ClawHub
Back to skill

Security audit

抖音视频发布

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but it can publish live Douyin posts through a logged-in account and automatically adds a fixed location without explicit user confirmation.

Install only if you are comfortable letting the agent operate a logged-in Douyin creator session. Before use, require the agent to show the exact account, video file, title, hashtags, cover, and location, and only click publish after you explicitly approve. Remove or override the fixed 'Suzhou Center' location unless that is actually the location you want attached.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:37
Finding

Unconsented Fixed Location Metadata Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–39
Vulnerability Type: Unconsented location metadata injection
Risk Level: Medium

Vulnerable Code Snippet:

markdown
### 6. 添加位置
- 找到「添加位置」按钮
- 搜索「苏州中心」并选择

The behavior is further reinforced at line 54:

markdown
- 地理位置选择「苏州中心」可提升曝光

Technical Analysis

The skill unconditionally instructs the browser automation agent to attach “Suzhou Center” as the video's location. It does not verify that this location is accurate, derive it from user-provided publishing parameters, or request confirmation before adding it.

Location metadata is not required for the skill's declared core function of publishing a video. Automatically attaching a fixed location can therefore modify the user's post beyond the reasonable scope of a generic publishing request. The assigned location may be misleading and may reveal or imply sensitive geographic information.

This issue does not grant arbitrary system access, execute code, or escalate operating-system privileges. Its scope is limited to content and metadata that the skill can publish through the user's authenticated Douyin creator session.

Attack Path

  1. A user asks the agent to publish a video to Douyin without specifying a location.
  2. The skill opens the Douyin creator interface using the authenticated browser session.
  3. After uploading the video and entering its other metadata, the agent follows the fixed instruction to search for “Suzhou Center.”
  4. The agent selects that location without validating its accuracy or obtaining the user's consent.
  5. The video is published with inaccurate or unwanted location metadata under the user's account.
  6. Viewers or platform systems may interpret the location as relating to the user, recording site, or subject of the video.

Impact Assessment

The skill can cause posts made through the authenticated Douyin creator account to contain u ...[truncated 445 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the fixed instruction to select “Suzhou Center.”
  • Default to publishing without location metadata.
  • Add a location only when the user explicitly supplies one.
  • Present the selected location to the user and request explicit confirmation before publication.
  • Validate that the chosen location matches the user's request rather than inferring it from engagement or exposure goals.
  • Include location in the final pre-publication checklist so the user can review, change, or remove it.
  • Treat location metadata as optional and potentially privacy-sensitive information.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad enough that a user request like '发抖音' or '发布视频到抖音' could activate a skill that performs a real public posting action without clear confirmation boundaries. In the context of browser automation against a logged-in creator account, accidental activation can directly cause unauthorized or unintended publication to a public platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill omits an explicit warning that publishing is a public, hard-to-reverse action that can affect the user's brand, privacy, and account state. Because the workflow culminates in clicking a live '发布' button and even encourages post-publish verification, the lack of a strong warning and confirmation materially increases the risk of accidental public posting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.