douban-monitor

• Outcome: Review
• Latest audit: Jul 28, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Douban/TMDB monitor, but a default run can automatically commit and push generated data to GitHub without a per-run confirmation.

Install this only in a dedicated repository or worktree. Set auto_git_push=false or DOUBAN_MONITOR_NO_PUSH=1 unless you intentionally want generated data under data/, detail/, reports/, and posters/ committed and pushed to the configured Git remote. Review the Git remote and generated files before enabling push, and use least-privilege TMDB and GitHub credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not script_path.exists():
            continue
        log_kv("运行", script_name)
        result = subprocess.run(
            [python, str(script_path)],
            cwd=str(project_root),
            capture_output=True, text=True,

• Confidence: 84% confidence
• Finding: result = subprocess.run( [python, str(script_path)], cwd=str(project_root), capture_output=True, text=True, )

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This skill both executes local helper scripts and performs `git pull`, `commit`, and `push`, causing code execution and external state-changing network operations beyond simple monitoring. In a skill context with unclear provenance, that is dangerous because it can run attacker-modified repository code and publish repository contents or generated artifacts to a remote without explicit approval.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The script executes additional local Python scripts and then stages, commits, and pushes repository changes automatically. That creates a supply-chain and integrity risk: any modified helper script or generated content can cause unintended code execution or exfiltration, and automatic push publishes changes externally without explicit approval.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that step 8 will automatically commit and push generated files to GitHub, but it does not prominently warn users that locally generated data may be published to a remote repository. In this skill's context, the generated files can include monitoring results, favorites-derived details, reports, and other locally produced artifacts, so users may unintentionally expose private or undesired data if auto-push is enabled by default.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill clearly performs local file writes and, in one operating mode, stages and pushes generated artifacts to GitHub, but the description does not present this as an explicit user-facing warning. That omission matters because users may invoke the skill expecting read-only monitoring behavior while it actually mutates local state and can publish data externally, increasing the risk of unintended repository changes or data exposure.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill depends on outbound HTTP requests to third-party services (Douban Rexxar API and TMDB) but does not surface this as an explicit warning to the user. This can create privacy, compliance, and operational surprises, especially in restricted environments where external network access, API usage, or traffic to those domains must be reviewed or approved.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The notes state that data and reports under `data/` and `reports/` are automatically committed and pushed to Git after each run, but provide no user-facing disclosure, confirmation step, or scope controls. In an agent skill, this can lead to unintended publication of generated content, scraped data, or repository modifications, especially if the user does not expect networked write actions to a remote repository.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document describes outbound requests to Douban and TMDB APIs, including authenticated access using TMDB credentials, without warning that the skill will transmit requests and potentially use sensitive tokens. In an agent context, undisclosed network access and credential use can surprise users, expose operational metadata to third parties, and increase the risk of accidental secret misuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill writes repository data, commits changes, and performs a git push without any user-facing warning, confirmation, or dry-run safeguard. In an agent setting, silent state-changing and publication behavior can unexpectedly alter a repo and disclose generated content to a remote origin.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.