抖音账号诊断宗师

• Outcome: Review
• Latest audit: Aug 6, 2026 · 2:42 AM UTC
• Version: 1.0.4

Overview

This skill does what it claims, but it uses a built-in RedFox API key and sends account queries to a third-party service with uneven disclosure and broad activation language.

Review before installing. Use a revocable RedFox API key if you proceed, avoid using the embedded default key, and only run the skill when you intentionally want the named Douyin account sent to RedFox for lookup and analysis. Treat generated reports as potentially containing third-party account/profile data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises automatic access to an external service and mentions environment-variable/API-key usage, yet the package declares no explicit permissions. That creates a transparency and policy-enforcement gap: users and platforms cannot easily assess that the skill may read credentials, contact remote endpoints, and potentially write generated reports or artifacts. In a data-retrieval skill that handles third-party account data, hidden capability scope increases the risk of unintended data exposure or unauthorized outbound access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior does not fully match the observed behavior: undeclared report dimensions, dual API paths, and especially a built-in default RedFox API key materially expand what the skill can do beyond what a user would reasonably expect. Embedding a default credential is dangerous because it enables silent third-party calls without user-supplied consent or account control, weakens auditability, and can conceal who is paying for or authorizing the data access.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script embeds a live default RedFox API key and automatically uses it when the operator does not supply one. Hardcoded third-party credentials are a real secret-management flaw because anyone with access to the skill code can reuse the credential, consume the vendor account's quota, and potentially access data or billable API functionality outside the author's intended control.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README states the skill can be invoked through natural-language descriptions without defining clear boundaries, exclusions, or a confirmation step. In an agent environment, this can cause unintended activation on ordinary discussion about Douyin accounts, leading to unprompted external data retrieval and analysis that the user may not have explicitly requested.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example phrases include broad requests such as evaluating or analyzing an account, which are common conversational patterns and can overlap with normal chat. This increases the risk that the skill auto-runs in contexts where the user is only discussing possibilities, competitors, or hypothetical scenarios, causing unintended third-party lookups and disclosure of derived account assessments.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrases are broad enough to match ordinary discussion such as casually asking to 'view' or 'analyze' a Douyin account, which can cause the skill to activate when the user did not intend to initiate third-party data retrieval. In this context, unintended activation is more than a UX issue because it may send account identifiers to an external service and return recent-content details about a third party.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill description does not clearly warn users that it will fetch third-party profile and recent-work data from an external provider and may display detailed recent-content information in the output. Without upfront disclosure, users may unknowingly submit identifiers for external processing, creating privacy, compliance, and consent risks that are heightened because the subject of the analysis may be someone other than the requester.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document exposes an external API for querying Douyin account data, including profile attributes and recent works, but provides no privacy notice, lawful-use constraints, or guidance on handling personal data. In the context of an agent skill that automates account diagnosis, this increases the risk of collecting or processing personal information without user awareness, consent validation, or retention limits.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The workflow instructs the agent to send a Douyin account identifier and retrieve detailed profile and recent works data from an external API, but it does not require any user-facing notice, consent, or data-minimization step before transmission. This is risky because user-supplied identifiers may belong to third parties, and the skill collects and processes profile metadata at a level that can create privacy and compliance issues if users are unaware their query is being sent to a non-platform external service.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The skill transmits user-supplied account identifiers or names to an external third-party endpoint without any in-code consent gate, warning, or minimization controls. In this skill context, external transmission is expected for functionality, but it still creates a privacy and data-sharing risk because user queries and looked-up account data are sent off-platform to Redfox.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends user-supplied Douyin account identifiers and requests profile/activity data from an external RedFox service, but it does not provide an explicit notice or consent boundary about third-party data transmission. In this skill context, external lookup is functionally necessary, but the absence of transparency creates a privacy and data-handling risk, especially if users do not expect account queries to be routed to a non-Douyin third party.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The credential resolution logic silently pulls a key from the environment or falls back to an embedded default without any warning, making secret provenance and handling opaque. This increases the risk of accidental credential misuse, unnoticed use of shared credentials, and insecure operational practices around API access.

Missing User Warnings

Low

• Confidence: 70% confidence
• Finding: The script writes a markdown report containing analyzed account data to a local file without any access control, redaction, or explicit notice in the execution flow. In a skill context that may process third-party account analytics, this can increase privacy and data-handling risk by leaving persistent artifacts on disk that may be read by other local users, logs, backups, or later tooling.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            response = requests.post(url, json=payload, headers=self.headers, timeout=30)
            result = response.json()

            code = result.get("code")

• Confidence: 88% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.