Security audit

Douyin Video Publish

Security checks for vulnerabilities and agentic risk

Overview

This Douyin publishing skill is purpose-aligned, but it needs review because it can post publicly from a live account without a clear final confirmation and it forces a preset location.

Install only if you are comfortable with an agent using your logged-in Douyin creator account. Before use, require a final confirmation that shows the exact video, account, title, hashtags, cover, and location, and remove or override the preset '苏州中心' location unless you explicitly want it attached.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This skill performs an irreversible public publishing action to a real social-media account but does not require an explicit user confirmation immediately before clicking the final publish button. In browser automation, missing a clear warning and confirmation gate can cause accidental public posting, reputational damage, or disclosure of sensitive content, especially if the agent inferred intent from a short command like '发抖音'.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill hard-codes selection of a specific location ('苏州中心') without user opt-in, which can misrepresent where content was created or disclose a location attribute the user did not authorize. Because this is part of an automated publish flow, the agent may silently attach misleading metadata to every post, creating privacy, compliance, and trust risks.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrase "发抖音" is broad and maps to an action that can publish content to an external platform. Because this skill performs browser automation for posting, a short common phrase increases the chance of accidental invocation or ambiguous routing, which could lead to unintended uploads or publication attempts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description says the skill uses browser automation to publish on Douyin, but it does not clearly warn that it may perform a real external posting action on the user's behalf. Without an explicit warning, users may not understand that invoking the skill can automate account actions and publish content publicly, increasing the risk of unintended disclosure or reputational harm.

Static analysis

No suspicious patterns detected.