Security audit

抖音评论自动回复

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can automatically post public Douyin replies from a saved login session without a required preview or confirmation.

Review before installing if you care about account control or brand risk. Use it only with a dedicated Douyin account/profile, inspect generated replies before sending, avoid vague auto-reply prompts, protect or delete the scripts/user-data profile when done, and be aware that failed replies may leave screenshots containing comment/account UI on disk.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The documentation explicitly tells the agent/operator to bypass the normal author+content matching path and invoke a low-level reply function directly by comment ID. That removes the skill’s limited safety guardrails and enables precise live posting to external accounts, increasing the chance of unintended or unauthorized mass replies if the agent is steered or the IDs are stale/misbound.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The troubleshooting guide explicitly suggests bypassing the documented author/content matching workflow by writing a custom script that replies directly to a comment ID. In this skill’s context, that removes a safety constraint around target selection and enables arbitrary live replies against a real Douyin account, increasing the chance of unintended, duplicate, or abusive posting.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly states that the first login session will be automatically saved and reused later, while the skill also performs direct automated replies with no approval or dry-run step. This creates real security and privacy risk because persisted authentication state can be reused by later runs or other local actors, and automated posting can cause unauthorized or mistaken actions on a social media account.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrase `批量自动回复` is overly generic and can match ordinary user requests that are not clearly scoped to Douyin. In this skill, ambiguous activation is especially dangerous because the workflow culminates in direct comment posting with no approval or dry-run step, so accidental invocation can lead to unintended public actions on a user's account.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill states that generic requests like `批量自动回复` should trigger the full workflow automatically. Given the documented flow of fetch comments → generate replies with LLM → directly send with no approval node, this ambiguity materially raises the risk of unintended automated posting, reputational harm, and spam-like behavior from a linked Douyin creator account.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The workflow is triggered by broad natural-language phrases for an action that leads to public posting on a third-party platform. Ambiguous activation boundaries increase the chance the agent will interpret casual mention of Douyin replies as authorization to scrape comments, generate text, and publish replies without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The shortcut triggers are especially risky because they map vague user language directly onto a workflow with external side effects. In this skill's context, a minimal phrase can cause selection of a default video and eventual automatic posting, so ambiguity materially raises the risk of unintended actions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This workflow explicitly allows the agent to generate and send public replies with no human approval or dry-run step. Because the output is externally visible and potentially irreversible in practice, model mistakes, prompt manipulation via comment content, or bad targeting can immediately cause reputational harm, spam, or unauthorized posting.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The file not only removes prior approval requirements but also acknowledges that users may only delete replies after the fact, which means the dangerous action is knowingly made one-step and externally visible. This materially increases the likelihood and severity of accidental or low-quality automated posting because there is no mandatory warning or consent checkpoint immediately before execution.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The CLI explicitly documents that `--reply` performs live posting with no `--dry-run` or approval step, which creates a real safety weakness for an agent-integrated tool. In this skill’s context, comments are fetched, processed, and then replies can be sent automatically, so a prompt mistake, bad matching, or unsafe automation can cause unintended public actions on a real account.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The documented workflow states that the agent will fetch comments, apply rules, generate LLM text, and directly send replies with no approval node. That is a stronger autonomous-action risk than ordinary CLI posting because the content generation and decision to post are delegated to the model, increasing the chance of spam, harassment, policy violations, reputational harm, or misuse of the connected Douyin account.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file states that when exactly one match is found, the system sends the reply directly with no dry-run intermediate step. Because this skill performs live external actions against Douyin comments, documenting immediate posting without an explicit warning or approval step creates a meaningful risk of accidental content publication and unintended account activity.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions recommend bypassing ambiguity handling by fetching comment IDs and then sending replies directly by ID via an internal script, again without any warning about live posting. In this skill’s context, that makes unsafe operation more dangerous because it converts a guarded matching failure into a direct write primitive against an external platform.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The document states that a persistent Chromium profile stores cookies and localStorage, but does not present this as a security/privacy warning or explain the sensitivity of that data. In a browser-automation skill tied to a creator account, stolen or mishandled profile data could enable session hijacking or unauthorized account access.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The troubleshooting text discusses direct automated replying, duplicate posting, and bypass paths without an upfront warning that actions are performed against a live Douyin account and immediately change platform state. Given the skill metadata explicitly says there is no approval or dry-run step, this omission materially raises the risk of accidental spam, mis-replies, and account consequences.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script launches a persistent Playwright browser context using a reusable user-data directory, which preserves authenticated Douyin cookies and session state across runs. In a skill designed for automated social-media actions, this materially increases the risk of unintended account takeover, cross-user session reuse, or unauthorized posting if the profile path is reused, shared, or pointed at an existing browser profile.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The reply workflow explicitly sends comments directly with no confirmation, approval gate, or dry-run step, meaning any bad input, matching mistake, or unsafe LLM-generated text is immediately posted to the live Douyin account. Given the skill's described workflow of scraping comments, applying rules, generating copy with an LLM, and sending automatically, this creates a strong risk of spam, abusive responses, reputational damage, and irreversible account actions at scale.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: On error, the script captures a full-page screenshot and writes it to disk in the working directory. In this skill’s context, the page contains creator-center comments, usernames, and potentially account/session-adjacent UI state, so failures can silently persist personal or sensitive business data without explicit operator awareness or minimization.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/reply_comment.js:129