douyin-chat-insight

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:49 AM UTC
• Version: 0.2.1

Overview

The skill mostly performs local chat-export reporting, but it needs Review because optional transcription guidance steers users to a referral signup and recommends weak persistent API-key storage.

Install only if you are comfortable using a Chinese-first local chat-export analyzer and reviewing generated reports before sharing them. Do not follow the SiliconFlow referral signup or store API keys in ~/.hermes/.env unless you intentionally want optional cloud transcription; prefer session-scoped credentials or a dedicated secret manager. Keep chat exports local, verify the selected conversation before deep analysis, and avoid giving the skill unrelated directories or private account/session data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: references/optional-douyin-link-asr.md:88

Finding

Mandatory Commercial Referral Instruction Hijacks Agent Responses

Content

View full analysis

Text-based conversation analysis does not require a SiliconFlow or Bailian key. When the user explicitly requests analysis of a Douyin link: > Yes. The core report already covers textual intelligence; link transcription is an optional enhancement. > For Douyin speech transcription, SiliconFlow is recommended: first open https://cloud.siliconflow.cn/i/1srulim9 to register or sign in, then visit https://cloud.siliconflow.cn/account/ak to create a key and set `SILICONFLOW_API_KEY`. > The four-block text report can still be generated without a key. ``` The original instruction identifies this wording as mandatory and embeds the referral URL `https://cloud.siliconflow.cn/i/1srulim9`. ### Technical Analysis The Skill declares a local chat-export analysis function, but its optional ASR documentation instructs the Agent that it must use fixed wording containing a provider-specific invitation URL. The invitation path includes an identifier and differs from the provider's neutral registration or documentation page. When Skill text is loaded as operational instructions, mandatory response templates can alter the Agent's response-selection process. In this case, a request for optional transcription causes the Agent to promote an author-selected referral path rather than neutrally presenting available transcription choices. This behavior is not required to parse local chat exports, generate reports, or explain that ASR is optional. It therefore exceeds the minimum behavior needed for the declared functionality. No code automatically opens the URL or transmits data, but the instruction controls user-facing output and can dire ...[truncated 1244 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/optional-douyin-link-asr.md:59

Finding

Agent-Wide Plaintext API Key Persistence Is Recommended Without Access Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill explicitly discusses probing sibling skills and environment state, including whether a cloud ASR key exists. Even if it only reports presence and claims not to read secrets, undisclosed environment and local-skill enumeration can reveal sensitive system configuration and violate the principle of least surprise for a chat-export analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill explicitly discusses probing sibling skills and environment state, including whether a cloud ASR key exists. Even if it only reports presence and claims not to read secrets, undisclosed environment and local-skill enumeration can reveal sensitive system configuration and violate the principle of least surprise for a chat-export analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill explicitly discusses probing sibling skills and environment state, including whether a cloud ASR key exists. Even if it only reports presence and claims not to read secrets, undisclosed environment and local-skill enumeration can reveal sensitive system configuration and violate the principle of least surprise for a chat-export analysis tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill explicitly discusses probing sibling skills and environment state, including whether a cloud ASR key exists. Even if it only reports presence and claims not to read secrets, undisclosed environment and local-skill enumeration can reveal sensitive system configuration and violate the principle of least surprise for a chat-export analysis tool.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/optional-douyin-link-asr.md (reported line 60)May include surrounding context.

bash

export SILICONFLOW_API_KEY='你的key'
# 或写入 ~/.hermes/.env 后重启 Agent

4. 价格参考：https://siliconflow.cn/pricing

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/doctor.py (reported line 69)May include surrounding context.

python

# unit tests (skip nested doctor test via env)
    import os
    env = os.environ.copy()
    env["CVI_DOCTOR"] = "1"
    t = subprocess.run(
        [sys.executable, "-m", "unittest", "discover", "-s", "tests", "-q"],

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

本机共享（Hermes / Codex / Claude 等）

bash

mkdir -p ~/.shared/skills
ln -sfn "$(pwd)" ~/.shared/skills/douyin-chat-insight
# 若已装 publish-agent-skill：
python3 ~/.shared/skills/publish-agent-skill/scripts/link_shared_skill.py douyin-chat-insight --apply

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

本机共享(Hermes / Codex / Claude 等)

bash

mkdir -p ~/.shared/skills
ln -sfn "$(pwd)" ~/.shared/skills/douyin-chat-insight
# 若已装 publish-agent-skill:
python3 ~/.shared/skills/publish-agent-skill/scripts/link_shared_skill.py douyin-chat-insight --apply

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document’s substantive guidance from the section headings onward is presented in Chinese, which imposes a specific language on readers without any opt-in or stated locale limitation. Under the policy rule, this is a natural-language locale constraint because users who do not read Chinese may be unable to understand required security instructions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares shell, file read/write, and environment access capabilities implicitly but does not scope or constrain them in metadata. In an agent setting, missing explicit tool restrictions increases the chance the model will invoke broader local actions than users expect, especially when handling sensitive chat exports and environment variables.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This file encodes rule keywords and notes entirely in Chinese, such as "硬事实" and "禁止默认多页 PPT", which imposes a specific language/locale in the skill content. There is no indication in the file that Chinese is optional, user-selected, or required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all user-facing positioning, release, and usage guidance exclusively in Chinese. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/INSTALL.md (reported line 35)May include surrounding context.

链到 Agent 能发现的目录，例如：

bash

mkdir -p ~/.shared/skills
ln -sfn "$(pwd)" ~/.shared/skills/douyin-chat-insight

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/INSTALL.md (reported line 35)May include surrounding context.

链到 Agent 能发现的目录,例如:

bash

mkdir -p ~/.shared/skills
ln -sfn "$(pwd)" ~/.shared/skills/douyin-chat-insight

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Line L13 requires errors to be shown in Chinese ("中文错误") but does not offer any user language choice or explain a justified locale restriction. This is a natural-language policy concern because it mandates a specific language for user-facing behavior without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document is entirely written in Chinese and gives no indication that other languages are supported or that the Chinese-only requirement is optional. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The sample conversation metadata and all visible user-facing content are exclusively in Chinese, indicating a locale-specific interaction format without any stated user opt-in or alternative language option. This can violate language/locale policy when a skill or example constrains usage to a single language without documenting that limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The note instructs reviewers to follow a Chinese-language report format and references Chinese-language criteria throughout the file, while the artifact provides no opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill file is written in Chinese and presents the input format requirements only in that language, with no indication that other languages are supported or that Chinese is an opt-in preference. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document is entirely written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file presents all routing guidance in Chinese and does not mention any language selection, alternative locale, or that Chinese is a justified region-specific requirement. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list is broad and includes generic terms like '群聊分析', '聊天记录', and '会话分析', which can cause the skill to activate for loosely related requests rather than only explicit export-analysis tasks. In this skill’s context, unintended activation is meaningful because the skill is designed to process potentially sensitive private/group chat exports, so overmatching raises privacy and misrouting risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The returned field user_guidance_zh hard-codes all user-facing guidance in Chinese. This imposes a specific language on users without any opt-in or alternative locale path, which matches the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code sets default_locale to zh by default, which imposes a specific language setting in the skill behavior. The stated policy flags language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function enumerates other installed skills under multiple tool-specific directories and also probes whether API-key environment variables are present, even though this skill’s stated purpose is offline chat-export analysis. That creates unnecessary local-environment discovery and metadata collection that can reveal unrelated user tooling and credential presence, which is privacy-invasive and may enable profiling or conditional behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.