抖音热榜 / Douyin Hot

• Analyzed: May 14, 2026, 6:54 AM
• Findings: 1
• Version: 1.0.5
• Hash: aa9a21e79755e13145e0d276e14d82dd18d940b8be556ce6934d0fcbe1ff014a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is a Douyin hot list fetcher that contains multiple security vulnerabilities. It is susceptible to SQL injection in `scripts/db.py` and `scripts/query.py` because the `days` parameter is inserted into SQL queries using string formatting without proper sanitization. Additionally, `scripts/generate_html.py` produces an HTML report (`data/index.html`) that is vulnerable to Cross-Site Scripting (XSS) because it renders fetched titles directly into the DOM using `innerHTML`. While these flaws allow for potential attacks, there is no clear evidence of intentional malice or data exfiltration.