ClawHub
Back to skill

Security audit

Douyin Comment Bot

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about automating Douyin comments, but it can post publicly from a logged-in account and automatically kill local gateway processes without confirmation.

Review this skill carefully before installing. It is not evidence of malware, but it should only be used if you are comfortable with an agent posting visible Douyin comments from your logged-in account and with its current automatic gateway recovery command. Prefer a version that asks you to confirm the target video, exact comment text, and any local process restart or termination.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:24
Finding

Broad Automatic Process Termination During Timeout Recovery

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–29
Vulnerability Type: Unsafe process management using a broad command-line pattern
Risk Level: Medium

bash
pkill -f "node.*openclaw.*gateway" || true
sleep 3
openclaw gateway status

Technical Analysis

The skill directs the agent to execute pkill -f automatically when the browser reports a timeout. The -f option matches against complete process command lines, while the regular expression can match every accessible Node.js process containing both openclaw and gateway.

The command does not:

  • Identify the gateway instance associated with the current task.
  • Validate the selected process ID, executable path, owner, or session.
  • Distinguish the current gateway from unrelated OpenClaw gateway processes.
  • Request user approval before terminating processes.
  • Explicitly restart the terminated gateway; openclaw gateway status only checks its status.

Consequently, this recovery procedure violates safe process-management practices and may terminate a wider set of processes than required. The suppression of errors through || true can also conceal failure or partial termination.

Attack Path

  1. A browser operation returns a timeout, whether because of a genuine service failure, resource pressure, or another transient condition.
  2. The skill follows its documented recovery procedure without requesting confirmation.
  3. It executes pkill -f "node.*openclaw.*gateway".
  4. The operating system terminates every process accessible to the executing user whose command line matches the expression.
  5. Other OpenClaw gateway instances or sessions running under that user may be interrupted.
  6. The skill waits and runs a status check, but the documented commands do not guarantee that the intended gateway is restarted.

Impact Assessment

The command operates with the privileges of the account running the agent. It does not i ...[truncated 608 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the broad pkill -f recovery command.
  2. Use an official, instance-scoped OpenClaw restart operation if one is available.
  3. Require explicit user approval before terminating or restarting system processes unless the user has separately authorized automatic recovery.
  4. If direct process signaling is unavoidable:
    • Obtain the PID from a trusted PID file or service manager.
    • Verify the process owner, executable path, start time, and expected instance identifier.
    • Signal only the verified PID.
    • Prefer graceful termination before forced termination.
  5. Use a service manager with a uniquely named service unit to isolate the intended gateway instance.
  6. Do not suppress all failures with || true; record and handle termination errors explicitly.
  7. Perform a bounded health check after restart and stop the workflow if recovery cannot be verified.
  8. Treat browser timeouts as potentially transient: retry the browser operation with bounded backoff before initiating process-level recovery.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is designed to post comments from an already logged-in Douyin account without an explicit confirmation step or prominent warning that it will perform a public account action. In context, this is more dangerous because the entire skill automates public engagement actions, increasing the risk of unauthorized posting, reputational harm, spam policy violations, or misuse of the user's account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs automatically killing and restarting a local gateway process with shell commands unrelated to the user-facing Douyin comment task. This expands the skill's authority beyond browser automation into host process management, creating a dangerous precedent for service disruption, unintended process termination, and abuse of local execution capabilities if the instructions are followed blindly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Line L012 states '禁止 screenshot（无 vision 权限）', establishing a documented constraint against visual-capture-style tooling. Later, L073-L077 instructs using snapshot to inspect the page, which contradicts the earlier prohibition as written and creates ambiguity about what tooling is actually allowed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.