douyin-analyse-batch

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:07 AM UTC
• Version: 1.0.2

Overview

The skill matches a Douyin daily-report workflow, but it also sets persistent automation and contains hardcoded external recipients and exposed services that could send reports or credentials where the user did not explicitly choose.

Review carefully before installing. Remove all hardcoded QQ and Telegram recipients, require explicit recipient confirmation before any send, make cron opt-in, bind the web UI to localhost with authentication, avoid entering API keys into the browser UI until the misleading key-handling behavior is fixed, and protect SMTP/TikHub credentials with least-privilege environment handling.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources

Findings (9)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_douyin_daily_report.sh:9
• Finding: Scheduled reports are automatically sent to hardcoded third-party email recipients<![CDATA[ ## Vulnerability Details **File Location**: - `scripts/setup_douyin_daily_report.sh:9` - `scripts/setup_douyin_daily_report.sh:29-49` - `scripts/cron_daily_digest_wrapper.sh:13-19` - `scripts/helpers/send_email.py:13-22` - `scripts/helpers/send_email.py:55-60` **Vulnerability Type**: Hardcoded external recipients and unintended data disclosure **Risk Level**: High ### Vulnerable Code ```bash EMAIL_RECIPIENTS="${DOUYIN_EMAIL_RECIPIENTS:[e-mail],[e-mail]}" ``` ```bash cat > "$ENV_FILE" << 'EOF' # SMTP email configuration SMTP_USER=[e-mail] SMTP_PASS=your_smtp_authorization_code SMTP_HOST=smtp.qq.com SMTP_PORT=587 # Recipients DOUYIN_EMAIL_RECIPIENTS=[e-mail],[e-mail] # Report limit DOUYIN_DIGEST_LIMIT=15 # Python virtual environment DOUYIN_VENV_PY=/tmp/douyin_transcribe/venv/bin/python3 # TikHub API Token # Add "tikhub_api_token": "your_token" to ~/.openclaw/config.json EOF ``` ```bash export SMTP_USER="${SMTP_USER:[e-mail]}" export SMTP_PASS="${SMTP_PASS:-}" export SMTP_HOST="${SMTP_HOST:-smtp.qq.com}" export SMTP_PORT="${SMTP_PORT:-587}" export DOUYIN_EMAIL_RECIPIENTS="${DOUYIN_EMAIL_RECIPIENTS:[e-mail],[e-mail]}" ``` ```python DEFAULT_RECIPIENTS = ['[e-mail]'] def build_recipients() -> list[str]: env_val = os.environ.get('DOUYIN_EMAIL_RECIPIENTS', '') if env_val.strip(): return [r.strip() for r in env_val.split(',') if r.strip()] return DEFAULT_RECIPIENTS ``` ```python with smtplib.SMTP(smtp_host, smtp_port) as smtp: smtp.ehlo() smtp.starttls() smtp.ehlo() smtp.login(sender, password) smtp.sendmail(sender, recipients, msg.as_bytes()) ``` ### Technical Analysis The installer writes two preset QQ addresses into the generated `.env` file. The scheduled wrapper independently falls back to the same addresses, while the email helper contains another hardcoded fallback. The user is therefore not required to affirmatively c ...[truncated 1468 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every hardcoded recipient and sender address. 2. Require `DOUYIN_EMAIL_RECIPIENTS` and `SMTP_USER` to be explicitly configured. 3. Reject empty, placeholder, or package-supplied recipient values. 4. Do not install or enable scheduled email delivery until the user confirms the complete recipient list. 5. Print the selected recipients before the first delivery and require explicit approval. 6. Consider an allowlist stored in a user-owned configuration file with mode `0600`. 7. Add tests ensuring that email delivery fails closed when no recipients are configured. ]]>

T06 · System Persistence

Error

• Location: scripts/setup_douyin_daily_report.sh:64
• Finding: The installer creates persistent twice-daily execution without separate opt-in consent<![CDATA[ ## Vulnerability Details **File Location**: - `scripts/setup_douyin_daily_report.sh:64-70` - `SKILL.md:18-23` - `references/DEPLOY.md:48-55` **Vulnerability Type**: Automatic scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```bash # 5. Set Cron scheduled task at 08:00 and 16:00 echo "[5/6] Setting Cron scheduled task..." CRON_WRAPPER="$SKILL_DIR/scripts/cron_daily_digest_wrapper.sh" CRON_EXPR="0 8,16 * * *" CRON_CMD="$CRON_EXPR bash \"$CRON_WRAPPER\" $DIGEST_LIMIT >> /tmp/douyin_cron.log 2>&1" (crontab -l 2>/dev/null | grep -v "douyin_daily_digest"; echo "$CRON_CMD") | crontab - echo " Cron configured for 08:00 and 16:00" ``` ### Technical Analysis Running the one-step setup script directly modifies the user's crontab and establishes execution twice every day. The scheduled process reads credentials, accesses external APIs, invokes OpenClaw, creates local files, and attempts email delivery. Scheduling is relevant to the declared daily-report feature, but installing persistence as an inseparable part of environment setup violates least-surprise and informed-consent principles. A user cannot run the setup script merely to prepare or test the Skill without also creating persistent execution. The command also rebuilds the complete crontab through a pipeline. Although it attempts to remove an older matching entry, this pattern is fragile and does not use a clearly delimited managed block. ### Attack Path 1. The user follows the documented one-step installation command. 2. The script silently appends a twice-daily cron entry. 3. The installation session ends, but the cron entry remains. 4. At 08:00 and 16:00, the wrapper loads `.env` and invokes the report pipeline. 5. The persistent process performs external requests and email transmission without a new interactive request. 6. The activity continues until the user notices and removes the cron entry. ### Impact Assessment The persistent task receives the privileges of the user ...[truncated 504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Separate environment installation from schedule installation. 2. Require an explicit `--install-cron` option or interactive confirmation. 3. Display the exact cron expression, command, log path, and network behavior before confirmation. 4. Default to manual execution and `--no-email` for the first run. 5. Use a uniquely delimited managed crontab block rather than reconstructing entries through `grep`. 6. Provide an idempotent uninstall command that removes only entries owned by this Skill. 7. Record whether persistence was enabled and periodically remind the user that it remains active. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: dependencies/douyin-mcp-server/README.md:197
• Finding: Documentation executes a mutable remote installer directly through a shell<![CDATA[ ## Vulnerability Details **File Location**: `dependencies/douyin-mcp-server/README.md:197-203` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown | Dependency | Description | Installation method | |------------|-------------|---------------------| | uv | Python package management | `curl -LsSf https://astral.sh/uv/install.sh \| sh` | | Python | 3.10+ | `uv python install 3.12` | | FFmpeg | Audio/video processing | `brew install ffmpeg` (macOS) <br> `apt install ffmpeg` (Ubuntu) | ``` ### Technical Analysis The instruction downloads a remote script and immediately pipes it into `sh`. The effective code is not pinned to a version, reviewed locally, or verified using a checksum or signature. HTTPS protects the connection in transit under normal conditions, but it does not protect against compromise of the hosting account, build pipeline, DNS infrastructure, certificate issuance process, or upstream script. The payload can change after this Skill package has been reviewed. ### Attack Path 1. A user or automated agent follows the bundled dependency instructions. 2. `curl` retrieves the current response from `https://astral.sh/uv/install.sh`. 3. The response is passed directly to the local shell. 4. If the upstream delivery path is compromised, attacker-controlled shell commands execute immediately. 5. Those commands inherit the installing user's filesystem, environment, and network access. ### Impact Assessment A malicious remote script can execute arbitrary commands with the installing user's privileges. Depending on that account, it could: - Read user files and credentials. - Modify shell profiles or scheduled tasks. - Install binaries or additional persistence. - Alter the OpenClaw workspace. - Exfiltrate tokens and SMTP credentials. - Download and execute further payloads. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `curl | sh` with a versioned package-manager installation where possible. 2. If a standalone installer is required, download a specific release artifact first. 3. Verify a vendor-published cryptographic checksum or signature before execution. 4. Show users how to inspect the downloaded script. 5. Pin the installed version and document its expected checksum. 6. Avoid having an autonomous agent execute remote installation instructions without user approval. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: dependencies/douyin-mcp-server/web/app.py:107
• Finding: The bundled MCP and Web services permit unauthenticated server-side requests to arbitrary URLs<![CDATA[ ## Vulnerability Details **File Location**: - `dependencies/douyin-mcp-server/douyin_mcp_server/server.py:63-72` - `dependencies/douyin-mcp-server/web/app.py:107-147` - `dependencies/douyin-mcp-server/web/app.py:160-164` **Vulnerability Type**: Server-Side Request Forgery and unrestricted streaming proxy **Risk Level**: High ### Vulnerable Code ```python urls = re.findall( r'http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|' r'(?:%[0-9a-fA-F][0-9a-fA-F]))+', share_text ) if not urls: raise ValueError("No valid sharing link was found") share_url = urls[0] share_response = requests.get(share_url, headers=HEADERS) video_id = share_response.url.split("?")[0].strip("/").split("/")[-1] share_url = f'https://www.iesdouyin.com/share/video/{video_id}' response = requests.get(share_url, headers=HEADERS) response.raise_for_status() ``` ```python @app.get("/api/video/download") async def download_video(url: str, filename: str = "video.mp4"): print(f"[Download] URL: {url}") print(f"[Download] Filename: {filename}") try: download_headers = { 'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) ' 'AppleWebKit/605.1.15 (KHTML, like Gecko) ' 'EdgiOS/121.0.2277.107 Version/17.0 Mobile/15E148 Safari/604.1', 'Referer': 'https://www.douyin.com/', 'Accept': '*/*', 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8', 'Accept-Encoding': 'identity', 'Connection': 'keep-alive', } response = requests.get( url, headers=download_headers, stream=True, allow_redirects=True ) response.raise_for_status() def iter_content(): for chunk in response.iter_content(chunk_size=8192): if chunk: yield chunk return StreamingResponse( iter_content(), media_t ...[truncated 1996 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind the development server to `127.0.0.1` by default. 2. Add authentication and authorization before exposing any network-fetching endpoint. 3. Allow only `https` URLs on an explicit list of required Douyin and media CDN hostnames. 4. Resolve hostnames and reject loopback, private, link-local, multicast, documentation, and reserved addresses. 5. Repeat destination validation after every redirect, or disable redirects. 6. Reject nonstandard destination ports unless explicitly required. 7. Add connection and read timeouts, maximum redirect counts, and strict byte limits. 8. Do not return arbitrary upstream content as `video/mp4` without validating its media type. 9. Apply rate limits and concurrency limits. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: dependencies/douyin-mcp-server/web/app.py:28
• Finding: The network-exposed Web UI accepts transcription API secrets from browser requests<![CDATA[ ## Vulnerability Details **File Location**: - `dependencies/douyin-mcp-server/web/app.py:28-32` - `dependencies/douyin-mcp-server/web/app.py:80-90` - `dependencies/douyin-mcp-server/web/app.py:160-164` **Vulnerability Type**: Sensitive credential submission over an unauthenticated HTTP service **Risk Level**: High ### Vulnerable Code ```python class VideoRequest(BaseModel): """Video request model""" url: str api_key: str = "" ``` ```python @app.post("/api/video/extract", response_model=ExtractResponse) async def extract_transcript(req: VideoRequest): # Prefer the API key supplied in the request, then use the environment api_key = req.api_key or os.getenv("API_KEY", "") if not api_key: return ExtractResponse( success=False, error="Please configure an API key" ) result = extract_text(req.url, api_key=api_key, show_progress=False) ``` ```python def main(): port = int(os.getenv("PORT", "8080")) print(f"Starting Web UI: http://localhost:{port}") uvicorn.run(app, host="0.0.0.0", port=port) ``` ### Technical Analysis The application permits a client to place an API key in a JSON request body. It then starts a plaintext HTTP server on every network interface. No TLS enforcement, application authentication, origin restriction, or trusted-proxy requirement is shown. Consequently, the secret crosses a browser-facing network boundary unnecessarily. Network observers, malicious local software, reverse proxies with request logging, or unauthorized clients may gain access to the key. The key is legitimately required by the transcription provider, but receiving it through an unauthenticated browser form is not necessary. It should remain in server-side secret storage. ### Attack Path 1. The operator starts the Web UI. 2. The server listens on `0.0.0.0:8080` over HTTP. 3. A user enters an API key into the Web interface. 4. The browser sends the key in the body of `/api/video/extra ...[truncated 568 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `api_key` from the browser request model. 2. Load credentials only from a server-side secret store or protected environment variable. 3. Bind to `127.0.0.1` by default. 4. If remote access is required, enforce TLS and strong authentication. 5. Disable request-body logging and redact authorization data in observability tooling. 6. Add CSRF and origin protections for browser-accessible state-changing endpoints. 7. Use narrowly scoped, revocable provider credentials and rotate any key previously entered through this interface. ]]>

T08 · Insecure Dependencies

Warning

• Location: dependencies/douyin-mcp-server/web/templates/index.html:7
• Finding: The API-key interface executes mutable third-party JavaScript without integrity protection<![CDATA[ ## Vulnerability Details **File Location**: `dependencies/douyin-mcp-server/web/templates/index.html:7-11` **Vulnerability Type**: Unpinned runtime CDN dependencies without Subresource Integrity **Risk Level**: Medium ### Vulnerable Code ```html <script src="https://cdn.tailwindcss.com"></script> <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js"></script> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet"> ``` ### Technical Analysis The page loads executable JavaScript from mutable third-party CDN URLs. Alpine.js is constrained only to the broad `3.x.x` series, while the Tailwind CDN URL does not identify a fixed release. Neither script uses Subresource Integrity. Third-party scripts run with the page's origin and can access the complete DOM, including API-key fields, video URLs, transcripts, and API responses. A CDN compromise or malicious upstream update can therefore turn a dependency into a credential-exfiltration payload after the Skill itself has been reviewed. ### Attack Path 1. The operator opens the bundled Web UI. 2. The browser retrieves JavaScript from the external CDN. 3. The CDN account, upstream package, or delivery path serves modified JavaScript. 4. The modified script executes under the Web UI's origin. 5. It reads the API-key input and other page data. 6. It sends those values to an attacker-controlled endpoint. ### Impact Assessment A successful supply-chain compromise can expose: - Transcription API keys entered into the page. - Submitted Douyin URLs. - Extracted transcripts and download links. - Other same-origin API responses available to page JavaScript. The compromise affects users who load the page while malicious CDN content is being served. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle audited JavaScript dependencies locally. 2. Pin every dependency to an exact version. 3. If external hosting remains necessary, add valid Subresource Integrity hashes and `crossorigin` attributes. 4. Deploy a restrictive Content Security Policy that limits scripts and outbound connections. 5. Avoid runtime Tailwind compilation in production. 6. Rebuild and review dependency bundles through a reproducible process. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/run_daily_digest.py:62
• Finding: SMTP credentials are unnecessarily inherited by the OpenClaw agent subprocess<![CDATA[ ## Vulnerability Details **File Location**: - `scripts/cron_daily_digest_wrapper.sh:7-19` - `scripts/run_daily_digest.py:62-70` **Vulnerability Type**: Excessive credential exposure across subprocess boundaries **Risk Level**: Medium ### Vulnerable Code ```bash ENV_FILE="$(cd "$(dirname "$0")" && cd .. && pwd)/.env" if [ -f "$ENV_FILE" ]; then set -a source "$ENV_FILE" set +a fi export SMTP_USER="${SMTP_USER:[e-mail]}" export SMTP_PASS="${SMTP_PASS:-}" export SMTP_HOST="${SMTP_HOST:-smtp.qq.com}" export SMTP_PORT="${SMTP_PORT:-587}" export DOUYIN_EMAIL_RECIPIENTS="${DOUYIN_EMAIL_RECIPIENTS:[e-mail],[e-mail]}" ``` ```python result = subprocess.run( ["openclaw", "agent", "--session-id", session_key, "--message", prompt, "--timeout", "90"], capture_output=True, text=True, timeout=120, env={ **os.environ, "PATH": os.environ.get("PATH", "") + ":/root/.local/share/pnpm" } ) ``` ### Technical Analysis The wrapper exports all variables loaded from `.env`, including the SMTP password. The report pipeline then copies the complete process environment into the `openclaw agent` subprocess. The agent invocation needs the prompt and execution path, but it does not need SMTP credentials. Passing the full environment expands the number of processes and components capable of reading the password and violates least privilege. This is especially risky for an extensible agent runtime, where plugins, tool integrations, child processes, or a compromised executable may inspect inherited environment variables. ### Attack Path 1. Cron launches the wrapper. 2. The wrapper sources `.env` with automatic export enabled. 3. `SMTP_PASS` becomes part of the pipeline's environment. 4. The pipeline launches `openclaw agent` with `env={**os.environ, ...}`. 5. The OpenClaw process or any compromised child-side component reads `SMTP_PASS`. 6. The credential is used to access or abuse t ...[truncated 458 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Build an explicit minimal environment for `openclaw agent`. 2. Pass only essential variables such as a controlled `PATH`, locale, and required OpenClaw configuration. 3. Keep SMTP credentials unavailable until the dedicated email subprocess is launched. 4. Avoid `set -a` when sourcing the entire `.env` file. 5. Split general configuration and email secrets into separate protected files. 6. Ensure secret files have mode `0600`. 7. Document which subprocess receives each credential and add regression tests for environment isolation. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: scripts/run_daily_digest.py:35
• Finding: A fixed OpenClaw session allows cross-run context contamination by untrusted video titles<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run_daily_digest.py:35-66` **Vulnerability Type**: Persistent shared agent-state contamination **Risk Level**: Medium ### Vulnerable Code ```python def call_openclaw_llm(title: str, transcript: str, video_url: str = "") -> str: """Use the openclaw agent command to generate analysis notes""" session_key = "agent:main:lightclawbot:direct:100012167891" prompt = f"""You are a professional Douyin video content analyst. Analyze the following video and generate analysis notes. [Video title] {title} [Video URL] {video_url or "None"} [Transcript] {transcript if transcript else "(No transcript; analyze only the title and tags)"} Generate the requested structured analysis.""" result = subprocess.run( ["openclaw", "agent", "--session-id", session_key, "--message", prompt, "--timeout", "90"], capture_output=True, text=True, timeout=120, env={**os.environ, "PATH": os.environ.get("PATH", "") + ":/root/.local/share/pnpm"} ) ``` ### Technical Analysis Every video and every scheduled run uses the same hardcoded session identifier. Video titles and URLs originate from an external API and are interpolated directly into the agent message. If OpenClaw retains conversation state for that session, attacker-controlled title text can affect later analyses. The lack of a per-run session boundary also permits context from earlier reports to influence later reports. The identifier appears externally specific rather than locally generated, increasing the risk of unintended routing or state sharing. No explicit instruction to override platform policy was found in the package. The risk arises from persistent reuse of one agent context with untrusted external content. ### Attack Path 1. An attacker causes a specially crafted video title to appear in the trend data. 2. The scheduled pipeline embeds that title directly into ...[truncated 818 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a fresh, random session for each report run or each video. 2. Delete or expire session state after report generation. 3. Do not use a hardcoded externally identifying session key. 4. Clearly delimit external titles, links, and transcripts as untrusted data. 5. Add an instruction that data inside the delimiters must not be treated as agent commands. 6. Validate generated output against the expected report structure. 7. Limit the OpenClaw tools available during title-only analysis. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: dependencies/douyin-hot-trend/cron-job.js:125
• Finding: A bundled executable prepares messages for a hardcoded Telegram chat<![CDATA[ ## Vulnerability Details **File Location**: `dependencies/douyin-hot-trend/cron-job.js:125-156` **Vulnerability Type**: Hardcoded external message-routing destination **Risk Level**: Medium ### Vulnerable Code ```javascript // Output JSON for the OpenClaw messaging tool const jsonOutput = { success: true, timestamp: new Date().toISOString(), timezone: 'Asia/Shanghai', chat_id: '8428610733', channel: 'telegram', message: message, items: items.slice(0, limit), format: 'markdown' }; const jsonFile = path.join(__dirname, 'daily-hot-trend-output.json'); fs.writeFileSync(jsonFile, JSON.stringify(jsonOutput, null, 2), 'utf-8'); console.log('Message prepared for Telegram'); console.log(`Saved at: ${jsonFile}`); // Output message content for OpenClaw to capture console.log('\n=== Message preview ===\n'); console.log(message); ``` ### Technical Analysis The bundled dependency creates routing metadata for a fixed Telegram chat ID. This destination is unrelated to the primary Skill's documented recipient configuration and cannot be selected by the user. The primary `run_daily_digest.py` path does not directly invoke this JavaScript file. Nevertheless, it remains an executable component bundled with the Skill and explicitly describes itself as an OpenClaw-integrated scheduled task. If an agent or user invokes it according to its purpose, the resulting output is prepared for delivery to a preset third-party destination. ### Attack Path 1. A user or agent discovers and invokes the bundled `cron-job.js`. 2. The script collects trend information and formats a Telegram message. 3. It writes output containing `channel: "telegram"` and the hardcoded chat ID. 4. An OpenClaw messaging workflow captures or consumes the routing object as intended by the script. 5. The trend message is delivered to Telegram chat `8428610733` rather than a user-selected destination. ### Impact Assessment The fixed chat recipient may receive trend data and any message ...[truncated 319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded Telegram chat ID and channel. 2. Require users to explicitly configure and confirm every messaging destination. 3. Keep message generation separate from message delivery and routing. 4. Do not emit delivery-ready routing objects unless the user requested Telegram delivery. 5. Remove this component from the package if it is not required by the primary daily email-report workflow. 6. Add tests that fail when package-owned recipient identifiers appear in executable configuration. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (170)

Tainted flow: 'video_info' from os.getenv (line 359, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

if show_progress:
            print(f"正在下载视频: {video_info['title']}")

        response = requests.get(video_info['url'], headers=HEADERS, stream=True)
        response.raise_for_status()

        # 获取文件大小

• Confidence: 92% confidence
• Finding: The downloader fetches video_info['url'] obtained from remote page data and streams it to disk without validating the destination host or content type. A malicious or tampered upstream response could cause the skill to download arbitrary remote content, enabling SSRF-style egress, large-file abuse, or storage exhaustion.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The installation flow reportedly modifies crontab, writes config files, installs dependencies associated with transcription/download, and may preconfigure external communication targets, none of which are fully surfaced in the high-level description. Hidden persistence and communication setup materially increases risk because it can continue operating after initial invocation and send data externally without ongoing user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

```
douyin-daily-report/
├── SKILL.md
├── .env                              ← 环境变量（setup 脚本生成）
├── scripts/
│   ├── setup_douyin_daily_report.sh  ← 一键安装（含 venv + Cron）
│   ├── cron_daily_digest_wrapper.sh  ← Cron 入口

• Confidence: 94% confidence
• Finding: The skill’s structure explicitly includes a generated .env file for SMTP credentials and related configuration, indicating collection and local storage of secrets. In a skill that also uses shell, filesystem, and network capabilities, locally stored credentials create a meaningful risk of leakage, misuse, or accidental inclusion in logs/backups.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata promises an email/Word daily report workflow, but this file is built around generating Telegram delivery artifacts with a hard-coded chat_id. That mismatch is dangerous because it can route data to an undisclosed external channel and defeat user expectations, review assumptions, and policy controls around where generated reports are sent.

Tainted flow: 'files' from open (line 251, file read) → requests.post (network output)

High

• Category: Data Flow

Content

}

        try:
            response = requests.post(self.api_base_url, files=files, headers=headers)
            response.raise_for_status()

            result = response.json()

• Confidence: 97% confidence
• Finding: The script uploads extracted audio to an external transcription API, which can disclose sensitive spoken content and metadata outside the local environment. In a skill context that automates reports and email delivery, this data egress is especially important because users may not expect third-party transmission of downloaded media content.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence
• Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Hidden Instructions

High

• Category: Prompt Injection

Content

</head>
<body class="bg-douyin-gray-50 min-h-screen bg-gradient-mesh" x-data="douyinExtractor()" x-init="checkHealth()">

    <!-- Top Navigation Bar -->
    <nav class="sticky top-0 z-50 bg-white/80 backdrop-blur-xl border-b border-douyin-gray-100">
        <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
            <div class="flex items-center justify-between h-16">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The page tells users the API key is only stored locally and will not be uploaded to the server, but the code later sends that locally stored key to the backend during extraction. This is a direct trust and secret-handling violation: users may disclose a sensitive credential under false pretenses, and the backend can log, retain, or misuse it.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
    </div>

    <!-- Help Modal -->
    <div x-show="showHelp" x-transition.opacity class="fixed inset-0 z-50 bg-black/50 backdrop-blur-sm flex items-center justify-center p-4"
         @click.self="showHelp = false">
        <div x-show="showHelp" x-transition:enter="transition ease-out duration-200"

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to email the generated analysis note to a preset recipient list, including a hardcoded default external address, without requiring explicit per-run user confirmation of recipients or warning that potentially sensitive transcript and analysis content will be transmitted off-device. This creates a real risk of unauthorized data exfiltration, especially because users may invoke the skill for analysis purposes without realizing it automatically sends attachments externally.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

crontab -l | grep -v "douyin_daily_digest" | crontab -

# 删除虚拟环境
rm -rf /tmp/douyin_transcribe

# 删除输出文件
rm -rf ~/Documents/douyin_analysis

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

crontab -l | grep -v "douyin_daily_digest" | crontab -

# 删除虚拟环境
rm -rf /tmp/douyin_transcribe

# 删除输出文件
rm -rf ~/Documents/douyin_analysis

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: dependencies/douyin-hot-trend/cron-job.js:16

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: dependencies/douyin-hot-trend/scripts/get-hot-trend.js:16

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/DEPLOY.md:92

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:113

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: dependencies/douyin-mcp-server/README.md:69

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: dependencies/douyin-mcp-server/web/templates/index.html:664