多平台账号主页视频提取器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.0

Overview

This is a functional bulk video downloader, but it needs review because it sends account and video targets to redfox.hk, can download unvalidated remote media URLs locally, and forces agents to print complete direct links.

Review before installing. Use it only for content you are authorized to collect and store, assume profile/video targets are shared with redfox.hk, run it in an isolated environment, choose a constrained output directory, and avoid using --download on sensitive networks until URL allowlisting and file-size limits are added.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:195

Finding

Skill instructions force Agent output and promotional redirection

Content

View full analysis

**Agent 必须原样展示脚本返回的完整表格，禁止以下行为：** > > * ❌ 禁止删除或合并任何列（发布时间、作品、赞、评论、收藏、分享、资源下载 缺一不可） > > * ❌ 禁止省略翻页提示行 > > * ❌ 禁止省略时间范围筛选提示（"💡 支持输入想提取的作品时间范围…"） > > * ❌ 禁止省略下载询问提示（"💾 需要将这 X 条作品批量下载到本地吗？"） > > * ❌ 禁止用「...」或摘要代替完整表格内容 > > * ✅ 必须逐行展示所有作品的完整信息（含资源下载链接） ``` The corresponding runtime output includes a forced support contact: ```python if fail_count > 0: print(f"\n> ⚠️ 下载失败的视频可能是用户已删除该视频，如需数据核查可联系工作人员邮箱 **{SUPPORT_EMAIL}** 处理。") print(f"\n> 💡 支持输入想提取的作品时间范围，如 `--date-start 2026-07-01 --date-end 2026-07-20`") if success_count > 0: print(f"> 💾 需要将这 {success_count} 条作品批量下载到本地吗？直接告诉我即可。") ``` ### Technical Analysis The Skill does more than define a recommended presentation format. It issues mandatory instructions governing the Agent’s response, explicitly prohibits summarization, and requires the Agent to reproduce complete API-derived tables, resource links, pagination prompts, download prompts, and a third-party support address. These directives alter the Agent’s current-session behavior when the Skill is loaded. They may override user preferences for concise output and compel the Agent to reproduce content obtained from an external API. Since titles, work URLs, and resource URLs originate from the remote service, mandatory verbatim-style reproduction also broadens the exposure of externally controlled content. This behavior is not required to retrieve or download videos. A normal formatting function could return structured results while allowing the Agent and user to decide how much information to display. ### Attack Path 1. The Agent loads `SKILL.md` to execute the video-downloader Skill. 2. The mandatory output rules instruct the Agent not to summarize o ...[truncated 1131 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/base.py:215

Finding

Unvalidated API-controlled URLs enable client-side SSRF and unbounded downloads

Content

View full analysis

bool: """ 下载视频文件到本地 Args: download_url: 视频下载直链 output_path: 保存路径 Returns: bool: 是否下载成功 """ try: resp = requests.get(download_url, timeout=120, stream=True) resp.raise_for_status() total = int(resp.headers.get("content-length", 0)) downloaded = 0 with open(output_path, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): if chunk: f.write(chunk) downloaded += len(chunk) # 验证文件大小 if total > 0 and downloaded < total * 0.9: warn(f" 文件可能不完整: {downloaded}/{total} bytes") return False return True except requests.exceptions.RequestException as e: error(f" 下载失败: {e}") return False except OSError as e: error(f" 文件写入失败: {e}") return False ``` API-controlled values flow directly to this method: ```python # 优先使用作品列表自带的无水印直链（快手），省掉下载接口调用 direct_url = work.get("directVideoUrl") if direct_url: dl_result = { "success": True, "download_url": direct_url, "title": title, "cover": work.get("coverUrl") or "", "duration": None, "resources": [{"type": "video", "downloadUrl": direct_url}], "error": None, } ``` ```python if do_download: dl_url = dl_result["download_url"] pub_time = work.get("publishTime", "") time_part = pub_time[:10].replace("-", "") if pub_time else datetime.now().strftime("%Y%m%d") safe_title = safe_filename(title) VIDEO_EXTS = ("mp4", "mov", "webm", "avi") IMAGE_EXTS = ("jpg", "jpeg", "png", "webp", "gif", "bmp") ...[truncated 3638 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: README.en.md:71

Finding

Unpinned dependency installation creates a supply-chain risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

代码行为与声明存在明显范围不一致。声明描述的是一个完整的多平台主页视频提取与批量下载工具，而当前代码片段仅是 scripts/bilibili.py，实现范围局限于 B站：通过账号主页 URL 获取作品列表，并解析单个作品下载信息。这可以视为整体工具中的一个子模块，但就“所提供代码块实际做什么”而言，其能力明显小于声明内容。未发现额外的未声明敏感能力；问题主要是声明比代码覆盖范围更广。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad multi-platform account-homepage video extraction and batch download capability across four platforms, accepting platform name and account ID/link. The supplied code chunk, however, is narrowly scoped to Douyin only. It also explicitly refuses Douyin homepage links and requires a specific Douyin uniqueName instead, which conflicts with the claim that account links are accepted. Additionally, while it can retrieve a list of works and resolve download info for a single work, there is no explicit batch download implementation in this snippet. The code is related to the general domain of homepage video extraction, but the declared purpose materially overstates platform coverage and accepted inputs for this chunk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description highlights one-click bulk local downloads but does not prominently warn that the skill can consume significant disk space, bandwidth, and alter local system state by writing many files. Because the skill is designed for batch downloading entire account libraries, an accidental or misunderstood invocation could quickly create operational impact on the user’s device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README promotes downloading watermark-free content from third-party accounts for reuse, backup, and competitor analysis without warning about privacy, copyright, consent, or platform terms implications. In this context, the skill materially facilitates large-scale acquisition and downstream reuse of others’ media, making legal, policy, and privacy harms more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README encourages invocation through broad natural-language requests such as generic video download phrases, which increases the chance the skill is triggered when a user did not intend to authorize large-scale scraping or downloading. In this skill’s context, the danger is amplified because execution can lead to bulk retrieval of third-party content and local file writes across multiple platforms.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and instructs use of capabilities that imply environment variable access, local file writes, and outbound network calls, but it does not declare any tool scope or permission boundaries. In an agent environment, this weakens least-privilege controls and can let the skill run with broader access than users or operators expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill actively promotes bulk downloading, backup, and secondary editing/repurposing scenarios without warning about authorization, copyright, or terms-of-service implications. In context, this materially increases the risk of misuse for mass content copying and redistribution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells users to supply account identifiers and links to a third-party service but does not clearly disclose that this data will be transmitted off-platform to redfox.hk. This undermines informed consent and can expose creator identifiers, URLs, and usage patterns to an external party without adequate notice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Overly broad trigger phrases make the skill likely to activate on ordinary requests about downloading videos, increasing the chance that sensitive or policy-relevant actions are taken without clear user intent. In this context, the skill performs third-party API calls and enables bulk downloading, so accidental invocation can expose account identifiers and facilitate unauthorized content acquisition.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The output specification states that results must be produced in a natural-language style for ordinary users, and the entire template and required prompts are fixed in Chinese with mandatory wording. There is no indication that users may choose another language or locale, which creates a locale policy issue.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly requires the agent to print complete downloadable resource links for every work and forbids summarization or omission. That design maximizes bulk extraction and redistribution value, and can expose direct media URLs at scale, making misuse easier and bypassing safer output minimization practices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The validation and description strings explicitly instruct users in Chinese and reject certain inputs based on Chinese-character detection, without offering a language choice. This creates a locale/language constraint in natural-language behavior that is not documented as optional or region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code performs a safety-relevant file write by downloading remote content and saving it to a user-specified local path. While there is progress/output logging, the surrounding user-facing text does not clearly warn that enabling downloads will create local files in the chosen directory, which is the kind of data-affecting behavior this rule covers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown output, warnings, and follow-up prompts are all fixed in Chinese, including mandatory display rules and download prompts. Because the file does not provide any language selection or opt-in, this is a natural-language locale policy issue under the language-choice requirement.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code sends user-supplied account identifiers and metadata to an external API endpoint along with an API key. In the context of a bulk video/account downloader, that transmission can expose targets of scraping, user queries, and potentially copyrighted-content retrieval activity to a third party, creating privacy, compliance, and data-handling risk even if the code is not overtly malicious.

Content

Scanner excerpt · scripts/bilibili.py (reported line 66)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This request submits a user-provided work URL to an external download-parsing service, again with an API key, enabling a third party to observe exactly which videos are being resolved for download. Given the skill's explicit purpose of bulk extraction/downloading across platforms, this increases legal, privacy, and misuse risk because sensitive usage patterns and potentially infringing download activity are exported off-box.

Content

Scanner excerpt · scripts/bilibili.py (reported line 147)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "download_url": None, "title": None, "cover": None,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

User-facing strings such as the module description, class docstring, validation errors, and hints are all presented only in Chinese. Under the language/locale policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The code forwards a user-supplied work URL directly to an external parsing service, which can expose sensitive or internal URLs if a user provides them accidentally or maliciously. In the context of a downloader skill explicitly designed to batch-extract and download third-party content, this broad URL forwarding increases privacy and abuse risk because the service may process arbitrary links without local validation or domain restriction.

Content

Scanner excerpt · scripts/douyin.py (reported line 158)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "download_url": None, "title": None, "cover": None,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/douyin.py (reported line 81)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kuaishou.py (reported line 74)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kuaishou.py (reported line 156)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring, usage examples, and CLI help are written in Chinese and present the tool as operating in that language by default. There is no indication anywhere in this file that users may select another language or locale, which can violate a language-choice policy when the skill is not explicitly region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s user-facing docstrings and error/help messages are written exclusively in Chinese, including prompts such as the description hint and validation errors. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This outbound request sends user-controlled channel data and an API key to an external endpoint, which is a real data-flow/security concern when not paired with disclosure, validation, or clear trust controls. In this skill's context—bulk extraction of creator account content—the external transmission is more sensitive because it can reveal monitoring targets and collection patterns.

Content

Scanner excerpt · scripts/youtube.py (reported line 67)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code sends user-supplied YouTube channel identifiers to an external API along with a persistent API key, but this file provides no notice, consent flow, or minimization of transmitted data. In the context of a bulk account-video extraction skill, this external transmission can expose user queries, target account interests, and operational credentials to a third-party service, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.