ClawHub
Back to skill

Security audit

dy-video-to-text

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Douyin transcription and download purpose is clear, but its scripts can make requests to arbitrary user-supplied URLs before validating that they are Douyin links.

Review before installing. Only use this with trusted Douyin links, avoid running it in environments with access to internal services, and prefer an isolated virtual environment with pinned dependencies. Be aware that transcription sends the video URL and API key to Alibaba Cloud and downloading writes video files locally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/douyin_parse.py:35
Finding

Unrestricted User-Supplied URL Requests Enable Blind SSRF

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/install_deps.sh:11
Finding

Unpinned Dependencies Are Installed into User or System Python Environments

Content
View full analysis
/dev/null; then uv pip install --system requests dashscope 2>/dev/null \ || uv pip install requests dashscope elif command -v pip3 &> /dev/null; then pip3 install --user requests dashscope 2>/dev/null \ || pip3 install --break-system-packages requests dashscope 2>/dev/null \ || pip3 install requests dashscope elif command -v pip &> /dev/null; then pip install --user requests dashscope 2>/dev/null \ || pip install --break-system-packages requests dashscope 2>/dev/null \ || pip install requests dashscope else ``` ### Technical Analysis The installer requests `requests` and `dashscope` without exact versions or package hashes. Each installation can therefore resolve to different package artifacts over time. A compromised upstream release, account takeover, repository compromise, or future malicious dependency could execute package installation logic and runtime code with the invoking user's privileges. The installer also attempts `uv pip install --system` and falls back to `pip --break-system-packages`. These modes can modify the host's shared Python environment rather than an isolated environment belonging only to the Skill. This exceeds the minimum privilege needed to run two Python dependencies and can overwrite or conflict with packages used by other applications. Redirecting installation errors to `/dev/null` also obscures useful security and compatibility information, making it harder for users to understand which privileged fallback was selected. ### Attack Path 1. A user follows the documented setup procedure and runs `bash scripts/install_deps.sh`. 2. The package manager resolves mutable, unpinned ver ...[truncated 1446 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding includes a real security issue: the skill documents access to DASHSCOPE_API_KEY and outbound calls to Douyin and Alibaba Cloud, yet no explicit permissions/tool scope are declared. Even if the 'download not implemented' portion is likely a false positive, the undeclared secret and network usage can lead to unreviewed data exfiltration or policy bypass in environments that rely on manifest-declared capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding includes a real security issue: the skill documents access to DASHSCOPE_API_KEY and outbound calls to Douyin and Alibaba Cloud, yet no explicit permissions/tool scope are declared. Even if the 'download not implemented' portion is likely a false positive, the undeclared secret and network usage can lead to unreviewed data exfiltration or policy bypass in environments that rely on manifest-declared capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding includes a real security issue: the skill documents access to DASHSCOPE_API_KEY and outbound calls to Douyin and Alibaba Cloud, yet no explicit permissions/tool scope are declared. Even if the 'download not implemented' portion is likely a false positive, the undeclared secret and network usage can lead to unreviewed data exfiltration or policy bypass in environments that rely on manifest-declared capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding includes a real security issue: the skill documents access to DASHSCOPE_API_KEY and outbound calls to Douyin and Alibaba Cloud, yet no explicit permissions/tool scope are declared. Even if the 'download not implemented' portion is likely a false positive, the undeclared secret and network usage can lead to unreviewed data exfiltration or policy bypass in environments that rely on manifest-declared capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This finding includes a real security issue: the skill documents access to DASHSCOPE_API_KEY and outbound calls to Douyin and Alibaba Cloud, yet no explicit permissions/tool scope are declared. Even if the 'download not implemented' portion is likely a false positive, the undeclared secret and network usage can lead to unreviewed data exfiltration or policy bypass in environments that rely on manifest-declared capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This finding includes a real security issue: the skill documents access to DASHSCOPE_API_KEY and outbound calls to Douyin and Alibaba Cloud, yet no explicit permissions/tool scope are declared. Even if the 'download not implemented' portion is likely a false positive, the undeclared secret and network usage can lead to unreviewed data exfiltration or policy bypass in environments that rely on manifest-declared capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares external network use and environment variable access in metadata (requires.env, external endpoints, and API-key-driven transcription) but does not declare an explicit tool scope such as permissions or allowed tools. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may not realize the skill can access secrets and send user data to third parties.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description includes broad triggers such as 'use when user shares a Douyin link' or 'needs to extract text from Chinese short videos,' which could cause the agent to invoke a networked, file-writing, or API-consuming workflow in situations where the user did not explicitly request those actions. In a skill that can contact third parties and consume an API key, over-broad activation increases the risk of unintended data disclosure, surprise downloads, or unnecessary paid API usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest explicitly advertises speech-to-text extraction and watermark-free video downloading but does not warn users that shared Douyin links, video content, and extracted audio/transcripts may be sent over the network to third-party services such as Alibaba Cloud Bailian ASR. This creates a real privacy and transparency issue because users may submit videos containing personal, copyrighted, or otherwise sensitive material without understanding that external processing and content retrieval occur.

Content

No source excerpt is available for this finding.

Tainted flow: 'page_url' from requests.get (line 47, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/douyin_download.py (reported line 49)May include surrounding context.

python
video_id = share_response.url.split("?")[0].strip("/").split("/")[-1]
    page_url = f'https://www.iesdouyin.com/share/video/{video_id}'

    response = requests.get(page_url, headers=HEADERS, timeout=15)
    response.raise_for_status()

    pattern = re.compile(

Tainted flow: 'page_url' from requests.get (line 52, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/douyin_extract_text.py (reported line 54)May include surrounding context.

python
video_id = share_response.url.split("?")[0].strip("/").split("/")[-1]
    page_url = f'https://www.iesdouyin.com/share/video/{video_id}'

    response = requests.get(page_url, headers=HEADERS, timeout=15)
    response.raise_for_status()

    pattern = re.compile(

Tainted flow: 'page_url' from requests.get (line 45, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/douyin_parse.py (reported line 47)May include surrounding context.

python
video_id = share_response.url.split("?")[0].strip("/").split("/")[-1]
    page_url = f'https://www.iesdouyin.com/share/video/{video_id}'

    response = requests.get(page_url, headers=HEADERS, timeout=15)
    response.raise_for_status()

    pattern = re.compile(

Static analysis

No suspicious patterns detected.