桃噗噗回复助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:28 AM UTC
• Version: 1.0.1

Overview

This skill is mostly what it claims to be, but it automates public Douyin account replies with unsafe browser and session-handling choices that need review.

Install only if you are comfortable with a tool that can act from an authenticated Douyin account and post public replies. Prefer manual review or draft mode, remove sandbox-disabling and anti-detection browser flags, protect or disable persisted login state, restrict navigation to Douyin Creator Center URLs, and avoid placing AI-generated reply text into executable browser JavaScript.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_comment_reply.js:118

Finding

Generated Reply Text Can Be Injected into Executable Browser JavaScript

Content

View full analysis

Remediation

View remediation

{ return sendReply(replyText); }, generatedReply); ``` 3. Prefer Playwright locator APIs, which treat input as data: ```javascript await replyInput.fill(generatedReply); await sendButton.click(); ``` 4. Remove the `__REPLY_TEXT__` execution pattern and the documented `sendReply('reply content')` pattern. 5. If browser evaluation source must be serialized, use a trusted static function and pass values through the tool's argument mechanism rather than manual quoting. 6. Validate generated replies before submission, including maximum length, control-character rejection, and content-policy checks. 7. Add tests containing quotes, backslashes, line separators, template-literal markers, and JavaScript-like text to ensure all reply content remains inert data. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/intent_helper_v2.js:252

Finding

Untrusted Platform Comments Are Directly Embedded into AI Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/browser_manager.js:359

Finding

Authenticated Browser Storage State Is Persisted in Plaintext

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/browser_manager.js:21

Finding

Chromium Sandbox Protections Are Explicitly Disabled

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/batch_monitor.js:157

Finding

Monitoring Targets and Browser Navigation Lack a Douyin Origin Allowlist

Content

View full analysis

t.id === videoId)) { console.log(`[BatchMonitor] Video ${videoId} is already monitored`); return videoId; } const target = { id: videoId, url: videoUrl, title: options.title || '', enabled: true, monitorDepth: options.monitorDepth || this.config.monitorDepth, lastCheck: null, addedAt: new Date().toISOString() }; this.targets.push(target); this.saveState(); console.log(`[BatchMonitor] Added video ${videoId} to monitoring targets`); return videoId; } ``` ```javascript const commentUrl = target.url.includes('comment') ? target.url : target.url.replace('/video/', '/comment/'); await this.page.goto(commentUrl, {waitUntil: 'networkidle'}); ``` From `scripts/video_list_fetcher.js`: ```javascript console.log('[VideoList] Navigating to Creator Center...'); await page.goto(config.contentManageUrl, {waitUntil: 'networkidle'}); ``` The comments and log messages above are translated into English; the URL-validation and navigation logic are unchanged. ### Technical Analysis `addTarget()` only checks whether the input contains a substring matching `video/`. It does not parse the URL or validate its scheme, hostname, port, credentials, or final destination. Consequently, a URL such as `https://attacker.example/video/test` satisfies the check, is persisted, transformed ...[truncated 2022 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (64)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

该代码的主要功能是“监控”和“提取”评论，而不是声明中的“自动回复”。它会通过浏览器页面访问视频/评论页面，抓取评论元素，识别新评论，并将监控目标和已处理评论持久化到本地 JSON 文件。虽然“监控评论”与描述的一部分相关，但描述中的核心能力——智能生成回复并自动执行回复——在此代码片段中完全不存在。此外，描述声称支持关键词匹配、敏感词过滤、评论分类、多账号管理，这些能力在代码中也没有体现。因此，该代码与声明用途存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该代码块只是底层浏览器生命周期管理器，属于支撑性基础设施，但如果将其作为该技能的实际代码代表，则与“抖音自动回复”这一声明存在明显不匹配。它确实涉及浏览器自动化和持久化登录，可能可被上层抖音自动回复逻辑复用，但本代码本身没有访问抖音创作者中心、抓取或监控评论、生成回复、执行回复操作，也没有实现描述中列出的评论处理能力。因此其实际主功能是浏览器管理，而非抖音自动回复。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个完整的“抖音自动回复”技能，核心能力应包括监控评论后生成并发送回复，以及若干治理/管理功能。实际代码只实现了读取当前页面 DOM、提取评论信息和视频标题，属于评论抓取/检测脚本。虽然“监控评论”中的一部分可由该脚本支撑，但其主要行为明显比声明窄得多，且缺少声明中的核心能力：没有任何回复动作、没有文本生成、没有关键词或敏感词处理、没有分类逻辑、没有账号管理。因此描述不能准确代表该代码块的实际行为，构成明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个面向抖音平台的完整自动回复系统，核心能力应包括平台接入、监控评论、自动回复执行，以及敏感词过滤和多账号管理等。而提供的代码只是一个辅助模块：定义若干关键词模式，识别消息属于询价、库存、砍价等意图，并生成固定回复模板。其主要用途更像电商客服/商品咨询回复助手，而非抖音自动回复技能的核心实现。虽然“关键词匹配”和“回复生成”与声明有部分表面重合，但缺失了声明中的关键平台能力与主要业务流程，因此属于明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

该代码块的功能范围明显小于声明描述。它确实覆盖了声明中的部分子能力，例如关键词匹配、敏感词过滤、评论分类，以及为AI回复生成提示词；但它没有任何与抖音相关的专用集成代码，也没有浏览器自动化、登录、页面监听、API调用、评论抓取、回复提交或账号切换等实现。主处理函数 analyzeComment 只是对传入的 comment 文本做分析并输出 recommendation，不会连接外部平台或执行自动回复。因此，声明将其描述为完整的“抖音自动回复技能”并包含平台自动化、多账号管理等能力，和该代码块的实际行为存在实质性不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该代码片段的主功能是日志系统，而不是抖音自动回复。虽然日志文件名和部分便捷函数名称（如 logReplySent、logSensitiveDetected、logMonitor）表明它服务于某个“抖音回复”项目，但这些只是辅助记录功能，不能等同于实际执行自动回复技能。根据评估标准，支持性实现细节本可不算不匹配，但这里代码片段的主要行为与声明的主要用途存在明显偏差：声明强调浏览器自动化、评论监控、智能回复与多账号等核心业务能力，而代码只实现日志记录、审计与查询。此外，代码还具备文件系统日志和审计日志查询等声明未提及的能力。因此应判定为描述与实际行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的核心功能是“抖音评论自动回复”，重点应包括读取评论、分析内容、生成并发送回复。给出的代码片段完全没有处理评论、回复生成、发布回复或客服逻辑，而是专注于登录状态管理：通过选择器、URL 和 storage 判断是否登录，定时发送鼠标事件保活，会话丢失后刷新页面或跳转创作者中心尝试恢复。这不是单纯的底层辅助细节，而是一个独立模块，其主要目的与声明的主功能明显不同。因此描述与代码行为存在显著不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个完整的抖音自动回复技能，核心能力应包括监控评论、分析内容并生成/发送回复。但实际代码只是一个“评论一键检查”脚本：读取当前页面DOM，收集评论作者、时间、内容及是否已回复状态，输出待处理评论列表。它没有任何调用模型生成回复、填写回复框、提交回复、账号切换、敏感词处理或分类逻辑。虽然‘监控评论/检查待处理评论’与声明场景部分相关，但主功能明显弱于且不同于声明的自动回复系统，因此属于描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

该代码块的主要目的与声明严重不一致。声明描述的是一个完整的抖音评论自动回复系统，而实际代码仅负责“什么时候执行某动作”的时间调度控制，围绕 schedule_config.json 做读取、判断当前动作、查找下一自动回复时段以及更新调度规则。虽然其中出现了 auto_reply 动作名称，但这只是调度标记，不等于实现了抖音自动回复本身。代码访问的资源也与声明不符：仅访问本地文件系统配置，而非抖音站点、浏览器或评论数据。因此应判定为明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的是一个较完整的“抖音自动回复”系统，包含监控、分析、内容生成、过滤、分类和多账号管理等上层能力。但实际代码只是一个页面内辅助函数：查找当前可见的可编辑输入框，填入传入的回复文本，触发事件并点击发送按钮，再检查是否出现验证弹窗或输入框是否清空。它没有连接创作者中心、没有监控评论、没有分析评论内容、没有生成回复、没有过滤敏感词、没有分类逻辑，也没有多账号相关代码。虽然“发送抖音评论回复”与声明主题相关，但其实际能力远小于声明，构成明显的描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个功能较完整的“抖音自动回复”技能，包含评论监听、智能生成、过滤与管理等高层能力；但实际代码只是一个低层发送脚本，用于把外部提供的 replyText 填入当前页面的回复框并点击发送。虽然“发送抖音评论回复”与声明主题相关，但其实际能力远小于声明范围，且核心宣称能力均未在该代码中体现。因此描述与代码行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述的核心能力是“抖音评论自动回复”，重点应包括读取评论、分析评论并发送回复。但该代码块仅导航到抖音创作者中心内容管理页，抓取和缓存视频列表数据，并筛选出适合监控的视频目标。虽然这可能是更大系统中的前置步骤，但就本代码块本身而言，其主要目的与声明的核心行为存在明显差异：它不处理评论文本，不生成回复，也不执行回复动作。因此应判定为描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.

md

### scripts/check_comments_v2.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.

md

### scripts/intent_helper_v2.js

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file hard-codes "locale": "zh-CN" and "timezoneId": "Asia/Shanghai". This creates a natural-language and locale policy concern because the skill enforces a specific regional setting without any visible opt-in, user choice, or stated region-specific justification.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/intent_helper_v2.js (reported line 271)May include surrounding context.

js

other: `用户评论："${comment}"\n请生成一个积极、大方、热情的回复。回复要自然亲切，不超过100字。`
  };
  
  return prompts[classification.category] || prompts.other;
}

// ==================== 导出 ====================

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill document describes capabilities involving browser automation, local configuration/state files, and AI model settings, but it does not declare any explicit tool scope or permissions boundaries. In a skill ecosystem, missing scope declarations weakens reviewability and can allow broader-than-expected access to environment-backed capabilities, increasing the chance of unintended data exposure or unsafe execution context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document describes login-state persistence and multi-account management but does not clearly disclose that session/account state may be stored locally. Persistent session artifacts can expose account access to other local users, backups, logs, or malware if stored insecurely, and the risk is amplified by support for multiple accounts in one environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promotes automatic public replying from the user's Douyin account but does not prominently warn that generated content will be posted publicly in the user's name. That omission increases the risk of reputational harm, accidental policy violations, or harmful/incorrect statements being published without sufficiently informed consent, especially because the skill is explicitly designed to automate interaction at scale.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config/ai_config.json (reported line 12)May include surrounding context.

json

"deepseek": {
      "name": "DeepSeek",
      "provider": "deepseek",
      "apiUrl": "https://api.deepseek.com/v1/chat/completions",
      "model": "deepseek-chat",
      "enabled": false,
      "apiKey": null

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config/ai_config.json (reported line 20)May include surrounding context.

json

"openai": {
      "name": "OpenAI GPT-4o",
      "provider": "openai",
      "apiUrl": "https://api.openai.com/v1/chat/completions",
      "model": "gpt-4o",
      "enabled": false,
      "apiKey": null

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config/ai_config.json (reported line 28)May include surrounding context.

json

"anthropic": {
      "name": "Anthropic Claude",
      "provider": "anthropic",
      "apiUrl": "https://api.anthropic.com/v1/messages",
      "model": "claude-sonnet-4-20250514",
      "enabled": false,
      "apiKey": null

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The system prompt is written entirely in Chinese and instructs the assistant to act as a Douyin account operations assistant, implicitly constraining output language and locale-specific behavior. The file does not offer any user opt-in, language selection, or documented justification for enforcing this language/locale policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This is a manifest/config file, so SQP-1 applies. The configuration fixes behavior to zh-CN and Asia/Shanghai without indicating that the skill is only meant for a China-specific context, which makes activation/use context insufficiently specific and could cause unintended behavior outside the intended scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The browser is explicitly configured with anti-automation evasion flags such as disabling AutomationControlled and infobars, which are not necessary for a normal comment auto-reply workflow and instead help conceal automated behavior from the target platform. In the context of a Douyin automation skill, this increases the likelihood of policy evasion, deceptive interaction with the platform, and stealthy misuse at scale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.