ClawHub
Back to skill

Security audit

Douyin Dedup

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it removes/remixes watermarked videos and can contact unexpected URLs if given a crafted link.

Review before installing. Use it only for videos you have rights to process, expect it to download remote media and write processed MP4 files under ~/video-dedup/output, and avoid running it in an environment with sensitive internal network access until URL validation is tightened.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dedup.py:88
Finding

Insufficient URL Validation Enables Server-Side Requests to Untrusted Destinations

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documented behavior does not fully match the detected capabilities: the skill appears to rely on undisclosed network access, supports broader processing modes than described, and overstates or misstates aspects of the deduplication pipeline. Description-to-behavior mismatches are dangerous because they reduce informed consent, hide operational reach, and can mask unexpected data handling or automation beyond what the user intended.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises shell, network, and file-writing behavior via its documented command and workflow, but it declares no explicit tool scope or permissions. This creates a least-privilege and transparency problem: users and the platform cannot readily assess or constrain what the skill is allowed to access before it downloads content and writes output files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description explains how to run the tool and where output is stored, but it does not clearly warn users that remote media will be downloaded and processed files will be written to local disk. This is risky because it can lead to unexpected storage consumption, unanticipated persistence of potentially sensitive or copyrighted content, and reduced user awareness about local side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains natural-language strings and documentation entirely in Chinese, including the top-level description and later user-facing console messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the tool is clearly documented as region- or locale-specific, which is not stated here.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is explicitly framed as a tool to download Douyin videos, remove watermarks, and apply transformations for 'deduplication' and repost-evasion. In this context, the danger is not a memory-safety bug but harmful functionality: it operationalizes content theft, attribution removal, and anti-abuse evasion against a third-party platform, increasing legal, policy, and abuse risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dedup.py (reported line 60)May include surrounding context.

python
def run_cmd(cmd: list, desc: str = "") -> str:
    """执行命令"""
    print(f"[RUN] {desc or ' '.join(cmd[:3])}...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"[ERROR] {desc} failed:\n{result.stderr[-800:]}")
        raise RuntimeError(f"{desc} failed")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dedup.py (reported line 74)May include surrounding context.

python
def run_cmd(cmd: list, desc: str = "") -> str:
    """执行命令"""
    print(f"[RUN] {desc or ' '.join(cmd[:3])}...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"[ERROR] {desc} failed:\n{result.stderr[-800:]}")
        raise RuntimeError(f"{desc} failed")

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring for create_and_shuffle_segments states that the video will be split into multiple segments and their order shuffled, which is central to the described 'deep remix dedup' behavior. However, the function later prints '保持原始顺序' and returns segments without any shuffling, so the inline documentation materially contradicts the actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

All user-facing natural-language instructions and behavior description are presented only in Chinese, with no indication that other languages are supported or that Chinese is a justified requirement. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The user-facing progress output announces a step to split and shuffle video segments, which communicates a specific transformation being performed. In reality, create_and_shuffle_segments preserves the original segment order, so this runtime messaging contradicts the code's true behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.