ClawHub
Back to skill

Security audit

Douyin-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Douyin uploader, but it can publish to a live account by default while running Chromium with weakened browser protections and extra clipboard permissions.

Review this before installing if you use a real Douyin account. Use --no-publish when you want a draft, avoid running it as an admin/root user, keep the cookie file private, clear stored login data when finished, and be aware that the browser is configured with reduced sandboxing and unnecessary clipboard permissions.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
douyin-uploader.js:401
Finding

Chromium Security Sandbox Is Explicitly Disabled

Content
View full analysis

Vulnerability Details

File Location: douyin-uploader.js, lines 401–406
Vulnerability Type: Chromium sandbox disabled
Risk Level: High

Vulnerable Code

js
const browser = await puppeteer.launch({
    headless,
    slowMo: headless ? 0 : 50,
    args: [
        '--window-size=1400,900',
        '--no-sandbox',
        '--disable-setuid-sandbox',

Technical Analysis

The Puppeteer launch configuration passes both --no-sandbox and --disable-setuid-sandbox to Chromium. These options disable important process-isolation mechanisms for every browser session created by the skill, including login, cookie validation, and video upload sessions.

The browser processes remote web content from the Douyin Creator Platform and any resources loaded by that platform. If malicious content reaches the browser or an exploitable Chromium vulnerability is triggered, disabling the sandbox removes a major defense-in-depth boundary that would otherwise restrict a compromised renderer process.

This does not independently prove arbitrary code execution. Exploitation requires another browser or renderer vulnerability, but the configuration materially increases the consequences of such a vulnerability.

Attack Path

  1. The user invokes the login, session-check, or upload workflow.
  2. Puppeteer launches Chromium with its sandbox disabled.
  3. Chromium loads remote content from the Douyin Creator Platform and its page dependencies.
  4. Compromised page content, a malicious loaded resource, or a browser exploit compromises a renderer process.
  5. Because the Chromium sandbox is disabled, the attacker has a substantially easier path to executing actions with the privileges of the Node.js user.
  6. The attacker may then attempt to access local session data, readable files, or other resources available to that operating-system account.

Impact Assessment

Successful exploitation could expose the Douyin cookie file, Chromium profile data, and other files or ...[truncated 361 chars]

Remediation
View remediation

Remediation Suggestions

Remove --no-sandbox and --disable-setuid-sandbox and allow Chromium to use its standard security sandbox:

js
args: [
    '--window-size=1400,900',
    '--disable-blink-features=AutomationControlled',
    '--use-fake-ui-for-media-stream',
    '--use-fake-device-for-media-stream',
    '--disable-notifications'
]

Additionally:

  1. Run the skill under a dedicated, non-root operating-system account.
  2. Configure the deployment host or container so Chromium sandboxing is supported.
  3. Fail safely when the sandbox cannot initialize rather than silently disabling it.
  4. If an exceptional environment requires sandbox disabling, isolate the browser in a hardened container or virtual machine with:
    • no host filesystem mounts except the required video;
    • no access to host credentials or sockets;
    • dropped Linux capabilities;
    • a read-only root filesystem where practical;
    • a restrictive seccomp/AppArmor/SELinux profile;
    • network access limited to required Douyin endpoints.
  5. Document any residual risk if sandbox disabling remains necessary.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
douyin-uploader.js:416
Finding

Remote Origin Receives Unnecessary Clipboard Permissions

Content
View full analysis

Vulnerability Details

File Location: douyin-uploader.js, lines 416–425
Vulnerability Type: Excessive browser-origin permissions
Risk Level: Medium

Vulnerable Code

js
if (!headless) {
    const context = browser.defaultBrowserContext();
    // Only request permissions needed for video upload workflow
    await context.overridePermissions('https://creator.douyin.com', [
        'clipboard-read',
        'clipboard-write'
    ]).catch((error) => {
        console.error('Failed to override permissions for creator.douyin.com:', error instanceof Error ? error.message : String(error));
    });
}

Technical Analysis

The code grants clipboard-read and clipboard-write permissions to the entire https://creator.douyin.com origin whenever Chromium runs in non-headless mode. The audited upload implementation does not use the Clipboard API, so these permissions are not demonstrated to be necessary for login or video publication.

overridePermissions bypasses the browser's normal permission-prompt behavior for the specified origin. Consequently, scripts executing in that trusted origin may be able to read or modify clipboard content without the user making a contextual permission decision.

Exploitation requires script execution within the permitted origin, such as through a compromised platform resource, an origin-level injection vulnerability, or malicious content that obtains same-origin script execution.

Attack Path

  1. The user starts a non-headless login or upload session.
  2. The skill grants clipboard read and write permissions to https://creator.douyin.com.
  3. A compromised or injected script executes under that origin.
  4. The script invokes the Clipboard API without encountering the normal permission prompt.
  5. Clipboard contents are read and transmitted through the origin's network capabilities, or the clipboard is overwritten with attacker-controlled content.
  6. The user may subsequently paste exposed or attacker-sub ...[truncated 658 chars]
Remediation
View remediation

Remediation Suggestions

Remove the permission override because the audited workflow does not require clipboard access:

js
// Do not grant clipboard permissions to the remote origin.

If a future feature legitimately requires clipboard functionality:

  1. Prefer direct Puppeteer input methods such as page.keyboard.type() rather than the system clipboard.
  2. Grant only the specific permission that is required; do not grant both read and write access by default.
  3. Use a separate, short-lived browser context for the operation.
  4. Grant the permission immediately before use and clear the override immediately afterward with clearPermissionOverrides().
  5. Avoid retaining clipboard permissions throughout login and upload sessions.
  6. Add automated tests verifying that standard login, upload, and publication workflows function without clipboard permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill can automatically click publish and proceed through confirmation flows, which can cause irreversible posting to a live social-media account without a final explicit user approval at execution time. In the context of a content-publishing tool, unintended publication can create reputational damage, policy violations, or disclosure of sensitive material under the user's authenticated account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code persists authenticated Douyin session cookies to a local JSON file, enabling session reuse by anyone or any process that can read that file. Although the code attempts to chmod the file to 0600, there is no user-facing disclosure, no encryption at rest, and the cookie store is kept in a predictable location beside the skill code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill uploads the user-specified video to creator.douyin.com, which is a network transmission of user data to an external platform. The file's purpose implies uploading, but the code does not include a clear user-facing disclosure at the point of transmission about sending the file to Douyin.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The automation relies on Chinese placeholder/button text and uses Chinese-language runtime prompts such as 验证码, which effectively requires a Chinese locale/UI. The file does not document this as a justified region-specific constraint or offer any language/locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language description is presented as a Douyin/TikTok China uploader and includes only Chinese-language wording for part of the skill identity, indicating a China-specific language/locale constraint. The file does not offer a user language choice or explicitly document a justified locale limitation, which matches the policy category for forced language or locale behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file header uses Chinese for the script description, usage, and command list, which imposes a specific language on users. There is no indication that this skill is region-specific or that users can choose another language, so it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings in Chinese for the script description and usage, and the rest of the interface also presents localized output without any opt-in or alternative. Under the policy, forcing a specific language without user choice is a locale/language policy violation unless the constraint is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Using a caret range for puppeteer allows newer matching releases to be installed without explicit review, which can introduce supply-chain risk or unexpected vulnerable versions over time. In an automation skill that drives a browser and handles login sessions, dependency drift is more sensitive because a compromised or breaking browser automation library can affect authentication material and runtime behavior.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json
"manage": "node scripts/manage.js"
  },
  "dependencies": {
    "puppeteer": "^23.11.1"
  }
}

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The header comments use Chinese for the script name and usage text, which imposes a specific language on users without any visible opt-in or explanation that the skill is intended only for a Chinese-speaking or region-specific audience. This matches the policy category for language or locale constraints expressed in natural language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.