Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/dy-publish.js --ep 02 --time "2026-10-15 07:00"
Security audit
抖音自动发布
Security checks for vulnerabilities and agentic risk
Overview
This skill fits Douyin publishing, but its cleanup can delete unintended videos and its instructions require disabling sandbox protection.
Review before installing. Preserve sandbox protection and use a dedicated browser profile. Avoid DEL=1 until deletion checks exact video identity and scheduled status. Configure private output paths and make screenshots optional. Publishing dry runs still upload the video and save a screenshot. Verify actual account results before repeating failed batch items.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (24)
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/dy-publish.js --file a.mp4 --title "标题" --desc "正文" \
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/dy-publish.js --ep 02 --time "2026-10-15 07:00" --dry
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本逐条调用 `dy-publish.js`，日志写 `dy-batch.log`，末尾输出成功/失败计数。
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/dy-publish.js` — 主发布脚本
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md zsh scripts/batch-dy.sh
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md START_EP=30 END_EP=30 START_DAY=29 START_HOUR=07 zsh scripts/batch-dy.sh
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/batch-dy.sh` — 批量双更排期
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/dy-status-list.js 全部 # 概览
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/dy-status-list.js` — 按审核状态快速筛
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/dy-queue.js 全部 # 卡片式滚动累积抓取（虚拟列表，必须用这个）
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 8. **列表是虚拟滚动**：`body.innerText` 一次只渲染约 12 条，必须滚动累积去重（`dy-queue.js`）。
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/dy-queue.js` — 虚拟列表滚动累积抓取（对账主力）
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md NAME="怎么活得更好" DESC="系列简介" COVER=/path/cover.png node scripts/dy-create-collection.js
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/dy-create-collection.js` — 建合集
The troubleshooting instructions recommend disabling the Bash sandbox without warning about the security implications.
High
- Category
- Output Handling
- Confidence
- 98% confidence
- Finding
The troubleshooting table recommends setting
dangerouslyDisableSandbox: trueas a routine fix for unresponsive clicks, without establishing that sandboxing caused the problem or explaining the security consequences. If honored by the execution environment, this removes an isolation boundary and can allow compromised scripts or injected commands to access host resources beyond the sandbox. Browser automation involving an authenticated publishing account increases the potential consequences, although this file does not itself demonstrate exploitation or malicious intent.- Content
Duplicate-reservation cleanup can delete any keyword-matching work without checking its scheduling status or whether it is a duplicate.
High
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
The script selects the IDX-th visible deletion control after a keyword search without verifying the work's identity, scheduled status, or duplication. With DEL=1, it can therefore delete a legitimate, potentially already-published work using the authenticated account; the duplicate-cleanup context makes this particularly dangerous because users may reasonably expect only redundant scheduled posts to be affected. The default dry-run gate reduces accidental execution but does not validate the target when deletion is enabled.
- Content
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
The workflow requires disabling the Bash sandbox without warning about the loss of isolation.
Medium
- Category
- Output Handling
- Confidence
- 97% confidence
- Finding
The skill explicitly requires dangerouslyDisableSandbox: true without explaining the loss of isolation or limiting the exception. Running its scripts outside the sandbox increases the potential consequences of compromised dependencies or script behavior, particularly because the workflow controls a browser logged into an account with publishing and deletion capabilities; the referenced scripts were not supplied, so their safeguards cannot be verified.
- Content
Undisclosed screenshots save account-page content to disk, including in dry-run mode.
Medium
- Category
- Output Handling
- Confidence
- 94% confidence
- Finding
The script saves screenshots to fixed local PNG paths without a comment, prompt, or log disclosing that account-page content will be persisted. The first screenshot is written before the dry-run check, so even a non-deleting run creates or overwrites a file that may contain private account information.
- Content
The script saves a screenshot of the creator account page without disclosing the capture or local file write.
Medium
- Category
- Output Handling
- Confidence
- 91% confidence
- Finding
The screenshot can persist account content visible on the page to a fixed local PNG file, potentially overwriting an existing capture. No prompt, log, or explanatory comment discloses this action; the stated duplicate-title search purpose does not clearly imply saving screenshots.
- Content
The script silently saves a screenshot of the authenticated creator-management page to disk.
Medium
- Category
- Output Handling
- Confidence
- 94% confidence
- Finding
The screenshot creates or overwrites a local PNG that may contain private creator-dashboard information. Unlike the stated status-filtering and list-extraction actions, this persistent capture has no accompanying comment, confirmation, or user-facing log disclosing the file write.
- Content
Page screenshots are silently written to fixed local paths.
Low
- Category
- Output Handling
- Confidence
- 97% confidence
- Finding
The script automatically saves screenshots of an authenticated creator page to predictable local paths, potentially retaining unpublished collection details or visible account information without explicit consent. The first screenshot is saved even in DRY mode; although these appear to be debugging artifacts rather than malicious collection, backups, synchronization, or principals with access to the files could expose their contents. No external transmission or broad file permissions are demonstrated, so the risk is limited and conditional.
- Content
Creator-page screenshots are saved locally without disclosure.
Low
- Category
- Output Handling
- Confidence
- 95% confidence
- Finding
Lines 229 and 267 write screenshots of the creator page to fixed local paths without a confirmation, log message, or explanatory comment disclosing these writes. This persists page content beyond the publishing workflow, and the first screenshot is saved even during a dry run.
- Content