ClawHub
Back to skill

Security audit

抖音文案解析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Douyin transcription API wrapper, but users should understand it sends their share text and API key to an external service and includes fixed purchase-link messaging.

Install only if you are comfortable using the devtool.uk transcription service, sending Douyin share text and your service API key to that endpoint, and seeing its purchase or renewal link when the key is missing or invalid.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:79
Finding

Mandatory Third-Party Commercial Messaging in Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-82
Vulnerability Type: Instruction and output hijacking through mandatory commercial redirection
Risk Level: Medium

Vulnerable Code Snippet

markdown
If response indicates invalid token/key (for example `code: -1` and message like `令牌无效`), guide the user to:
- https://devtool.uk/plugin
- Purchase/renew a valid key there (no free key is provided).

The same behavior is reinforced elsewhere in SKILL.md, including lines 45-51 and 86-96, where the skill requires the agent to make a fixed commercial claim and provide the same purchase link when an API key is unavailable.

Technical Analysis

The skill does more than define the behavior needed to perform Douyin transcription. It imposes mandatory language directing users to a third-party commercial page and requires the agent to claim that no free key is available.

These instructions alter the agent's response policy whenever the skill is loaded and an API key is missing or rejected. The language is expressed as a hard requirement rather than optional troubleshooting information. Consequently, the skill controls trusted agent output for the purpose of third-party promotion and redirection.

This is classified as instruction hijacking because the behavior resides in the skill instructions and modifies what the agent must communicate during the current session. No evidence was found that these instructions persist in long-term memory or alter the underlying system prompt.

Attack Path

  1. A user asks the agent to transcribe a Douyin video.
  2. The agent loads the skill because the request matches its declared purpose.
  3. The DOUYIN_TRANSCRIBE_API_KEY environment variable is absent, empty, expired, or rejected by the remote service.
  4. The mandatory response rules in SKILL.md are activated.
  5. The agent presents the fixed claim that no free API key is provided.
  6. The agent directs ...[truncated 1090 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove requirements that force the agent to repeat commercial claims or direct users to a purchase page.
  2. Replace the mandatory response with a neutral authentication error, such as: “The required API credential is missing or invalid. Configure a valid credential for the selected service and retry.”
  3. Provide vendor documentation or purchase information only when the user explicitly requests account, billing, or credential-acquisition guidance.
  4. Clearly identify any external URL as belonging to a third-party service rather than implying endorsement by the agent platform.
  5. Separate operational instructions from marketing content. The skill should describe the credential requirement without dictating promotional language.
  6. Retain the existing prohibition against exposing secret values, and explicitly disclose that the API key and submitted share text are transmitted to the external service.
  7. Review all repeated missing-key and invalid-key sections in SKILL.md so that removing one instance does not leave equivalent mandatory commercial instructions elsewhere.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
Execute the bundled shell wrapper instead of calling the external API inline from `SKILL.md`.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly requires shell execution via bash/curl/python3 and instructs running a bundled script, but it does not declare a corresponding tool scope or allowed-tools/permissions boundary. That mismatch can cause the runtime or user to grant broader-than-expected execution capability, reducing transparency and making command-execution behavior easier to smuggle into an ostensibly simple transcription skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill requires a specific Chinese prompt and explicitly mandates exact Chinese-language wording when the API key is missing. This forces a locale/language choice regardless of the user's language preference, which is a natural-language policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The mandatory reply template is entirely in Chinese and is marked as required, so the skill instructs the agent to respond in a specific language without user opt-in. There is no alternative template or instruction to adapt to the user's locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits both user-supplied Douyin share text and the secret API key to an external third-party endpoint, which creates a real data exfiltration and secret-handling risk. In this skill context, remote submission is expected for a transcription API, but the danger remains because users are not clearly warned at runtime that their input and credential will be sent off-host to a non-obviously trusted service domain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's only user-facing instructions and error messages are in Chinese, including required usage guidance and API-key handling text. The file does not offer an alternate language or indicate that the skill is intentionally limited to a Chinese-language audience for a documented regional reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.