ClawHub
Back to skill

Security audit

Douyin Automation V2

Security checks across malware telemetry and agentic risk

Overview

This skill is openly for Douyin automation, but it can post comments, send private messages, and like content through a user’s account without clear approval or scope limits.

Review carefully before installing. Use only with explicit approval for each comment, DM, and like; set strict target lists and rate limits; avoid unsolicited messaging or deceptive human-mimicking behavior; and monitor or clear the local reply history if account activity is sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly supports automated commenting and private-message sending on a social platform but provides only minimal cautionary language, without meaningful safeguards around unsolicited contact, consent, rate limits, or handling personal data. In this context, the functionality increases the risk of spam, harassment, privacy violations, and platform-abuse at scale.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.