Downloader tiktok videos

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:58 AM UTC
• Version: 1.0.4

Overview

The skill is a mostly disclosed TikTok downloader, but it also enables browser-session cookie use, restriction-bypass techniques, and unrestricted HTTPS targets that go beyond a narrowly scoped public-download workflow.

Review before installing. Use this only if you are comfortable with a shell-based downloader that can install or rely on host tools, write downloaded files locally, and make network requests through yt-dlp. Avoid using --cookies-from-browser or cookies.txt unless you understand that those cookies can act like active account credentials. Do not use the bypass, proxy, or geo-bypass guidance to evade platform restrictions, and prefer an isolated environment with pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22
• Finding: Unpinned System-Wide Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-28` **Additional Locations**: `download_latest.py:37-39`, `_meta.json:6-9` **Vulnerability Type**: Unpinned third-party dependency and unsafe system-wide installation guidance **Risk Level**: Medium ### Vulnerable Code ```bash pip install -U yt-dlp --break-system-packages # Linux system Python # or pip install -U yt-dlp # virtualenv / macOS yt-dlp --version # verify install ``` The helper also recommends the same mutable installation source: ```python print(" To install it, run ONE of the following commands yourself:") print(" pip install -U yt-dlp") print(" pip install -U yt-dlp --break-system-packages (Linux system Python)") ``` The dependency declaration specifies only the package name: ```json "dependencies": { "required": ["yt-dlp"], "optional": ["ffmpeg"], "notes": "ffmpeg is required when merging separate video+audio streams (bestvideo+bestaudio format). Without it, yt-dlp will fall back to a single-stream format." } ``` ### Technical Analysis The installation instructions retrieve the latest available `yt-dlp` release without a version constraint, cryptographic hash, lockfile, or documented trusted package index. Consequently, the code ultimately executed by the Skill can change after the Skill itself has been reviewed. The `--break-system-packages` option further weakens isolation by permitting installation into a system-managed Python environment. This can overwrite or conflict with operating-system-managed packages and increases the effect of a compromised or incompatible dependency. The project does not automatically run the installation command, and `check_ytdlp()` only displays instructions when the executable is unavailable. This reduces immediate exploitability, but users following the documented prerequisite procedure remain exposed to supply-chain and environment-integrity risks. ### Attack Pa ...[truncated 1286 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `yt-dlp` to a specifically reviewed version instead of installing the latest release: ```bash python -m pip install "yt-dlp==REVIEWED_VERSION" ``` 2. Publish and verify hashes, preferably through a hash-locked requirements file: ```text yt-dlp==REVIEWED_VERSION --hash=sha256:EXPECTED_HASH ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a dedicated virtual environment or another isolated runtime rather than modifying system Python. 4. Remove the `--break-system-packages` recommendation from both `SKILL.md` and `download_latest.py`. 5. Document the expected package source and use an explicitly configured trusted index. 6. Test and review dependency updates before changing the pinned version. 7. Record dependency versions and hashes in `_meta.json` or a standard lockfile so the reviewed and installed dependency sets are reproducible. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: download_latest.py:48
• Finding: Arbitrary HTTPS Targets Accepted Outside the Declared TikTok Scope<![CDATA[ ## Vulnerability Details **File Location**: `download_latest.py:48-63` **Downstream Locations**: `download_latest.py:65-76`, `download_latest.py:122-165`, `download_latest.py:224-247` **Vulnerability Type**: Insufficient destination validation for outbound requests, compounded by optional browser-cookie access **Risk Level**: Medium ### Vulnerable Code The URL normalization function passes every HTTPS URL through without validating that it belongs to TikTok: ```python def normalize_input(raw: str) -> str: """Normalize input to a full TikTok URL. Accepts: @username username https://www.tiktok.com/@username https://www.tiktok.com/@username/video/ID https://vm.tiktok.com/shortcode """ raw = raw.strip() if raw.startswith("https://"): return raw # Already a full URL; pass through as-is username = raw.lstrip("@") return f"https://www.tiktok.com/@{username}" ``` The unvalidated destination is then passed to `yt-dlp` for metadata retrieval: ```python def get_metadata(url: str, count: int = 1) -> list[dict]: """Fetch video metadata using --dump-json (one JSON object per line).""" cmd = [ "yt-dlp", "--playlist-items", f"1-{count}", "--dump-json", # Correct flag: prints one JSON object per video to stdout "--quiet", url, ] result = subprocess.run(cmd, capture_output=True, text=True) ``` The download path can additionally instruct `yt-dlp` to access browser cookies before contacting the destination: ```python if cookies: print("⚠️ Cookie file provided — keep cookies.txt private and delete after use.") cmd += ["--cookies", cookies] if cookies_from_browser: print(f"⚠️ Exporting session cookies from {cookies_from_browser} — these are sensitive.") cmd += ["--cookies-from-browser", cookies_from_browser] cmd.append(url) print(f"\n⬇️ Downloading to: {output_dir}") result = subprocess.run(cmd) ``` ### Tech ...[truncated 3053 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse destinations with `urllib.parse.urlsplit()` and enforce a strict hostname allowlist: - `www.tiktok.com` - `tiktok.com` - `vm.tiktok.com` - `vt.tiktok.com` 2. Require HTTPS, reject embedded credentials, reject unexpected ports, and reject malformed hostnames. 3. Reject IP-literal destinations and hostnames resolving to loopback, link-local, private, reserved, or cloud-metadata address ranges. 4. Validate the normalized username and direct-video path syntax rather than constructing a URL from arbitrary text. 5. Revalidate every HTTP redirect destination before following it. If `yt-dlp` cannot expose a reliable redirect-validation hook, resolve approved TikTok short links in a restricted preliminary request and verify the final hostname before invoking the downloader. 6. Require separate, explicit user confirmation before enabling `--cookies` or `--cookies-from-browser`. 7. Restrict browser values to documented supported identifiers rather than accepting arbitrary strings. 8. Prefer a narrowly scoped TikTok cookie file over importing an entire browser cookie store, and use a temporary file with restrictive permissions if conversion is required. 9. Run `yt-dlp` with least privilege and, where practical, apply network sandboxing that permits only validated TikTok and required media-delivery hosts. 10. Add tests covering non-TikTok URLs, credential-bearing URLs, alternate ports, misleading subdomains, IP literals, and redirect chains. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

\
  --merge-output-format mp4 \
  --output "./%(uploader_id)s_%(id)s.%(ext)s" \
  "{video_url}"
```

## Common Errors

| Error | Cause | Fix |
|-------|-------|-----|
| `HTTP Error 403` | TikTok rate limiting | Add `--sleep-interval 3 --max-sleep-interval 6` |
| `Unable to extract` | Outdated yt-dlp | `pip install -U yt-dlp --break-system-packages` |
| `Private account` | Private account | Use `--cookies-from-browser chrome` if logged in ⚠️ exports session cookies — keep them private |
| `No video formats` | Geo-restriction | Add `--geo-bypass` |
| `Sign in required` | Restricted content | Provide cookies via `--cookies cookies.txt` ⚠️ treat this file like a password |
| `Merge requires ffmpeg` | ffmpeg missing | `apt-get install ffmpeg -y` |

> ⚠️ **Cookie security note:** Browser cookies exported via `--cookies-from-browser` or `cookies.txt`
> contain active session tokens. Never share these files, commit them to version control, or pass
> them to untrusted scripts. Del

• Confidence: 93% confidence
• Finding: The browser-cookie extraction pattern resembles credential harvesting because it accesses active session tokens from a local browser profile. In this skill's context, the purpose is framed as enabling authenticated downloads, but it still creates a high-risk path to sensitive credentials that could be misused, leaked, or retained.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- When: Questions about usage rights or Terms of Service
- Contains: Usage conditions, permitted and prohibited uses

## Output Guidelines

- Always display metadata before downloading (title, date, duration)
- Confirm the downloaded file path

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

mp4]+bestaudio/best" \
  --merge-output-format mp4 \
  --output "./%(uploader_id)s_%(id)s.%(ext)s" \
  "{url}"
```

List all available formats to check:
```bash
yt-dlp -F "https://www.tiktok.com/@user/video/ID"
```

> ⚠️ Watermark-free format availability depends on the video creator's settings.

---

## Cookies & Authentication

### From the browser (easiest method)
```bash
# Chrome
yt-dlp --cookies-from-browser chrome URL

# Firefox
yt-dlp --cookies-from-browser firefox URL

# Edge
yt-dlp --cookies-from-browser edge URL
```

### From a cookies file (Netscape format)
```bash
yt-dlp --cookies /path/to/cookies.txt URL
```

**How to export cookies (manual methods only):**

Option A — Chrome DevTools (no extension needed):
1. Open Chrome, log in to TikTok
2. Open DevTools (F12) → Application tab → Cookies → https://www.tiktok.com
3. Manually copy the values you need into a Netscape-format cookies.txt

Option B — Firefox (built-in export):
1. Open Firefox, log in to TikTok
2.

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

ult=None,
        help="Path to archive file (skips already-downloaded videos)"
    )
    parser.add_argument(
        "--cookies",
        default=None,
        metavar="FILE",
        help="Path to a Netscape-format cookies.txt file (sensitive — keep private)"
    )
    parser.add_argument(
        "--cookies-from-browser",
        default=None,
        metavar="BROWSER",
        help="Export cookies from browser: chrome | firefox | edge (sensitive)"
    )

    args = parser.parse_args()

    if not check_ytdlp():
        sys.exit(1)  # Instructions printed by check_ytdlp()

    url = normalize_input(args.target)
    print(f"\n🎯 Target : {url}")

    print(f"\n📊 Fetching metadata ({args.count} video(s))...")
    metas = get_metadata(url, args.count)
    if not metas:
        sys.exit("❌ Could not retrieve metadata. Check the account name or URL.")
    for meta in metas:
        print_metadata(meta)

    if args.meta_only:
        print("\n✅ Metadata-only mode — no downl

• Confidence: 80% confidence
• Finding: The skill exposes a capability to export live browser session cookies and pass them into yt-dlp. In an agent-skill context, this is dangerous because cookies are authentication secrets; enabling browser-cookie extraction materially increases the chance of credential/session theft, misuse of authenticated accounts, or exfiltration of sensitive tokens beyond TikTok if a caller abuses the feature.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell commands, package installation, and host-level utilities, but it declares no explicit tool scope or permissions boundary. That increases the chance an agent can invoke shell access implicitly and perform actions beyond the user's intended TikTok task without an auditable least-privilege contract.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation text is broad enough to trigger on many generic TikTok-related requests, including scraping, archiving, and metadata extraction, which may exceed user intent or organizational policy. Over-broad invocation is dangerous because it can cause an agent to select a shell-capable download skill when a safer, narrower response would suffice.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Guidance to use --cookies-from-browser and cookie files enables access with active authenticated session tokens, expanding the skill from public-content retrieval into authenticated account access. Even with a warning, this creates a credential-handling path that could expose session secrets or let the agent retrieve restricted/private content on behalf of the user.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: Referencing advanced techniques such as watermark removal, proxies, custom headers, and restriction bypass extends the skill beyond straightforward download/metadata collection into evasion-oriented behavior. In context, this makes abuse easier by normalizing methods commonly used to bypass platform protections or access controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to extract authenticated TikTok cookies from their browser or a cookies file, which exposes sensitive session credentials that can be reused if mishandled. Although intended to access user-owned sessions, the guidance lacks strong handling restrictions, storage minimization, and warnings that these cookies are equivalent to account access tokens.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The rate-limiting bypass section provides concrete retry and sleep tuning specifically framed as bypass behavior, which exceeds the stated downloader purpose. In a scraping/downloading skill, this makes automated high-volume collection easier and can enable evasion of service protections intended to slow abusive access.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The proxy and geo-bypass section goes beyond basic downloading of public TikTok content and explicitly teaches access-evasion techniques. While not inherently malicious, this expands the skill into territory that can facilitate policy circumvention, origin masking, and access to region-restricted content, increasing misuse risk in an automation context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_ytdlp() -> bool:
    """Check that yt-dlp is installed. Does NOT auto-install — that is the user's decision."""
    try:
        result = subprocess.run(["yt-dlp", "--version"], capture_output=True, text=True)
        print(f"✅ yt-dlp {result.stdout.strip()}")
        return True
    except FileNotFoundError:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--quiet",
        url,
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"⚠️  Metadata error:\n{result.stderr[:400]}")
        return []

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.append(url)

    print(f"\n⬇️  Downloading to: {output_dir}")
    result = subprocess.run(cmd)

    if result.returncode == 0:
        files = sorted(output_dir.glob("*.mp4"), key=lambda f: f.stat().st_mtime, reverse=True)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The documentation includes system-wide package installation and host modification steps that are broader than simply downloading TikTok content. In an agent setting, this expands the blast radius from content retrieval to changing the runtime environment, which can affect system integrity and enable unintended persistence or package misuse.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The example sets `Accept-Language: en-US,en;q=0.9`, which forces a specific language/locale in requests. The file does not provide opt-in, alternatives, or explain why an English locale is required, which conflicts with the language/locale policy criteria.

Static analysis

No suspicious patterns detected.