Douyin Scraper V2

• Analyzed: May 10, 2026, 6:50 AM
• Findings: 1
• Version: 1.0.0
• Hash: d89da9789428de03d899608884a3a733ad32c228b44ee8c64bb6b0b8ab73669f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates Douyin scraping using Playwright for browser automation and a third-party Baidu PaddleOCR API for text extraction. It is classified as suspicious due to high-risk capabilities and a potential command injection vulnerability in the `SKILL.md` instructions, which direct the AI agent to construct shell commands using unvalidated user input (e.g., `--keyword "<提取的关键词>"`). The workflow involves persisting browser sessions in a local `profile/` directory and exfiltrating captured image data to an external endpoint (aistudio-app.com) for processing, which, while aligned with the stated purpose, presents a privacy and security risk.