Security audit

抖音自动回复助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Douyin automation tool that asks users to handle live account cookies unsafely and overstates incomplete account-action features.

Review before installing. This skill asks for a live Douyin browser cookie, stores it in plaintext, and may log interaction content; treat that cookie like a password and do not use a primary account. The advertised automation is also incomplete in the shipped code, so users could expose credentials without receiving the promised functionality.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/config_manager.py:55
Finding: Douyin Session Cookie Exposed Through Command-Line Arguments and Plaintext Storage
Content: View full analysis
") return manager.set_cookie(sys.argv[2]) ``` ### Technical Analysis The Skill instructs users to provide a live Douyin session cookie as a command-line argument. Command-line secrets can be exposed through shell history, terminal logs, process-monitoring tools, process listings, or diagnostic data. The configuration manager then persists the cookie directly in `config.json` as plaintext. The file is created using the process's default permissions and current `umask`. The code does not explicitly require owner-only permissions, use an operating-system credential store, encrypt the secret, or validate whether an existing configuration file is a symbolic link. A Douyin session cookie is an authentication credential rather than ordinary configuration data. Anyone who ...[truncated 1301 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/douyin_bot.py:132
Finding: User Identifiers and Message Content Persisted in Logs and Exported Reports
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unpinned and Unnecessary Third-Party Dependency Installation
Content: View full analysis
=2.28.0 ``` ```bash # assets/QUICKSTART.md:23-26 # 1. Enter the Skill directory cd douyin-auto-reply # 2. Install dependencies if required pip install requests ``` ```bash # assets/marketplace_listing.md:79-88 # Extract after downloading from ClawHub unzip douyin-auto-reply.skill cd douyin-auto-reply pip install requests ``` ### Technical Analysis The dependency declaration permits any future `requests` release at or above version 2.28.0. The installation documentation is less restrictive and asks the package installer to resolve the latest available release and its transitive dependencies. No integrity hashes or lock file are provided. Consequently, the exact installed code can change after the Skill has been reviewed. Package installation and build mechanisms can execute package-controlled code in the installing user's environment. The shipped executable scripts do not import `requests`; it appears only in the API documentation example. Requiring users to install it therefore increases the supply-chain attack surface without supporting the current executable implementation. This finding does not establish that the legitimate `requests` package is malicious. The risk arises from unnecessary, non-reproducible, and unverified future dependency resolution. ### Attack Path 1. A user follows the installation documentation. 2. `pip` queries the configured package index and resolves the latest compatible `requests` package and dependencies. 3. The selected versions may differ from those reviewed with the Skill. 4. If a future release, transitive dependency, configured package index, or distribution artifact is compromised, installation processes attacker-controlled p ...[truncated 530 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is described as an automated Douyin engagement assistant using the DouyinBot API, but the implementation reportedly does not perform monitoring, replying, private messaging, or API calls, and instead functions as a command-line configuration manager. This is dangerous because deceptive capability claims undermine trust and may conceal the true operational surface of the skill, including unexpected handling of local data or configurations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is described as an automated Douyin engagement assistant using the DouyinBot API, but the implementation reportedly does not perform monitoring, replying, private messaging, or API calls, and instead functions as a command-line configuration manager. This is dangerous because deceptive capability claims undermine trust and may conceal the true operational surface of the skill, including unexpected handling of local data or configurations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The quickstart tells users to extract their live Douyin session cookie from browser developer tools and paste it into a local script, but it does not clearly explain that this cookie is effectively an account credential that can grant authenticated access. In the context of an automation tool for monitoring comments, replying, and sending DMs, normalizing manual cookie extraction materially increases the risk of credential mishandling, account takeover if the cookie is exposed, and potential abuse of the user’s account.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions tell users to configure a Douyin cookie but do not warn that the cookie is a live authentication secret equivalent to account access. In this context, encouraging users to paste such a credential into a script materially increases the risk of account takeover, credential leakage via shell history/logs, and unsafe handling of sensitive auth data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly instructs users to copy their live browser session cookie from developer tools and use it as an authentication credential, but does not warn that this cookie is effectively account access. If the cookie is exposed in logs, code, screenshots, or shared configs, an attacker may hijack the Douyin account and perform actions as the user until the session is revoked or expires.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document claims the skill is complete and ready for listing, but later states that full Douyin API integration is still pending. This misrepresents the implementation status and can mislead reviewers or buyers into trusting automation capabilities that may not exist or may be incomplete. In the context of account automation, false claims about readiness increase the chance of unsafe deployment with real credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill promotes automated monitoring, replying, and direct messaging without an upfront warning that it will perform actions on behalf of the user account and interact with other users automatically. This creates significant risk of platform enforcement, spam behavior, user harassment, or accidental mass messaging if deployed carelessly. The surrounding context makes it more dangerous because the stated use cases include lead generation and private-message funneling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instructions tell users to set a Douyin cookie without clearly warning that the cookie is account authentication material equivalent to a login session. Users may paste sensitive session tokens into local tools, logs, or config files without understanding the takeover risk if those values are exposed. In a botting skill, this is especially dangerous because the cookie is central to account control.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The summary advertises complete core functionality while the roadmap acknowledges that a key dependency—full Douyin API integration—has not yet been implemented. This contradiction undermines informed consent for users and marketplace reviewers, and in a skill that automates account actions it can cause users to expose live accounts or cookies to unfinished code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill advertises scripts and configuration files that imply local file read/write behavior, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because users and hosting platforms cannot clearly assess or constrain what filesystem access the skill requires, increasing the chance of over-privileged execution or unintended data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill promotes automated monitoring of comments and automated messaging on a user's Douyin account but does not include a clear privacy, consent, or account-integrity warning. This is dangerous because such automation can expose user and commenter data, trigger unauthorized interactions, and create compliance or account-enforcement risk if operators are not clearly informed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The configuration example instructs users to place a Douyin session cookie directly in config.json without an explicit warning that this is sensitive authentication material. This is dangerous because cookies can grant direct account access if leaked through source control, backups, logs, or shared environments, potentially enabling account takeover or unauthorized actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The marketplace copy promotes continuous comment monitoring, automated replies, and private-message funneling without clearly warning users about platform enforcement, spam, consent, and privacy risks. In this skill context, automation against a social platform account can directly lead users to unsafe deployment practices, account restrictions, or abusive messaging behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The listing makes a privacy claim that it does not store chat records, while elsewhere advertising detailed logging and analytics. That inconsistency can mislead buyers about what user interaction data is retained, creating privacy, compliance, and trust risks if comment or message content is included in logs or statistics.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The sample API wrapper and usage examples perform state-changing actions such as posting comment replies and sending direct messages, but the document does not clearly warn users that running these calls will publish content and contact other users from their account. In the context of an auto-reply/DM growth skill, this increases the risk of unintended spam, abusive automation, reputation damage, and possible account enforcement if examples are copied without safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The troubleshooting guide instructs users to copy their browser Douyin cookie and pass it directly on the command line, but does not warn that cookies are authentication secrets equivalent to account credentials. This is dangerous because command-line arguments may be exposed through shell history, process listings, screenshots, logs, or copied support artifacts, increasing the risk of account takeover.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reset procedure includes deletion of config.json and stats.json, but it does not clearly warn that the action is destructive and will remove local configuration and accumulated statistics. While not a code-execution issue, it can cause accidental loss of operational data and force users to re-enter sensitive settings such as cookies, which increases operational and security risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings that force a specific language/locale for descriptions and CLI interaction. Under the policy, locale-specific behavior should either be optional for the user or clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring describes this file as a '数据统计分析工具' for analyzing auto-reply effectiveness and user interaction data, which implies read/report behavior. However, clear_stats() overwrites the stats file and resets counters, introducing destructive state modification beyond analysis/report generation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script accepts a Douyin session cookie directly as a command-line argument and stores it in plaintext JSON on disk. Command-line arguments are commonly exposed through shell history, process listings, and logging, so this creates a realistic risk of credential leakage and account takeover if the cookie is reused by an attacker.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s natural-language interface and instructions are entirely in Chinese, including the program description and user-facing usage/help text, with no indication that language choice is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file forces a specific language experience through all headings, instructions, and examples, with no indication that other language options are available. Under the stated policy, mandating one language without user opt-in can be a natural-language policy violation unless justified or optionalized.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations when a skill forces a specific language without user opt-in. This marketplace material appears to mandate Chinese-language interaction/documentation without stating that language support is optional or region-specific.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified as requests>=2.28.0, which allows installation of any newer version without ensuring a tested, fixed, or reproducible release. This creates supply-chain risk and makes builds non-deterministic; in a bot that monitors comments and sends messages, a vulnerable or incompatible future requests release could affect outbound HTTP handling or expose secrets used in API communication.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: Because requests is unpinned, it is impossible to verify whether deployment will use a version affected by known advisories, including issues involving credential leakage and request verification behavior. In this skill's context, the package likely handles DouyinBot API traffic and may transmit tokens, session data, or referral workflows, so using an affected version could expose credentials or weaken transport/security assumptions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.