ClawHub
Back to skill

Security audit

Download-video-tiktok

Security checks for vulnerabilities and agentic risk

Overview

This TikTok downloader is not clearly malicious, but it needs review because it can install software, write downloads, and use browser session cookies for restricted content.

Review before installing. Use it only for public TikTok content you are allowed to download, avoid `--cookies-from-browser` and exported cookie files, preinstall a pinned yt-dlp through a controlled process, and constrain accepted URLs and output paths before running it in a shared or privileged environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
download_latest.py:16
Finding

Unpinned Runtime Dependency Installation into the System Python Environment

Content
View full analysis

Vulnerability Details

File Location: download_latest.py:16-28
Additional Location: SKILL.md:19-25
Vulnerability Type: Unsafe and unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

python
def check_ytdlp():
    """Vérifie que yt-dlp est installé."""
    try:
        result = subprocess.run(["yt-dlp", "--version"], capture_output=True, text=True)
        print(f"✅ yt-dlp {result.stdout.strip()}")
        return True
    except FileNotFoundError:
        print("❌ yt-dlp non trouvé. Installation...")
        subprocess.run([sys.executable, "-m", "pip", "install", "-U", "yt-dlp",
                        "--break-system-packages"], check=False)
        return True

The corresponding documented installation command is:

bash
pip install -U yt-dlp --break-system-packages 2>/dev/null || pip install yt-dlp
yt-dlp --version

Technical Analysis

When yt-dlp is unavailable, the script automatically installs the latest available release from the Python package index configured in the execution environment. No exact version or package hash is specified. Consequently, the dependency resolved during a future invocation may differ from the component that existed when the Skill was reviewed.

The use of --break-system-packages bypasses Python's externally managed environment protection and permits modification of the system Python environment. This expands the scope of a dependency compromise because installation may alter packages used by unrelated applications.

Although the package name is not an apparent typo and no malicious package is embedded in the project, the mutable runtime installation creates a supply-chain trust boundary. A compromised package release, package index, mirror, DNS/network path, or local pip configuration could supply attacker-controlled code. Python packages can execute code during installation and subsequently when thei ...[truncated 1628 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic dependency installation from normal Skill execution. Detect a missing dependency, fail closed, and provide a controlled installation procedure.
  2. Pin yt-dlp to an exact reviewed version rather than using an unconstrained latest release.
  3. Verify package hashes, for example through a lock file or requirements file used with pip install --require-hashes.
  4. Install dependencies into a dedicated virtual environment or immutable container instead of the system Python environment.
  5. Remove --break-system-packages; do not bypass externally managed environment protections.
  6. Use an explicitly trusted package index and disable unintended extra indexes where operationally possible.
  7. Check the installation return code and verify the installed executable and version before continuing.
  8. Update dependencies through a separate reviewed release process that includes integrity verification and vulnerability scanning.

T09 · Insecure Skill Coding Practices

Warning
Location
download_latest.py:34
Finding

Arbitrary HTTPS Targets Accepted Outside the Declared TikTok Scope

Content
View full analysis

Vulnerability Details

File Location: download_latest.py:34-42
Relevant Sinks: download_latest.py:45-59 and download_latest.py:96-116
Vulnerability Type: Unrestricted outbound URL handling and SSRF-like network access
Risk Level: Medium

Vulnerable Code

python
def normalize_input(raw: str) -> str:
    """Normalise l'entrée en URL de profil ou URL directe."""
    raw = raw.strip()
    if raw.startswith("https://www.tiktok.com/@") and "/video/" in raw:
        return raw  # URL directe de vidéo
    if raw.startswith("https://"):
        return raw  # URL courte ou autre
    username = raw.lstrip("@")
    return f"https://www.tiktok.com/@{username}"

The accepted URL is passed to yt-dlp during metadata extraction:

python
def get_metadata(url: str, count: int = 1) -> list[dict]:
    """Récupère les métadonnées sans télécharger."""
    cmd = [
        "yt-dlp",
        "--playlist-items", f"1-{count}",
        "--no-download",
        "--print", "%()j",  # JSON complet
        "--quiet",
        url
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)

It is also passed to the download operation:

python
cmd = [
    "yt-dlp",
    "--playlist-items", f"1-{count}",
    "--format", "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best",
    "--merge-output-format", "mp4",
    "--output", output_template,
    "--sleep-interval", "1",
    "--max-sleep-interval", "3",
    "--retries", "3",
    "--no-playlist" if "/video/" in url else "--yes-playlist",
]

if archive:
    cmd += ["--download-archive", archive]

cmd.append(url)

print(f"\n⬇️  Téléchargement en cours...")
result = subprocess.run(cmd)

Technical Analysis

The Skill is documented as a TikTok downloader, but normalize_input() accepts every string beginning with https:// and passes it directly to yt-dlp. It does not parse or val ...[truncated 2909 chars]

Remediation
View remediation

Remediation Suggestions

  1. Parse input with urllib.parse.urlsplit() instead of relying on string prefixes.
  2. Permit only the exact required TikTok hosts, such as www.tiktok.com, vm.tiktok.com, and vt.tiktok.com; compare normalized hostnames against an explicit allowlist.
  3. Reject URL user information, unexpected ports, malformed hostnames, fragments where unnecessary, and all non-HTTPS schemes.
  4. Validate direct-video and profile paths against expected TikTok URL structures.
  5. Resolve approved hosts defensively and reject loopback, link-local, private, reserved, and otherwise non-public destination addresses where feasible.
  6. Constrain and revalidate every redirect destination. Do not allow a TikTok-looking URL to redirect to an unauthorized host without policy enforcement.
  7. Apply outbound firewall or sandbox rules so the downloader can communicate only with required TikTok/CDN endpoints and cannot reach internal address ranges.
  8. Reject invalid targets before invoking either metadata extraction or download operations, and return a clear validation error.
  9. Add tests for deceptive hostnames, embedded credentials, alternate ports, IPv4/IPv6 private addresses, mixed-case hosts, trailing-dot hosts, and redirect-based bypasses.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (25)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation description is so broad that it triggers on nearly any mention of TikTok, including generic discussion unrelated to downloading or metadata retrieval. Overbroad invocation increases the chance the agent will inappropriately enter a shell-capable workflow and execute risky download or environment-changing steps without clear user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation instructs use of browser-derived cookies and bypass features (--cookies-from-browser chrome, --cookies, --geo-bypass) to access private or restricted content. This goes beyond downloading public TikTok media and can lead to credential/session misuse, unauthorized access, and potential exfiltration of sensitive authentication material.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
96% confidence
Finding

The --cookies-from-browser chrome pattern is high-risk because it directs the agent to access browser-stored session material, a behavior associated with credential theft and unauthorized session reuse. Even if presented as troubleshooting, in this downloader context it materially increases the chance of harvesting or misusing sensitive authentication data.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

ude/%(uploader_id)s_%(id)s.%(ext)s"
"{url_de_la_video}"

text

## Gestion des erreurs courantes

| Erreur | Cause | Solution |
|--------|-------|----------|
| `HTTP Error 403` | Rate limiting TikTok | Ajouter `--sleep-interval 3 --max-sleep-interval 6` |
| `Unable to extract` | yt-dlp obsolète | `pip install -U yt-dlp --break-system-packages` |
| `Private account` | Compte privé | Utiliser `--cookies-from-browser chrome` si connecté |
| `No video formats` | Géo-restriction | Ajouter `--geo-bypass` |
| `Sign in required` | Contenu restreint | Fournir cookies via `--cookies cookies.txt` |
| `Merge requires ffmpeg` | ffmpeg absent | `apt-get install ffmpeg -y` |

## Normalisation du username

```python
# Accepte tous ces formats :
# @moncompte  →  moncompte
# moncompte   →  moncompte
# https://www.tiktok.com/@moncompte  →  moncompte

def normalize(input_str):
    if "tiktok.com/@" in input_str:
        return input_str.split("tiktok.com/@")[-1].split("/")[0]
    return input_s

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The referenced advanced documentation explicitly extends the skill into watermark removal, custom headers, proxies, cookies, and restriction-circumvention techniques that are not reflected in the manifest description. This capability expansion is dangerous because it conceals higher-risk behavior behind a seemingly simple public-content downloader and may enable evasive or unauthorized access patterns.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · advanced.md (reported line 29)May include surrounding context.

tput "/home/claude/%(uploader_id)s_%(id)s.%(ext)s"
"{url}"

text

Lister tous les formats disponibles pour vérifier :
```bash
yt-dlp -F "https://www.tiktok.com/@user/video/ID"

⚠️ La disponibilité du format sans watermark dépend des réglages du créateur de la vidéo.

Cookies et authentification

Depuis le navigateur (méthode la plus simple)

bash
# Chrome
yt-dlp --cookies-from-browser chrome URL

# Firefox
yt-dlp --cookies-from-browser firefox URL

# Edge
yt-dlp --cookies-from-browser edge URL

Depuis un fichier cookies (format Netscape)

bash
yt-dlp --cookies /chemin/vers/cookies.txt URL

Comment exporter les cookies :

  1. Se connecter à TikTok dans Chrome/Firefox
  2. Installer l'extension "Get cookies.txt LOCALLY"
  3. Ouvrir l'extension sur tiktok.com → exporter
  4. Utiliser avec --cookies cookies.txt

Contournement du rate limiting

bash
yt-dlp \
  --sleep-interval 2 \
  --max-sleep-interval 5 \
  --sleep-requests 1 \

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

These steps explicitly instruct users to export TikTok cookies from the browser into a reusable file, which normalizes disclosure and offline reuse of session credentials. That materially increases the chance of credential theft, unauthorized reuse, and leakage through files, backups, shells, or shared environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This plain-text file contains user-facing policy and usage terms almost entirely in French, but it does not provide an opt-in, alternate language, or explanation that the skill is intended only for a French-speaking or region-specific audience. That can violate a language/locale policy when users are forced into a specific language without choice.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill clearly instructs shell execution (pip, apt-get, yt-dlp, ls) but does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization gap where an agent may execute commands broader than users or reviewers expect, increasing the chance of unintended command execution and unsafe environment modification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill includes package installation and system modification steps (pip install, potentially later apt-get) rather than limiting itself to TikTok retrieval logic. Allowing the skill to alter the runtime environment expands its capabilities, raises supply-chain risk, and can be abused to persist changes or install unreviewed software.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill suggests using browser cookies to access private or sign-in-required content without strong warnings about consent, session sensitivity, or policy boundaries. In context, this is more dangerous because the skill is framed as an automatic downloader, making it easier to normalize unsafe handling of authentication material and access-controlled content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Les directives imposent des réponses structurées en français, et l’ensemble de la description opérationnelle force implicitement cette langue sans offrir d’option ou d’opt-in utilisateur. Cela constitue une contrainte de langue/locale non justifiée au regard de la politique demandant un choix explicite ou une justification claire.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is described as targeting public TikTok content, but the documentation adds authenticated access via browser cookies and exported cookie files. That expands the capability from public scraping into access using live session credentials, which can expose account sessions and encourage use beyond the stated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation tells users how to extract browser cookies and reuse them with command-line tooling without clearly stating that cookies are equivalent to active session credentials. This can lead to credential exposure, account takeover risk, and unsafe handling of sensitive authentication material.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The proxy and geo-bypass guidance is not necessary for a simple public-account downloader and provides instructions for evading platform or regional restrictions. In this context, it increases misuse potential by helping operators conceal origin or bypass access controls.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · download_latest.py (reported line 24)May include surrounding context.

python
def check_ytdlp():
    """Vérifie que yt-dlp est installé."""
    try:
        result = subprocess.run(["yt-dlp", "--version"], capture_output=True, text=True)
        print(f"✅ yt-dlp {result.stdout.strip()}")
        return True
    except FileNotFoundError:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This skill exceeds its stated purpose by automatically installing software at runtime, which expands its capabilities from content retrieval to modifying the host environment. In an agent-skill context, unexpected package installation is especially risky because it can execute unreviewed dependency code, alter system state, and surprise operators who expected a narrow TikTok utility.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Executing pip install is a package-management capability not justified by the business function of fetching TikTok metadata or videos. In a hosted or agent environment, this can be abused to change the runtime, pull code from external repositories, and bypass normal change-management expectations, making the skill materially more dangerous than its description suggests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The script automatically runs pip install -U yt-dlp --break-system-packages when yt-dlp is missing, which is a privileged package-management action unrelated to merely downloading TikTok videos. This introduces remote code execution and environment-integrity risk because installing packages executes package-management logic from external repositories and the --break-system-packages flag can modify or destabilize the host Python environment.

Content

Scanner excerpt · download_latest.py (reported line 29)May include surrounding context.

python
return True
    except FileNotFoundError:
        print("❌ yt-dlp non trouvé. Installation...")
        subprocess.run([sys.executable, "-m", "pip", "install", "-U", "yt-dlp",
                        "--break-system-packages"], check=False)
        return True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · download_latest.py (reported line 55)May include surrounding context.

python
"--quiet",
        url
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"⚠️ Erreur métadonnées : {result.stderr[:200]}")
        return []

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · download_latest.py (reported line 115)May include surrounding context.

python
cmd.append(url)

    print(f"\n⬇️  Téléchargement en cours...")
    result = subprocess.run(cmd)

    if result.returncode == 0:
        files = sorted(output_dir.glob("*.mp4"), key=lambda f: f.stat().st_mtime, reverse=True)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation includes yt-dlp commands that create files on disk via --write-info-json and a fixed output path under /home/claude, but it does not warn the user that running the command performs a local write. In an agent skill context, this can cause unintended filesystem side effects, data accumulation, or writes to sensitive/shared locations if the instructions are executed automatically or paraphrased without disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The thumbnail export example uses --write-thumbnail and a concrete output path, which will create local files, yet the documentation does not disclose that side effect. In a skill designed for automated content retrieval, undisclosed writes are riskier because an agent may perform them without the user realizing files are being created.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example explicitly sets Accept-Language: fr-FR,fr;q=0.9,en;q=0.8, which forces a specific locale preference in the request. Under the stated policy, locale-specific behavior should be optional or clearly justified; here it is presented as a default advanced technique without opt-in language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file contains natural-language instructions, usage examples, and help text exclusively in French. Under the stated policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

All headings, labels, and usage guidance are written exclusively in French, with no indication that language choice is optional or that the skill is intentionally region- or audience-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.