抖音相似账号推荐

• Outcome: Review
• Latest audit: Aug 6, 2026 · 2:43 AM UTC
• Version: 1.0.2

Overview

This Douyin analysis skill mostly matches its stated purpose, but it asks agents to persist and reveal API keys and includes an unsafe wrapper that ignores user input.

Review before installing. Use this only if you are comfortable sending Douyin account identifiers and your RedFox API key to RedFox. Do not let the agent write the API key into shell startup files or echo the full key; prefer a temporary environment variable or a dedicated secret manager. Avoid using query_wrapper.py because it ignores your requested account and runs a hard-coded lookup.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (18)

exec() call detected

High

• Category: Dangerous Code Execution

Content

# 直接调用脚本
sys.argv = ['script', '--account_id', '疯狂小杨哥']
exec(open('scripts/douyin_similar_account.py', encoding='utf-8').read())

• Confidence: 96% confidence
• Finding: The wrapper reads a local Python file and executes its contents with exec(), which bypasses normal module import safety and executes arbitrary code in the current interpreter context. If the target file is modified, replaced, or sourced from an untrusted workspace, this becomes arbitrary code execution with the privileges of the agent process.

Direct flow: open (file read) → exec (code execution)

High

• Category: Data Flow

Content

# 直接调用脚本
sys.argv = ['script', '--account_id', '疯狂小杨哥']
exec(open('scripts/douyin_similar_account.py', encoding='utf-8').read())

• Confidence: 98% confidence
• Finding: This is a direct file-read-to-code-execution flow: the file contents from scripts/douyin_similar_account.py are passed straight into exec() without validation. In a skill environment where repository contents may be changed, this creates a clear arbitrary code execution path and is more dangerous than a standard import because the executed code inherits and can alter the current globals and argv.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill describes capabilities to read environment variables, invoke shell commands, access files, and make network requests, but does not declare any permissions or boundaries for those actions. This creates an authorization gap where an agent may exercise powerful capabilities without clear user consent or platform-level restriction, increasing the chance of overreach or unintended side effects.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation instructs the agent to persist a user-supplied API key into shell startup files or Windows user environment settings, causing credential storage and system configuration changes beyond what is necessary for a one-time account lookup. This is dangerous because it can expose secrets to other processes, future sessions, logs, shoulder-surfing during verification, or unintended reuse by unrelated tools.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill advertises a subscription/push-notification feature that is not necessary for similar-account lookup and is not supported by the described implementation details. Expanding scope toward ongoing notifications can normalize collection of additional user data, background actions, or future unsolicited network activity without a clearly defined trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The wrapper hard-codes a specific Douyin account instead of using user-provided input, which contradicts the skill description and can cause unauthorized or misleading processing. In agent settings this can hide the true data flow, produce incorrect outputs, and potentially leak or force queries against a fixed third-party target without user intent.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The workflow appends a subscription/enterprise upsell that is outside the core stated purpose of similar-account recommendation and analysis. This creates a scope-creep and consent problem: a user asking for analysis may be funneled into ongoing notifications or commercial contact without that behavior being clearly declared in the skill’s manifest or gated by explicit user opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill reads local shell startup files and the Windows registry to discover an API key, which expands its access beyond what is necessary for a Douyin account analysis tool. Even though it appears intended to improve usability, inspecting local configuration files exposes unrelated secrets and normalizes secret harvesting behavior from the host environment.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The invocation guidance tells users to describe needs in natural language with no command boundaries, which can cause the skill to trigger on broad, ordinary conversation. In an agent environment, overly broad activation increases the chance of unintended external API use, unintended data disclosure to the skill, or unauthorized actions under the wrong context.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The example intent phrases are ambiguous and overlap with common requests such as competitor analysis or niche research. In context, this makes accidental invocation more plausible, which can route sensitive business or account-related user prompts to the skill and its third-party API without sufficiently clear user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README states users can 'directly use natural language' to invoke the skill, but does not clearly bound activation to narrowly defined Douyin-similar-account tasks. In agentic environments, broad invocation language can cause unintended routing from loosely related user requests, exposing external API use, data retrieval, or subscription actions when the user did not intend this skill to run.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The example trigger phrase about analyzing 'same-track competitor accounts' is ambiguous because it does not explicitly require Douyin or similar-account recommendation context. That ambiguity increases the chance the orchestrator invokes this skill for broader competitor-analysis requests, leading to misrouting, unnecessary third-party API calls, and possible handling of unintended account data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions tell the agent to persist an API key in global shell configuration without warning the user that this changes their system state and stores a sensitive credential long-term. Secret persistence without explicit risk disclosure can lead to accidental exposure through profile inspection, backups, shared accounts, terminal history, or misuse by unrelated software running under the same user profile.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Executing another local Python file via exec() without transparency or isolation is unsafe because users and reviewers cannot easily see what code will actually run or what side effects it may have. In this skill context, the hidden execution path increases risk because the wrapper appears simple while delegating full control to another script in-process.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs sending user-supplied Douyin account identifiers to a third-party API, but provides no privacy notice, consent step, or data-handling disclosure. Even if the identifier is public-facing, transmitting it to an external service can expose user intent, query history, and associated metadata to another controller without transparency.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script reads secrets from shell/profile files without clearly warning the user that it will inspect local configuration files. In an agent/skill context, this is dangerous because users may not expect the tool to parse personal shell profiles, which can contain many unrelated credentials and sensitive settings beyond the RedFox API key.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Having the agent help persist and verify a user-provided API key in global environment settings expands the tool from data retrieval into credential management and host modification. This is risky because it gives the agent a path to write secrets into persistent locations, potentially affecting unrelated tools and increasing the blast radius if the host is shared or compromised.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting guidance includes commands that embed and echo the full API key, which encourages users or agents to reveal the secret directly in shell commands and output. Displaying full credentials can leak them into terminal scrollback, logs, screenshots, shell history, support transcripts, or collaborative sessions.

Static analysis

No suspicious patterns detected.