Douyin Favorites to Knowledge

• Outcome: Review
• Latest audit: Aug 5, 2026 · 12:58 PM UTC
• Version: 2.2.5

Overview

The skill appears purpose-aligned, but it deserves Review because it can create unattended daily sync jobs and its advanced adapter mechanism can run arbitrary local Python modules.

Install only if you want Douyin favorites or explicitly selected likes copied into a local knowledge base, possibly on a daily schedule. Confirm the knowledge directory, transcription provider, and scheduled task details; know how to disable the task later. Use only trusted adapters, keep API keys in environment variables or a secret manager, and avoid Feishu or cloud ASR unless you are comfortable with those external data flows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use shell commands, access environment variables for API keys, read and write local knowledge-base files, and access the network, yet it declares no permissions boundary. Even though the workflow is framed around a legitimate user-authorized sync task and includes privacy-preserving guidance, the absence of explicit permission declarations increases the risk of over-broad execution and weak user consent around sensitive capabilities.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The module docstring advertises 'silent' synchronization, which conflicts with the stated requirement that synchronization source and transcription mode depend on explicit user choice. In a skill that handles account-linked favorites and potentially sensitive media-derived content, language implying non-interactive or implicit syncing can normalize behavior that bypasses consent expectations and lead to unauthorized data processing in downstream implementations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code introduces a fourth transcription path using Bailian/DashScope even though the skill metadata says users should only be offered SiliconFlow, local Whisper, or no transcription. In this skill, transcription sends a Douyin media URL to a third-party cloud service, which can violate user expectations, policy constraints, and privacy boundaries if this path is reachable despite the documented limits.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The setup flow includes promotional/referral behavior and can optionally open a third-party signup URL unrelated to the core local sync function. This expands the tool's behavior beyond user-requested data synchronization and creates an unnecessary external interaction surface, though it does not by itself expose secrets or bypass authorization.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The CLI accepts user-supplied adapter specifications in module:function form and loads them dynamically for collector, enricher, and notifier paths. If an attacker can influence CLI arguments or a workflow invoking this skill, this results in arbitrary Python code execution in the skill's process, which exceeds the stated purpose of syncing authorized Douyin content to a knowledge base.

Context-Inappropriate Capability

Medium

• Confidence: 70% confidence
• Finding: This skill's stated purpose is syncing Douyin favorites/likes into a local Markdown or Obsidian knowledge base, but this file adds an outbound Feishu notification channel not reflected in that purpose. Even though the current payload is minimal, undisclosed external network egress expands the data-flow surface and could be repurposed later for metadata leakage or covert exfiltration, making the mismatch security-relevant.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The plan explicitly records validation using existing WorkBuddy Tencent Cloud SecretId/SecretKey even though the skill policy elsewhere forbids reuse of developer credentials. This is dangerous because it normalizes testing and potentially operating the skill with non-user credentials, creating a path for credential misuse, cross-tenant data exposure, billing on the wrong account, and accidental deployment assumptions based on unauthorized secrets.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: These tests explicitly validate a 'sync' path that silently promotes collected favorites directly into the knowledge base without an approval/review gate. For a skill whose description emphasizes authorized-account data handling and review-oriented workflows, silent persistence of externally collected content increases the risk of unintended data ingestion, privacy mistakes, and unsafe automation of user content.

Context-Inappropriate Capability

Medium

• Confidence: 72% confidence
• Finding: The tests show support for Feishu webhook notification configuration, which expands the skill from local knowledge-base sync into outbound network delivery. Even if the webhook secret is not stored in config, this feature creates an unnecessary exfiltration path for metadata or content derived from a user's Douyin favorites, which is more sensitive in this skill context than in a general alerting tool.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This test confirms that new favorites are written to local Markdown and ledger state without prompting the user. Silent write behavior is dangerous here because the skill processes personal account-derived content, so an accidental run or unexpected source selection could persist private material into a knowledge repository without an adequate review checkpoint.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The daily command writes report files automatically and the test verifies no prompt is shown. While lower impact than direct sync promotion, it still persists account-derived activity into the knowledge base and can create unintended disclosure or audit trails if run in the wrong vault or on a shared machine.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.