抖音账号视频批量下载器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.0

Overview

This Douyin downloader is mostly coherent, but it needs review because it sends account and work links to a third-party API and downloads API-supplied URLs without enough safety limits.

Review before installing. Use this only for content you are allowed to download, understand that Douyin IDs and work URLs are sent to redfox.hk, run it in a constrained environment if downloading, choose a bounded output directory, and monitor disk usage. Prefer a virtual environment with pinned dependencies and avoid using high-privilege API keys or running the downloader with elevated system permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/douyin_video_downloader.py:437

Finding

Server-Side Request Forgery Through Unvalidated Media Download URLs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/douyin_video_downloader.py:477

Finding

Unbounded Streaming Downloads Can Exhaust Local Storage

Content

View full analysis

0 and downloaded < total * 0.9: warn(f" 文件可能不完整: {downloaded}/{total} bytes") return False ``` ### Technical Analysis The downloader streams response data directly to disk without enforcing a maximum file size or a cumulative download quota. The `Content-Length` header is read only after the request begins and is used solely to detect an apparently incomplete download. This check does not protect against oversized content because: - A server may omit `Content-Length`. - A server may use chunked transfer encoding. - A server may provide a false or extremely large length. - The downloaded-byte counter is never compared against a safe upper bound. - A read timeout does not impose an overall transfer deadline while data continues to arrive. - Files that fail the completeness check remain on disk. - Direct writes to the final path can leave partial files after network or filesystem errors. ### Attack Path 1. A malicious or compromised parsing response supplies a media URL controlled by the attacker. 2. The user enables `--download`. 3. The endpoint returns an extremely large response, a continuously generated response, or chunked data without a usable `Content-Length`. 4. The downloader continuously writes the response to the output path because no byte limit is enforced. 5. Available disk space is consumed, or the process occupies resources for an excessive duration. 6. The partia ...[truncated 561 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:109

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description emphasizes automatic batch downloading to the local device but does not warn users that the skill can create or overwrite files, consume substantial disk space, or download large volumes of external media. Because this tool is explicitly designed for bulk local writes, the missing warning materially increases the chance of unexpected disk impact or unsafe use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README tells users they can 'just describe what you need in natural language' and includes very generic example phrases, which can cause the skill to activate on broad, everyday requests without clear user acknowledgment of side effects. In this skill, activation can lead to fetching external content and initiating local batch downloads, so overbroad invocation guidance increases the risk of unintended actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes parsing watermark-free direct links and bulk-downloading Douyin content to local storage, but it provides no warning about authorization, copyright, terms-of-service restrictions, or the risks of writing large batches of files locally. In context, this increases the likelihood of misuse for unauthorized copying or archival of third-party content, even if the document does not itself contain executable malicious logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation describes sending Douyin account IDs and work links to redfox.hk APIs but does not clearly warn users that these identifiers and links are transmitted to a third-party service. This lack of transparency undermines informed consent and can expose user-supplied targets, lookup activity, and derived content URLs to an external operator without the user realizing it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary user requests such as asking to download or fetch Douyin videos, which increases the chance the skill will activate when the user did not intend to use this specific third-party downloader. Because the skill sends account identifiers and content links to an external API and can perform local downloads, unintended invocation can cause unanticipated data disclosure and actions on the user's system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code transmits account identifiers and related request metadata to an external API endpoint controlled outside the local environment. In an agent skill, external exfiltration is security-relevant because user inputs may be sensitive, and the skill offers no minimization, consent gate, trust validation, or alternative local processing path.

Content

Scanner excerpt · scripts/douyin_video_downloader.py (reported line 287)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            _record_failure(account_id)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sends user-supplied account identifiers to a third-party service and later sends work URLs for parsing, but it does not provide a clear privacy disclosure or consent prompt at the point of transmission. In a skill context, this can expose user interests, monitored accounts, or investigative targets to an external operator without sufficiently explicit notice.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This second outbound request sends work URLs to an external parsing API, potentially disclosing the specific content being investigated or downloaded. In security-sensitive or investigative workflows, that metadata can reveal targets, interests, or monitoring activity to the third-party API provider.

Content

Scanner excerpt · scripts/douyin_video_downloader.py (reported line 379)May include surrounding context.

python

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "download_url": None, "title": None, "cover": None,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The comment block says callers must display '完整资源下载链接' and '逐行展示所有作品信息（含完整资源下载链接）'. However, the table-building code only keeps one link per resource type using seen_types, so additional video/image/audio links in the same work are not shown.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline comment describes '合并展示视频/封面/音频所有可点击下载链接', implying all links are included. The loop immediately gates additions on rtype not in seen_types, which contradicts that claim by dropping subsequent links of the same type.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When --download is provided, the script immediately creates the output directory and later saves media files locally, but there is no confirmation prompt before performing the write operation. Although the script logs progress, it does not disclose this side effect at the moment of execution beyond the flag name itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

A language policy issue applies across all file types when a skill forces a specific language without user opt-in. This README presents all operational guidance in Chinese only, with no indication that users may select another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.