Douyin Text Extractor

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.0.3

Overview

The skill mostly matches its Douyin video transcription purpose, but it can install unverified FFmpeg binaries and sends media-derived content to third-party transcription services with incomplete disclosure.

Review the FFmpeg installer before use. Prefer installing FFmpeg yourself from a trusted package manager, or verify any downloaded binary before running the installer. Use limited-scope API keys, configure MCP only for trusted clients, and process only videos whose audio or URL you are comfortable sending to SiliconFlow or Aliyun.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if install_script.exists():
            print("\n🚀 启动 FFmpeg 自动安装...")
            subprocess.run([sys.executable, str(install_script)])
            
            # 验证安装
            installed, version = check_ffmpeg()

• Confidence: 88% confidence
• Finding: subprocess.run([sys.executable, str(install_script)])

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises capabilities that imply access to environment variables, filesystem I/O, networking, and shell execution, but it does not declare permissions or warn users about that access. This creates a trust and consent gap: users may expose API keys, allow local file modification, or trigger network/shell actions without understanding the skill's full operational scope.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The README states that the API key is only stored locally and never uploaded, but the documented transcription workflow necessarily uses that key to authenticate requests to an external speech recognition provider. This is a misleading security/privacy claim that can cause users to make trust decisions based on false assumptions about data flow and secret handling.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatically installing FFmpeg is broader than the advertised extraction function and causes the skill to execute additional code and potentially modify the host system. In an agent or plugin context, such side effects materially increase risk because users may not expect package installation or execution of helper scripts during routine use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that FFmpeg will be automatically downloaded and installed on first use, which means the skill may modify the local system and execute installation-related actions without a prominent warning. Automatic installation expands the attack surface because it introduces remote binary retrieval and system changes that users may not anticipate from a content-extraction skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description emphasizes extraction and download features but does not clearly warn upfront that it stores downloaded videos and generated transcripts in a local output directory. This can lead to unintentional persistence of potentially sensitive or copyrighted content on disk, especially in shared or managed environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The manifest advertises automatic FFmpeg installation but gives no warning that the skill may modify the host system. Silent or poorly disclosed installation behavior increases the risk of unexpected package downloads, privilege prompts, supply-chain exposure, and changes to the execution environment, especially for a media-processing skill likely to run on end-user machines.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest requests API credentials for external AI services but does not clearly warn users that their data and keys will be used with third-party providers. In this skill's context, uploaded or extracted audio/transcripts may contain sensitive content, so missing disclosure increases the chance of unsafe credential handling and unintentional data exfiltration to external APIs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill uploads extracted audio to a third-party transcription API without a strong user-facing disclosure at the point of transmission. This is dangerous because video audio may contain personal, confidential, or copyrighted content, and users may not realize that local media is being sent off-device to an external provider.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill downloads videos and extracts audio into a temporary directory on local disk, but it does not explicitly warn users that local media artifacts will be created during processing. In shared or monitored environments, this can expose sensitive media content, consume disk space, and leave recoverable remnants if cleanup fails or the process exits unexpectedly.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The tool uploads extracted audio to SiliconFlow for transcription, which is a third-party data transfer of user content without a clear just-in-time privacy warning. Because audio may contain personal, confidential, or regulated information, silent transmission to an external service materially increases privacy and compliance risk.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: For the Aliyun path, the tool sends a remote video URL to a third-party transcription provider without an explicit privacy warning or consent gate. Even though it shares a URL instead of raw uploaded bytes, the effect is still external disclosure of user-requested content and may reveal private or access-sensitive media locations.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:69

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:98