Security audit

Downloader tiktok videos

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly disclosed TikTok downloader, but it also enables browser-session cookie use, restriction-bypass techniques, and unrestricted HTTPS targets that go beyond a narrowly scoped public-download workflow.

Review before installing. Use this only if you are comfortable with a shell-based downloader that can install or rely on host tools, write downloaded files locally, and make network requests through yt-dlp. Avoid using --cookies-from-browser or cookies.txt unless you understand that those cookies can act like active account credentials. Do not use the bypass, proxy, or geo-bypass guidance to evade platform restrictions, and prefer an isolated environment with pinned dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned System-Wide Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: download_latest.py:48
Finding: Arbitrary HTTPS Targets Accepted Outside the Declared TikTok Scope
Content: View full analysis
str: """Normalize input to a full TikTok URL. Accepts: @username username https://www.tiktok.com/@username https://www.tiktok.com/@username/video/ID https://vm.tiktok.com/shortcode """ raw = raw.strip() if raw.startswith("https://"): return raw # Already a full URL; pass through as-is username = raw.lstrip("@") return f"https://www.tiktok.com/@{username}" ``` The unvalidated destination is then passed to `yt-dlp` for metadata retrieval: ```python def get_metadata(url: str, count: int = 1) -> list[dict]: """Fetch video metadata using --dump-json (one JSON object per line).""" cmd = [ "yt-dlp", "--playlist-items", f"1-{count}", "--dump-json", # Correct flag: prints one JSON object per video to stdout "--quiet", url, ] result = subprocess.run(cmd, capture_output=True, text=True) ``` The download path can additionally instruct `yt-dlp` to access browser cookies before contacting the destination: ```python if cookies: print("⚠️ Cookie file provided — keep cookies.txt private and delete after use.") cmd += ["--cookies", cookies] if cookies_from_browser: print(f"⚠️ Exporting session cookies from {cookies_from_browser} — these are sensitive.") cmd += ["--cookies-from-browser", cookies_from_browser] cmd.append(url) print(f"\n⬇️ Downloading to: {output_dir}") result = subprocess.run(cmd) ``` ### Tech ...[truncated 3053 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (16)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 93% confidence
Finding: The browser-cookie extraction pattern resembles credential harvesting because it accesses active session tokens from a local browser profile. In this skill's context, the purpose is framed as enabling authenticated downloads, but it still creates a high-risk path to sensitive credentials that could be misused, leaked, or retained.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

--merge-output-format mp4
--output "./%(uploader_id)s_%(id)s.%(ext)s"
"{video_url}"

text
## Common Errors | Error | Cause | Fix | |-------|-------|-----| | `HTTP Error 403` | TikTok rate limiting | Add `--sleep-interval 3 --max-sleep-interval 6` | | `Unable to extract` | Outdated yt-dlp | `pip install -U yt-dlp --break-system-packages` | | `Private account` | Private account | Use `--cookies-from-browser chrome` if logged in ⚠️ exports session cookies — keep them private | | `No video formats` | Geo-restriction | Add `--geo-bypass` | | `Sign in required` | Restricted content | Provide cookies via `--cookies cookies.txt` ⚠️ treat this file like a password | | `Merge requires ffmpeg` | ffmpeg missing | `apt-get install ffmpeg -y` | > ⚠️ **Cookie security note:** Browser cookies exported via `--cookies-from-browser` or `cookies.txt` > contain active session tokens. Never share these files, commit them to version control, or pass > them to untrusted scripts. Del

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
- When: Questions about usage rights or Terms of Service - Contains: Usage conditions, permitted and prohibited uses ## Output Guidelines - Always display metadata before downloading (title, date, duration) - Confirm the downloaded file path

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · advanced.md (reported line 29)May include surrounding context.
mp4]+bestaudio/best"
--merge-output-format mp4
--output "./%(uploader_id)s_%(id)s.%(ext)s"
"{url}"

text
List all available formats to check: ```bash yt-dlp -F "https://www.tiktok.com/@user/video/ID"

⚠️ Watermark-free format availability depends on the video creator's settings.

Cookies & Authentication

From the browser (easiest method)

bash
# Chrome yt-dlp --cookies-from-browser chrome URL # Firefox yt-dlp --cookies-from-browser firefox URL # Edge yt-dlp --cookies-from-browser edge URL

From a cookies file (Netscape format)

bash
yt-dlp --cookies /path/to/cookies.txt URL

How to export cookies (manual methods only):

Option A — Chrome DevTools (no extension needed):

Open Chrome, log in to TikTok

Open DevTools (F12) → Application tab → Cookies → https://www.tiktok.com

Manually copy the values you need into a Netscape-format cookies.txt

Option B — Firefox (built-in export):

Open Firefox, log in to TikTok

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 80% confidence
Finding: The skill exposes a capability to export live browser session cookies and pass them into yt-dlp. In an agent-skill context, this is dangerous because cookies are authentication secrets; enabling browser-cookie extraction materially increases the chance of credential/session theft, misuse of authenticated accounts, or exfiltration of sensitive tokens beyond TikTok if a caller abuses the feature.
Content: Scanner excerpt · download_latest.py (reported line 216)May include surrounding context.
python
ult=None, help="Path to archive file (skips already-downloaded videos)" ) parser.add_argument( "--cookies", default=None, metavar="FILE", help="Path to a Netscape-format cookies.txt file (sensitive — keep private)" ) parser.add_argument( "--cookies-from-browser", default=None, metavar="BROWSER", help="Export cookies from browser: chrome | firefox | edge (sensitive)" ) args = parser.parse_args() if not check_ytdlp(): sys.exit(1) # Instructions printed by check_ytdlp() url = normalize_input(args.target) print(f"\n🎯 Target : {url}") print(f"\n📊 Fetching metadata ({args.count} video(s))...") metas = get_metadata(url, args.count) if not metas: sys.exit("❌ Could not retrieve metadata. Check the account name or URL.") for meta in metas: print_metadata(meta) if args.meta_only: print("\n✅ Metadata-only mode — no downl

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly instructs use of shell commands, package installation, and host-level utilities, but it declares no explicit tool scope or permissions boundary. That increases the chance an agent can invoke shell access implicitly and perform actions beyond the user's intended TikTok task without an auditable least-privilege contract.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation text is broad enough to trigger on many generic TikTok-related requests, including scraping, archiving, and metadata extraction, which may exceed user intent or organizational policy. Over-broad invocation is dangerous because it can cause an agent to select a shell-capable download skill when a safer, narrower response would suffice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Guidance to use --cookies-from-browser and cookie files enables access with active authenticated session tokens, expanding the skill from public-content retrieval into authenticated account access. Even with a warning, this creates a credential-handling path that could expose session secrets or let the agent retrieve restricted/private content on behalf of the user.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Referencing advanced techniques such as watermark removal, proxies, custom headers, and restriction bypass extends the skill beyond straightforward download/metadata collection into evasion-oriented behavior. In context, this makes abuse easier by normalizing methods commonly used to bypass platform protections or access controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to extract authenticated TikTok cookies from their browser or a cookies file, which exposes sensitive session credentials that can be reused if mishandled. Although intended to access user-owned sessions, the guidance lacks strong handling restrictions, storage minimization, and warnings that these cookies are equivalent to account access tokens.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The rate-limiting bypass section provides concrete retry and sleep tuning specifically framed as bypass behavior, which exceeds the stated downloader purpose. In a scraping/downloading skill, this makes automated high-volume collection easier and can enable evasion of service protections intended to slow abusive access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The proxy and geo-bypass section goes beyond basic downloading of public TikTok content and explicitly teaches access-evasion techniques. While not inherently malicious, this expands the skill into territory that can facilitate policy circumvention, origin masking, and access to region-restricted content, increasing misuse risk in an automation context.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · download_latest.py (reported line 33)May include surrounding context.
python
def check_ytdlp() -> bool: """Check that yt-dlp is installed. Does NOT auto-install — that is the user's decision.""" try: result = subprocess.run(["yt-dlp", "--version"], capture_output=True, text=True) print(f"✅ yt-dlp {result.stdout.strip()}") return True except FileNotFoundError:

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · download_latest.py (reported line 75)May include surrounding context.
python
"--quiet", url, ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"⚠️ Metadata error:\n{result.stderr[:400]}") return []

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · download_latest.py (reported line 162)May include surrounding context.
python
cmd.append(url) print(f"\n⬇️ Downloading to: {output_dir}") result = subprocess.run(cmd) if result.returncode == 0: files = sorted(output_dir.glob("*.mp4"), key=lambda f: f.stat().st_mtime, reverse=True)

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation includes system-wide package installation and host modification steps that are broader than simply downloading TikTok content. In an agent setting, this expands the blast radius from content retrieval to changing the runtime environment, which can affect system integrity and enable unintended persistence or package misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example sets Accept-Language: en-US,en;q=0.9, which forces a specific language/locale in requests. The file does not provide opt-in, alternatives, or explain why an English locale is required, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Direct Prompt Extraction

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Cookies & Authentication

From the browser (easiest method)

From a cookies file (Netscape format)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Undeclared Tool Scope

Vague Triggers

Context-Inappropriate Capability

Description-Behavior Mismatch

Missing User Warnings

Context-Inappropriate Capability

Context-Inappropriate Capability

subprocess module call

subprocess module call

subprocess module call

Context-Inappropriate Capability

Natural-Language Policy Violations

Static analysis