Security audit

Douyin Messager | 抖音私信助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly a Douyin messaging/comment automation helper, but its write-action examples use broad page selectors that could send messages or comments to the wrong place under the user's logged-in account.

Install only if you are comfortable letting the agent read Douyin DMs/comments and perform confirmed actions in a logged-in Douyin browser session. Before any send, comment, reply, like, or share, verify the active account, recipient or target content, and exact text yourself; avoid using this with sensitive messages until recipient and composer selection are made stricter.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:175
Finding: Broad DOM Selectors Can Send a Direct Message to an Unintended Conversation
Content: View full analysis
{ const all = Array.from(document.querySelectorAll('*')); for(const el of all) { const t = (el.textContent||'').trim(); const r = el.getBoundingClientRect(); if(t.includes('<目标用户名>') && r.width > 0 && r.height > 0 && r.left > 0) { el.click(); return 'clicked: ' + t; } } return 'not found'; }"} ``` ```javascript browser action=act request={"kind": "type", "selector": "[contenteditable=\"true\"]", "text": "你好，测试消息"} browser action=act request={"kind": "wait", "timeMs": 500} browser action=act request={"kind": "evaluate", "fn": "() => { const btn = Array.from(document.querySelectorAll('*')).find(el => { const r = el.getBoundingClientRect(); const cls = String(el.className || ''); return r.width >= 20 && r.width <= 50 && r.height >= 20 && r.height <= 50 && r.left > window.innerWidth * 0.7 && r.top > window.innerHeight * 0.55 && (cls.includes('send') || cls.includes('PygT7Ced')); }); if(!btn) return 'send button not found'; const r = btn.getBoundingClientRect(); btn.click(); return 'clicked send at ' + Math.round(r.left + r.width/2) + ',' + Math.round(r.top + r.height/2); }"} ``` ```javascript browser action=act request={"kind": "evaluate", "fn": "() => { const input = document.querySelector('[contenteditable=\"true\"]'); if(!input) return 'input not found'; return input.textContent.length === 0 ? 'sent ✓' : 'not sent: ' + input.textContent; }"} ``` ### Technical Analysis The workflow locates a conversation by scanning every DOM element and accepting the first visible element whose aggregated text contains the target name. This does not require an exact name match, does not restrict the search to a validated conversation-row container, and does not verify a stable account ide ...[truncated 3222 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.