抖音账号诊断宗师

• Outcome: Review
• Latest audit: Aug 6, 2026 · 2:40 AM UTC
• Version: 1.0.2

Overview

The skill is mostly aligned with Douyin account diagnosis, but it ships a hardcoded RedFox API key and sends account lookups to RedFox with limited consent and privacy detail.

Install only if you are comfortable with queried Douyin nicknames or IDs, and returned profile/recent-content data, being processed through RedFox. Prefer configuring your own revocable REDFOX_API_KEY and avoid relying on the embedded shared key. Treat reports as potentially containing business-sensitive account intelligence, especially for competitor or partnership screening workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises automatic access to a backend service and optional use of an API key, but it does not declare the sensitive capabilities implied by environment access, network use, and possible file output. Undeclared capabilities reduce transparency and informed consent, making it harder for users and hosting platforms to understand that external data retrieval and credential handling occur.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: A mismatch between the stated behavior and the actual behavior is dangerous because users may authorize a limited six-dimension diagnostic workflow while the skill also sends data to an external service, may rely on a built-in default API key, and produces additional outputs not disclosed in the description. Hidden external-service use and undisclosed data processing create consent, privacy, and supply-chain risks, especially when analyzing third-party account data.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The example code prints part of the API key to stdout, which leaks credential material into console logs, CI logs, terminal history captures, or monitoring systems. Even partial secret disclosure weakens secrecy, aids correlation of which credential is in use, and normalizes unsafe secret-handling patterns for downstream users of the skill.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The script contains a hardcoded RedFox API key and uses it as a fallback whenever the caller does not supply their own credential. Embedding reusable third-party credentials in distributed code is dangerous because anyone with access to the skill can extract and abuse the key, causing unauthorized API consumption, billing loss, quota exhaustion, and possible account suspension for the key owner.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The usage guidance says users can simply describe the account in natural language with no commands to memorize, which creates a broad invocation surface and raises the chance that unrelated requests containing similar wording will trigger the skill unintentionally. That can cause over-collection of third-party account data, unexpected external API calls, and incorrect routing of user intent to this skill when the user did not explicitly request account diagnosis.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The example trigger phrase about evaluating whether an account is worth collaborating with is broad enough to overlap with ordinary business evaluation requests, so the skill may activate even when the user did not intend a Douyin-specific data pull. In this context, unintended activation is more concerning because the skill fetches external profile and recent content data, potentially exposing or processing account information without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The README says users can invoke the skill with natural language directly and does not define clear activation boundaries, increasing the chance the skill is triggered from ordinary conversation that merely mentions Douyin account analysis. In agent environments, overly broad triggers can cause unintended external data access or tool execution without the user clearly intending to run this specific skill.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example phrases are broad, everyday requests like '分析这个抖音号' and '评估一下这个账号值不值得合作', which can easily appear in normal discussion and overlap with general assistant behavior. This makes accidental or prompt-injected activation more likely, potentially causing unintended retrieval of third-party account data and report generation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill description does not clearly warn users that it fetches account and recent-work data from an external backend and may present detailed account information in the generated report. Without a clear notice, users may unintentionally submit third-party identifiers or expose sensitive operational data without understanding the data-sharing implications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs sending Douyin account identifiers and related profile data to an external third-party endpoint, but it provides no privacy notice, consent requirement, retention statement, or data-handling constraints. In the context of an account-diagnosis skill, this can expose personal or quasi-personal data to a remote service without clear user awareness, increasing privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow directs the agent to collect and transmit extensive Douyin account and recent content data to a third-party API, but it does not require any user-facing notice, consent, or minimization before sharing that data externally. Even if some of this data is public platform data, sending it to an external service can create privacy, compliance, and trust risks, especially when users may not realize their query triggers off-platform data processing.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Disclosing even a truncated API key to the console exposes sensitive credential data to anyone with access to logs or shared terminal output. While not a full key leak, it still reveals secret structure and can facilitate operational mistakes, log retention exposure, or cross-system credential identification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends the user-supplied Douyin nickname or account ID, along with a source tag identifying the skill, to an external API endpoint without any explicit notice or consent flow. In a skill context this increases privacy risk because users may believe analysis is local, while their queried identifiers are actually disclosed to a third party and can be logged, profiled, or retained externally.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code reads a credential from the environment and silently falls back to an embedded API key, with no warning to the operator that a shared secret will be used. The main danger is not the environment access itself, but the insecure credential-handling design: silent fallback obscures secret usage, encourages dependence on a leaked shared key, and makes downstream misuse harder to detect or attribute.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.