .env.template .env

编辑 .env：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scrape_profile.py (reported line 86)May include surrounding context.

python

```bash
cd $SKILL_DIR
cp .env.template .env
```

编辑 `.env`：

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 95% confidence

Finding

The skill explicitly recommends importing live browser cookies via --cookies-from-browser chrome to bypass access restrictions. That behavior accesses credential material from the user's browser profile and can silently broaden the blast radius of compromise if the command, script, or output environment is not fully trusted.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

cp ~/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files//msg/file//.douyin_cookies.json
$SKILL_DIR/.douyin_cookies.json

3. 或重新扫码

python scripts/scrape_profile.py

4. 重试下载（Playwright 失败时自动切换 yt-dlp）

python scripts/download_video.py

text

### ❌ yt-dlp 也被拦截

```bash
# 带浏览器 Cookie 重试
yt-dlp -x --audio-format m4a --cookies-from-browser chrome <视频链接>

如果 Chrome Cookie 有效，在 download_video.py 的 ytdlp_download_audio 函数中的 cmd 列表里加入：

python

"--cookies-from-browser", "chrome",

❌ Whisper 崩溃（SIGSEGV / OpenMP 错误）

原因： macOS OpenMP 运行时冲突

解决：

bash

export KMP_DUPLICATE_LIB_OK=TRUE
WHISPER_MODEL=small python scripts/extract_subtitle.py

永久解决： 在 .env 中设置 WHISPER_MODEL=small

❌ Playwright 浏览器缺失

bash

python -m playwright install chromium

❌ Cookie 警�

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 74)May include surrounding context.

Model file may be corrupted (partial download). Delete and re-download:

bash

del "models\medium.pt"     # Windows
rm models/medium.pt        # macOS/Linux
python scripts/extract_subtitle.py   # re-downloads automatically

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script deletes input CSV files after processing when they are associated with the current run, without an explicit warning or opt-in at the point of execution. This destructive behavior can cause irreversible data loss, especially if users expect the original cleaned inputs to remain available for audit, reruns, or recovery. Because the file deletion is automatic and tied to state, users may not realize their source artifacts will disappear.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/download_video.py (reported line 32)May include surrounding context.

python

from dotenv import load_dotenv

BASE_DIR = Path(__file__).parent.parent
load_dotenv(BASE_DIR / ".env")


def _default_output_dir() -> Path:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/extract_subtitle.py (reported line 22)May include surrounding context.

python

from dotenv import load_dotenv

BASE_DIR = Path(__file__).parent.parent
load_dotenv(BASE_DIR / ".env")


def _default_output_dir() -> Path:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 12)May include surrounding context.

python

from dotenv import load_dotenv

BASE_DIR = Path(__file__).parent.parent
load_dotenv(BASE_DIR / ".env")


def _default_output_dir() -> Path:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scrape_profile.py (reported line 33)May include surrounding context.

python

from dotenv import load_dotenv

BASE_DIR = Path(__file__).parent.parent
load_dotenv(BASE_DIR / ".env")


def _default_output_dir() -> Path:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/storage.py (reported line 12)May include surrounding context.

python

from dotenv import load_dotenv

BASE_DIR = Path(__file__).parent.parent
load_dotenv(BASE_DIR / ".env")


def _default_output_dir() -> Path:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/track_latest.py (reported line 38)May include surrounding context.

python

from dotenv import load_dotenv

BASE_DIR = Path(__file__).parent.parent
load_dotenv(BASE_DIR / ".env")


def _default_output_dir() -> Path:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README instructs users to log into Douyin and save session cookies locally in .douyin_cookies.json, but it does not warn that these cookies are sensitive authentication material. If the file is copied, committed, or read by other local users or malware, an attacker may be able to hijack the user's Douyin session.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill clearly instructs shell execution, environment-variable use, and file reads/writes, but it does not declare any explicit tool scope or allowed-tools boundaries. That creates an avoidable trust gap: an agent or user may execute filesystem and shell-capable steps without a least-privilege declaration, increasing the chance of over-broad access during operation.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The one-liner searches the entire home directory recursively to locate the skill directory. Broad filesystem enumeration can expose directory names, consume resources, and normalize unnecessarily invasive search behavior when a fixed install path or explicit user-supplied path would suffice.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

一键完整流程（推荐）

bash

SKILL_DIR=$(python -c "import pathlib; print(pathlib.Path.home().rglob('douyin-content-tracker-skill/SKILL.md').__next__().parent)")
cd "$SKILL_DIR"

# 1. 采集最新 3 条视频

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to copy active Douyin-related cookie material from WeChat or browser sources into the skill directory and to use browser cookies with yt-dlp, without any warning about session-token sensitivity. Session cookies are credentials; mishandling them can enable account takeover, unauthorized scraping under the user's identity, and leakage through logs, backups, or repository commits.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

bash

cp ~/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/*/msg/file/*/.douyin_cookies.json \
   $SKILL_DIR/.douyin_cookies.json
chmod 600 $SKILL_DIR/.douyin_cookies.json

方法 C：使用已有 Cookie

Static analysis

No suspicious patterns detected.