Security audit

Douyin Video Downloader (抖音视频下载器)

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Douyin downloader, but it can run on incidental links or numbers and makes third-party network requests using a stored API token without enough user control.

Review before installing. Use only if you are comfortable sending Douyin links or IDs to TikHub with your local TikHub API token. Avoid allowing automatic invocation on incidental URLs or bare long numbers, and prefer a revised version that requires explicit user confirmation and validates v.douyin.com hostnames before making network requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:6
Finding: Automatic Skill Invocation Overrides User Intent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/douyin_download.py:66
Finding: Blind SSRF Through Substring-Based Short-Link Validation
Content: View full analysis
str: """ Follow redirects on a v.douyin.com short link and return the final URL. This is needed because short links don't embed the modal_id directly. """ try: resp = requests.head(url, allow_redirects=True, timeout=10) return resp.url except requests.RequestException as e: raise ValueError(f"Could not resolve short link '{url}': {e}") from e ``` ```python # 4. Short link — resolve then retry if "v.douyin.com" in text: resolved = resolve_short_link(text) if resolved != text: return extract_modal_id(resolved) ``` ### Technical Analysis The code determines whether an input is a trusted Douyin short link by checking whether the literal string `v.douyin.com` appears anywhere in the input. It does not parse the URL and validate its hostname. Consequently, attacker-controlled URLs such as the following pass the check: ```text http://127.0.0.1:8080/?v.douyin.com http://169.254.169.254/latest/?v.douyin.com https://attacker.example/path?v.douyin.com https://v.douyin.com.attacker.example/ ``` The entire unvalidated string is passed to `requests.head`. The actual destination is therefore selected by the attacker rather than being restricted to `v.douyin.com`. The request also uses `allow_redirects=True`. Even if the initial hostname were validated, a trusted or attacker-controlled endpoint could redirect the client to loopback, private, link-local, or other sensitive network addresses. No validation is performed on redirect destinations. The vulnerability is blind SSRF because the response body is not returned to the caller. Nevertheless, timing, status-dependent behavior, redirect behavior, and attacker-obse ...[truncated 1698 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest promises behavior that does not match the actual workflow: it says 'no login required' while requiring a TikHub API token, implies automatic downloading when detection occurs although the default command only returns a URL, and claims unsupported content types are excluded without showing enforcement. Security-relevant mismatches can mislead users and downstream agents into sending data to a third party or assuming safeguards exist when they do not.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes a Python script that reaches out to the TikHub API, but the manifest does not declare any tool scope or permission boundary for network use. This weakens policy enforcement and reviewability: the agent may transmit user-supplied Douyin URLs/IDs and API-backed requests externally without explicit declaration, increasing the risk of unintended data egress or overbroad execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger rules are broad enough to activate on merely seeing any Douyin URL or a 16–19 digit number, even without an explicit user request to download. In an agent setting this can cause unintended execution, external API calls, and file downloads based on incidental text, creating privacy, consent, and resource-usage risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill does not warn users that submitted Douyin URLs or video IDs will be sent to the external TikHub API. This omission matters because users may assume local-only processing, while the skill actually discloses their inputs to a third party and uses a stored API credential to do so.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: The skill sends user-supplied Douyin identifiers and an Authorization bearer token to api.tikhub.io, a third-party service, which creates an external data transmission and trust boundary. In this downloader context that behavior is expected, but it still poses privacy and supply-chain risk because user activity and access tokens are exposed to an external provider not fully described in the manifest.
Content: Scanner excerpt · scripts/douyin_download.py (reported line 27)May include surrounding context.
python
# Constants # --------------------------------------------------------------------------- TIKHUB_API_URL = "https://api.tikhub.io/api/v1/douyin/web/fetch_one_video" DEFAULT_OUTPUT_DIR = os.path.expanduser("~/Downloads/douyin")

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description presents the skill as a downloader, and the usage guidance says to use it whenever a Douyin URL or ID is seen. However, the CLI is implemented so that downloading is optional and the default behavior is only to print the resolved video URL. That is a semantic mismatch between the claimed primary behavior and the actual default operation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest describes a no-login Douyin video download skill, which implies straightforward URL/ID handling and retrieval. The implementation also accesses ~/.openclaw/config.json to obtain a third-party API token, introducing local credential/config file access that is not mentioned in the stated purpose. While this may be operationally necessary, it is still an undeclared capability relative to the manifest's narrow description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.