doubao-account-pool

• Outcome: Review
• Latest audit: Sep 25, 2026 · 9:57 PM UTC
• Version: 1.0.3

Overview

The skill is mostly a disclosed Doubao browser-automation tool, but it needs Review because it handles logged-in browser profiles, inspects and retrieves chat content, uses broad local process/browser control, and includes under-scoped external install and safety-filter workarounds.

Install only if you are comfortable giving this skill control over separate logged-in Doubao browser profiles, local Chrome DevTools ports, generated media downloads, and recent conversation retrieval. Use a dedicated `DOUBAO_HOME`, avoid personal chats in those profiles, review any purchase/SkillPay step manually, and do not run the unpinned npm installer unless you trust that separate payment tool.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (44)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill repeatedly claims that page text, DOM, and screenshots will never flow back to the main conversation, yet it also advertises or references page inspection utilities such as screenshots and AX/control listing. That mismatch is dangerous because it can mislead users and orchestrators about what data the skill can collect or expose, increasing the chance of sensitive page content being captured or returned contrary to expectation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill repeatedly claims that page text, DOM, and screenshots will never flow back to the main conversation, yet it also advertises or references page inspection utilities such as screenshots and AX/control listing. That mismatch is dangerous because it can mislead users and orchestrators about what data the skill can collect or expose, increasing the chance of sensitive page content being captured or returned contrary to expectation.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

- **Claude Code / Codex / Cursor 等**：把 `SKILL.md` 作为系统提示/规则文件挂上，让它在 `scripts/` 下跑 `doubao_cli.py`。

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The harvesting instructions direct the operator to enumerate chat sessions, scroll through the sidebar, navigate into chats, and filter out 'private old chats,' which implies incidental access to unrelated conversations before filtering. In a multi-account scraping tool, this creates a real risk of unauthorized collection or exposure of private conversation metadata and media from sessions outside the intended job scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file includes rm -rf "$DOUBAO_HOME" and removal of the tool directory, which are destructive operations affecting stored login state and local files. Although L142 adds a caution after the commands, the warning is not presented before the destructive steps, so the user can encounter and copy the deletion commands before seeing the risk disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes substantial capabilities including shell execution, file read/write, environment access, browser automation, and networked installation flows, but it does not declare an explicit tool/permission scope. In an agent setting, this ambiguity can lead to overbroad execution authority and makes it harder for hosts or reviewers to enforce least privilege before the skill is run.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users or agents to run npx -y @alipay/agent-payment@latest install, which pulls and executes remote code without version pinning. This creates a supply-chain risk: if the package is updated maliciously, compromised, or simply changes behavior, the agent may execute unreviewed code with local user privileges.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file title and all instructional content are written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill guidance is written as prescriptive Chinese operational policy and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly documents how to rewrite blocked prompts into softer wording to avoid platform safety refusals, including violent and sensitive content. That is safety-evasion guidance: it helps operators bypass moderation controls while preserving harmful intent, which increases the risk of generating disallowed violent content at scale across multiple accounts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs users to use only Chinese natural-language sentences and full-width punctuation, which imposes a specific language/locale requirement. The file does not offer a user choice or explain a justified region-specific constraint, so this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow directs operators to send generated images to external visual-model services for quality control, which conflicts with the metadata claim that page text/DOM/screenshots do not flow back and that processing is local-first. Even if the services are 'free' vision APIs, this expands the data boundary and can leak sensitive or proprietary generated content to third parties without clear disclosure or consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The classification step instructs use of a visual model to inspect intermediate frames and map them to candidate shots, which again implies exporting generated media to an external analyzer beyond the declared scope of simple generation/retrieval. This undocumented outbound processing creates a confidentiality and trust-boundary issue, especially for user media or unreleased creative assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow explicitly instructs operators to download generated videos and persist per-account usage/status data, but provides no privacy boundary, retention rule, or consent requirement for handling those artifacts. In this skill’s context, the data is tied to multiple authenticated browser instances and user-generated media, so storing it without safeguards can expose sensitive account activity, prompts, or generated content beyond the intended session.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/doubao_cli.py (reported line 120)May include surrounding context.

python

try:
        if sys.platform == 'win32':
            proc = subprocess.Popen(args_list, creationflags=subprocess.DETACHED_PROCESS)
        else:
            proc = subprocess.Popen(args_list, start_new_session=True)
        # 写 pidfile

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/doubao_cli.py (reported line 122)May include surrounding context.

python

if sys.platform == 'win32':
            proc = subprocess.Popen(args_list, creationflags=subprocess.DETACHED_PROCESS)
        else:
            proc = subprocess.Popen(args_list, start_new_session=True)
        # 写 pidfile
        pf = pidfile(n)
        os.makedirs(os.path.dirname(pf), exist_ok=True)

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/doubao_cli.py (reported line 333)May include surrounding context.

python

def alive(n, timeout=1.5):
    """实例 n 的 Chrome 是否在线（通过 /json/version 探活）。"""
    try:
        urllib.request.urlopen(
            'http://127.0.0.1:%d/json/version' % port_of(n),
            timeout=timeout,
        )

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/doubao_core.py (reported line 208)May include surrounding context.

python

def alive(n, timeout=1.5):
    """实例 n 的 Chrome 是否在线（通过 /json/version 探活）。"""
    try:
        urllib.request.urlopen(
            'http://127.0.0.1:%d/json/version' % port_of(n),
            timeout=timeout,
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/doubao_core.py (reported line 263)May include surrounding context.

python

try:
        if sys.platform == 'win32':
            proc = subprocess.Popen(
                args,
                creationflags=subprocess.CREATE_NEW_PROCESS_GROUP,
                close_fds=False,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/doubao_core.py (reported line 269)May include surrounding context.

python

close_fds=False,
            )
        else:
            proc = subprocess.Popen(args, start_new_session=True, close_fds=True)
    except Exception as e:
        log('up slot=%d ERR 启动失败: %s' % (n, str(e)[:100]))
        return False

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/doubao_core.py (reported line 394)May include surrounding context.

python

"if($p -and $p.CommandLine -like '*%s*'){ 'MATCH' } else { 'NOTMINE' }"
            % (pid, udd_lower.replace("'", "''"))
        )
        r = subprocess.run(
            ['powershell', '-NoProfile', '-Command', ps_cmd],
            capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=20,
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/doubao_core.py (reported line 400)May include surrounding context.

python

)
        if 'MATCH' not in r.stdout.strip():
            return 0
        subprocess.run(
            ['taskkill', '/PID', str(pid), '/T', '/F'],
            capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=30,
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code runs taskkill /T /F, which forcibly terminates a process tree and can cause data loss in the browser profile. The surrounding comments are developer-facing only, and there is no confirmation prompt or explicit user disclosure at execution time about the destructive nature of this action.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 82% confidence

Finding

On POSIX, the code uses pgrep -f udd_path and later kills every matching PID. Matching by command-line substring is imprecise and can terminate unrelated local processes if another process includes the same path text, making this a local denial-of-service risk.

Content

Scanner excerpt · scripts/doubao_core.py (reported line 414)May include surrounding context.

python

"""POSIX：按命令行含本实例目录匹配后 kill。返回被杀进程数。"""
    killed = 0
    try:
        out = subprocess.run(
            ['pgrep', '-f', udd_path],
            capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=10,
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 84% confidence

Finding

The code force-kills PIDs returned by pgrep -f without verifying that each PID is truly the intended browser process. Because command-line substring matching can overmatch, this can kill unrelated local processes and cause data loss or service interruption on the host.

Content

Scanner excerpt · scripts/doubao_core.py (reported line 424)May include surrounding context.

python

continue
            try:
                pid = int(line)
                subprocess.run(['kill', '-9', str(pid)], timeout=5)
                killed += 1
            except Exception:
                pass

Static analysis

No suspicious patterns detected.