douyin-to-obsidian

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:25 PM UTC
• Version: 1.0.0

Overview

This is a real Douyin-to-Obsidian extractor, but it needs Review because it bypasses platform protections, opens broad network paths, and installs an unverified executable dependency.

Install only if you are comfortable with a tool that automates Douyin access and attempts to bypass platform protections. Run it in a dedicated virtual environment or sandbox, use only Douyin links you trust, prefer a manually installed/verified FFmpeg instead of the auto-download path, and point output at a test vault or non-synced folder before using it with important Obsidian notes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/extractor.py:84

Finding

Unverified Remote FFmpeg Binary Download and Execution

Content

View full analysis

0: print( f" Progress: {downloaded/1024/1024:.1f}/" f"{total/1024/1024:.1f} MB", end='\r' ) print(f"\n Download complete: {zip_path.stat().st_size/1024/1024:.1f} MB") # Extract print(" Extracting...") with zipfile.ZipFile(zip_path, 'r') as zip_ref: # Find the directory containing ffmpeg.exe for name in zip_ref.namelist(): if 'bin/ffmpeg.exe' in name: extract_path = zip_ref.extract(name, cache_dir) # Copy executables into the cache root bin_dir = Path(extract_path).parent for file in bin_dir.iterdir(): if file.suffix == '.exe': shutil.copy2(file, cache_dir / file.name) break # Delete archive zip_path.unlink() # Add downloaded executables to PATH os.environ["PATH"] = ( str(cache_dir) + os.pathsep + os.environ.get("PATH", "") ) ``` The downloaded executable is subsequently invoked through `ffmpeg-python`: ```python ( ffmpeg .input(str(full_audio), ss=start_sec, t=end_sec - ...[truncated 2394 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run_extract.py:15

Finding

Arbitrary URL Navigation and Unrestricted Nested Resource Fetching

Content

View full analysis

undefined}); Object.defineProperty(navigator, 'plugins', {get: () => [1, 2, 3]}); """) page = await context.new_page() try: print("Loading page...") await page.goto( video_url, wait_until='domcontentloaded', timeout=60000 ) ``` URLs extracted from remote metadata are fetched without host or address validation: ```python subtitle_url = subtitles[0].get('url') if subtitle_url: try: import requests resp = requests.get(subtitle_url, timeout=10) subtitle_content = self._parse_subtitle(resp.text) except: pass ``` ```python async with aiohttp.ClientSession() as session: async with session.get( audio_url, timeout=aiohttp.ClientTimeout(total=300) ) as resp: audio_data = await resp.read() audio_path.write_bytes(audio_data) ``` ...[truncated 3438 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned and Unverified Python Dependencies

Content

View full analysis

=2.31.0 aiohttp>=3.9.0 ffmpeg-python>=0.2.0 openai-whisper>=20231117 openai>=1.0.0 playwright>=1.40.0 ``` The documented installation command is: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis Every package uses an open-ended lower-bound constraint. A future installation can therefore resolve to package versions that did not exist when the Skill was reviewed. No lock file or cryptographic package hashes are supplied. Python package installation may execute build backend logic, and imported packages execute Python code with the privileges of the invoking process. Consequently, a compromised future package release or dependency can enter the installation without any change to this repository. This finding does not establish that any currently named dependency is malicious. The vulnerability is the lack of version and artifact integrity controls, which makes the installed software set mutable and non-reproducible. ### Attack Path 1. A direct or transitive dependency publishes a compromised release that still satisfies the open-ended version constraint. 2. A user follows the documented `pip install -r scripts/requirements.txt` command. 3. The package resolver selects the compromised release. 4. Installation or build logic executes under the user's account. 5. The compromised package can also execute when imported by the Skill. 6. Malicious code obtains the same file and network access as the Python process. ### Impact Assessment A compromised dependency could execute arbitrary Python or native code with the invoking user's privileges. Potential scope includes: - Reading or modifying user-accessible files - Accessing environment variables and application data - Making arbitrary network requests - Altering extraction resu ...[truncated 300 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_extract.py:64

Finding

YAML Frontmatter Injection Through Remote Video Metadata

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (30)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

pip install -r scripts/requirements.txt

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code contains explicit anti-detection and risk-control bypass behavior, including URL transformation to evade access controls and browser automation stealth settings such as hiding webdriver and disabling security-related features. In the context of a content extraction tool, this broadens the capability beyond normal use and facilitates circumvention of platform protections, increasing abuse potential and making the skill materially more dangerous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly advertises automatic bypass of Douyin slider CAPTCHA and anti-abuse controls, which goes beyond normal content extraction and enters evasion behavior. This is dangerous because it facilitates defeating platform security mechanisms, can enable account or scraping abuse at scale, and increases legal, policy, and operational risk for users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation mentions automatic FFmpeg download but does not prominently and clearly disclose that the skill performs external network requests and retrieves binaries at runtime. This is dangerous because users may unknowingly execute code or install tooling from the network, undermining informed consent and making security review, sandboxing, and enterprise approval harder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README documents automatic FFmpeg/model downloads and browser-driven fetching of third-party content, but it does not clearly warn users that executing the tool will retrieve remote binaries/models and automate a browser against untrusted external sites. In this skill’s context, that omission is more concerning because the feature set explicitly includes anti-bot bypass and remote content extraction, which increases exposure to malicious content, unwanted network activity, and supply-chain risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises capabilities that imply network access, environment interaction, and local file writes, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because users and hosting agents cannot easily understand or constrain what the skill may access, especially since it also performs automatic downloads and writes notes into a local Obsidian directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is entirely framed around Chinese/Douyin-specific extraction and later specifies a Chinese-optimized Whisper model, but nowhere offers language or locale choice. For policy purposes, this can be read as forcing a specific language/locale without explicit opt-in or a clearly documented locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states that extracted content is automatically saved into an Obsidian directory, but it does not clearly warn users up front that local files will be created or overwritten. This can lead to unintended persistence of potentially sensitive or copyrighted content on the user's machine, especially if the default path points to a synchronized cloud-backed notes vault.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The architecture explicitly states that the skill saves a formatted Markdown file into the user's Obsidian directory, but the skill description does not warn users about this filesystem write behavior. That omission can mislead users about where their data is stored and increases the risk of unintended modification of personal notes or sensitive local content, especially because the tool also processes untrusted remote media and transcription output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill automatically downloads and installs an executable dependency from the internet into a user cache directory and places it on PATH without any integrity verification. This creates a supply-chain execution risk: if the remote source, transport path, or downloaded archive is tampered with, the tool may later execute attacker-controlled binaries on the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/extractor.py (reported line 83)May include surrounding context.

python

# macOS/Linux 尝试使用系统包管理器
            print("⚠️ 未找到 ffmpeg，请手动安装：")
            print("  macOS: brew install ffmpeg")
            print("  Linux: sudo apt-get install ffmpeg")
            raise RuntimeError("FFmpeg not found")
    
    def _download_ffmpeg(self, cache_dir: Path):

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description promises a one-click conversion to structured Obsidian notes, which implies note generation or formatting behavior beyond raw extraction. In this file, the main extract flow only returns subtitle/transcription text plus metadata, with no markdown generation, Obsidian frontmatter, or note-writing logic.

Content

No source excerpt is available for this finding.

Tainted flow: 'video_url' from requests.get (line 181, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The function performs a server-side HTTP request to a user-controlled URL when resolving short links. Although it checks for the substring "v.douyin.com", it does not robustly validate the hostname after parsing, so crafted URLs or redirects could trigger unintended outbound requests, creating an SSRF-style primitive and exposing the environment to tracking or internal network access attempts.

Content

Scanner excerpt · scripts/extractor.py (reported line 180)May include surrounding context.

python

try:
            if "v.douyin.com" in video_url:
                print(f"检测到短链，正在解析真实地址：{video_url}")
                resp = requests.get(video_url, allow_redirects=True, timeout=10, headers={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'})
                video_url = resp.url
                print(f"短链已解析为真实链接：{video_url}")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The browser context is hard-coded to locale='zh-CN' and timezone_id='Asia/Shanghai', which imposes a specific language/locale behavior on all users. The file does not offer any opt-in, configuration, or justification that this is a region-specific tool requiring those settings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Whisper transcription call forces language='zh' and uses a Chinese prompt, which constrains output language behavior regardless of user preference. This is a natural-language policy concern because the skill does not present the user with a language choice or document an explicit limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The segmented transcription path repeats the same hard-coded Chinese language and prompt settings, enforcing a single language/locale behavior. Because this applies automatically and without opt-in, it violates the stated language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code includes natural-language instructions and messages in Chinese only, starting with the module docstring and continuing through user-facing prints. Because the skill does not offer user opt-in for language/locale and does not document that it is intentionally region-specific, it creates a language policy risk under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest describes automatic extraction of Douyin video copy into structured Obsidian notes, but this script is hard-wired to create directories and write Markdown files into a specific local Obsidian vault path. Persisting output into a user filesystem location is a stronger side effect than a plain extraction helper and is not evident from the file's own minimal docstring claiming only 'quickly extract' text.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill includes automatic download and management of FFmpeg at runtime, which introduces software retrieval and execution behavior from an external source. While FFmpeg may be functionally relevant for media processing, unattended binary download expands the trust boundary and creates supply-chain and integrity risks if the source, transport, or artifact verification is weak.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The natural-language description says the Whisper recognition is '中文优化', which can imply a forced language/locale preference. Because the file does not clearly state that the skill is intentionally Chinese-only or offer language selection, this may conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README is written entirely in Chinese and describes the Whisper model as '中文优化', implying a Chinese-only language/locale expectation without any opt-in or note that the skill is region/language-specific. Under the policy, locale constraints should either offer user choice or be clearly documented as a justified regional limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill mentions auto-installation, but it does not clearly present automatic downloading of FFmpeg binaries and Whisper model assets as a security-relevant behavior requiring user awareness. Silent or poorly disclosed downloads increase supply-chain and trust risks because executable tools and large model artifacts are fetched during use.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a lower-bound version specifier (requests>=2.31.0) rather than an exact pin, so builds are not reproducible and may resolve to a vulnerable or incompatible release over time. Because this skill performs network operations and may process external content, leaving dependency resolution open-ended increases supply-chain and patch-regression risk.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
aiohttp>=3.9.0
ffmpeg-python>=0.2.0
openai-whisper>=20231117

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin requests, and the package has multiple known advisories across versions, so it is impossible to determine from this file whether the installed version is safe. This is dangerous because the skill performs network-related tasks, and an affected requests release could expose credentials, request integrity, or other sensitive operations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

aiohttp is specified with >=3.9.0, which allows installation of any later release without review. This weakens build integrity and can expose deployments to newly introduced vulnerabilities or breaking behavior in a package commonly used for network-facing functionality.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
aiohttp>=3.9.0
ffmpeg-python>=0.2.0
openai-whisper>=20231117
openai>=1.0.0

Static analysis

No suspicious patterns detected.