Security audit

Douyin Scraper

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Douyin search automation tool, but it needs review because it can trigger browser automation from broad phrases and handles browser session state without enough safeguards.

Install only if you are comfortable with a skill that opens Douyin in an automated browser, sends your search terms to Douyin, and may use saved login state. Do not save or share douyin-auth.json casually, avoid sensitive searches, and prefer a pinned/local browser dependency plus explicit Douyin-specific invocation phrases before routine use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Unpinned Global Installation of a Third-Party Browser Automation Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-27`; also documented in `README.md:19-23` **Vulnerability Type**: Uncontrolled third-party dependency installation **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```bash npm install -g agent-browser agent-browser install ``` The same installation process appears in `README.md`: ```bash # 1. Install the skill through clawhub clawhub install douyin-scraper # 2. Install dependencies npm install -g agent-browser agent-browser install ``` ### Technical Analysis The installation instructions retrieve the latest available version of `agent-browser` from the npm registry without pinning a reviewed version or verifying package integrity. The package is installed globally, expanding the effect of any malicious lifecycle script or compromised package content beyond an isolated project environment. The subsequent `agent-browser install` command may download additional browser components. The project does not specify expected versions, download sources, checksums, package-lock data, or integrity metadata for either installation stage. This does not prove that the current upstream package is malicious. It creates a supply-chain vulnerability in which the code ultimately installed and executed can change after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the upstream npm package, its publisher account, or a later package release. 2. The attacker publishes a malicious version under the expected package name. 3. A user follows the documented `npm install -g agent-browser` instruction without a version constraint. 4. npm retrieves the attacker-controlled version. 5. Malicious package code or lifecycle scripts execute with the privileges of the user performing the installation. 6. The globally installed command remains available to this Skill and other processes using that account. ### Impact Assessment A successful supply-chain compromise could execute arbitra ...[truncated 367 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `agent-browser` to an explicitly reviewed version: ```bash npm install --save-exact agent-browser@<reviewed-version> ``` 2. Install it as a project-local dependency rather than globally. 3. Commit and enforce a lockfile containing npm integrity hashes. 4. Use `npm ci` in automated environments to prevent unreviewed dependency resolution changes. 5. Verify and document the package publisher, registry, expected browser component source, and component checksums. 6. Review lifecycle scripts before installation and consider initially installing with: ```bash npm ci --ignore-scripts ``` 7. Execute the browser tooling in a sandbox or container with access limited to the files and network destinations required for Douyin searches. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/douyin-search.sh:67
Finding: Predictable Temporary Screenshot Path Derived from Unsanitized User Input<![CDATA[ ## Vulnerability Details **File Location**: `scripts/douyin-search.sh:9-47,67` **Vulnerability Type**: Unsafe temporary-file handling and unquoted pathname expansion **Risk Level**: Medium ### Vulnerable Code User input is accepted without a length or character restriction: ```bash QUERY="$*" ``` The value is transformed into `KEYWORD`, but the transformations only remove selected phrases and whitespace: ```bash KEYWORD=$(echo "$QUERY" | sed -E 's/搜索一下//g' | \ sed -E 's/搜索//g' | \ sed -E 's/帮我找//g' | \ sed -E 's/帮我搜//g' | \ sed -E 's/查找//g' | \ sed -E 's/找一找//g' | \ sed -E 's/找一下//g' | \ sed -E 's/我想看//g' | \ sed -E 's/给我搜搜//g' | \ sed -E 's/有没有//g' | \ sed -E 's/我想学习一下//g' | \ sed -E 's/帮我找点//g' | \ sed -E 's/视频//g' | \ sed -E 's/内容//g' | \ sed -E 's/教程//g' | \ sed -E 's/最新的//g' | \ sed -E 's/最火的//g' | \ sed -E 's/高赞的//g' | \ sed -E 's/高清的//g' | \ sed -E 's/实用的//g' | \ sed -E 's/^[[:space:]]*//' | \ sed -E 's/[[:space:]]*$//') ``` The resulting value is embedded in a predictable path in a shared temporary directory and is not quoted: ```bash timeout 10 agent-browser --session douyin screenshot /tmp/douyin-${KEYWORD}.png 2>&1 && echo "📸 页面截图已保存: /tmp/douyin-${KEYWORD}.png" ``` ### Technical Analysis The screenshot filename is predictable and resides directly under the shared `/tmp` directory. The script neither creates the destination atomically nor verifies that it is a regular file owned by the current user. A local attacker may pre-create the ex ...[truncated 2034 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory atomically: ```bash TMP_DIR=$(mktemp -d) || exit 1 chmod 700 "$TMP_DIR" trap 'rm -rf -- "$TMP_DIR"' EXIT SCREENSHOT="$TMP_DIR/screenshot.png" ``` 2. Never place raw user input in a filesystem path. 3. Quote every pathname and variable expansion: ```bash timeout 10 agent-browser --session douyin screenshot "$SCREENSHOT" ``` 4. If a human-readable filename is required, restrict the keyword to an allowlist, impose a length limit, and reject slashes, control characters, wildcard characters, and path traversal sequences. 5. Verify that the output is a regular file and is owned by the invoking user before reporting success. 6. Store screenshots only when required, apply restrictive permissions such as mode `0600`, and delete them when the operation finishes. 7. Replace `set +e` with strict error handling and report success only after confirming that navigation and screenshot creation completed successfully. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Vague Triggers

High

Confidence: 96% confidence
Finding: The README advertises generic phrases like "直接说…即可" and "零代码配置，开箱即用," which imply the skill may activate from broad natural-language utterances without a clear invocation boundary. In an agent environment, this increases the chance of accidental or adversarial triggering during ordinary conversation, causing unintended browser automation and scraping actions.

Vague Triggers

High

Confidence: 98% confidence
Finding: The statement that users do not need to remember complex command formats and can say anything freely encourages unrestricted free-form activation. In a multi-skill or assistant setting, ambiguous activation semantics make prompt-injection-by-conversation and accidental execution materially more likely.

Vague Triggers

High

Confidence: 96% confidence
Finding: The activation patterns are broad enough to match ordinary user requests such as '搜一下' or generic requests to find videos, which can cause the skill to trigger unexpectedly outside a clearly scoped Douyin intent. In an agent environment, overbroad routing can invoke browser automation and scraping behavior without sufficiently explicit user intent, increasing the risk of unintended web actions and data access.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill description, examples, and supported utterances are entirely presented in Chinese and imply Chinese-language-only interaction, but there is no opt-in, language choice, or explicit justification for the locale restriction. This can violate language/locale policy expectations when users are not given a choice.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The supported examples include very generic phrases such as "健身视频" and "查找搞笑段子," which overlap with normal conversation and are not safely distinguishable as tool invocations. This makes false activations plausible, especially when the host agent routes messages based on semantic similarity rather than explicit commands.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README instructs users to save browser session state to a local file but does not warn that such state may contain authentication tokens, cookies, or other reusable credentials. If that file is copied, logged, committed, or accessed by another process, an attacker could hijack the user's authenticated Douyin session.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises session persistence and later instructs saving authenticated browser state, but it does not warn that cookies, tokens, and other account artifacts may be stored locally. If these state files or persistent sessions are exposed, an attacker could reuse them to access the user's Douyin account or associated browsing context.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The example triggers are short, generic phrases that overlap with normal user conversation, making unintended activation plausible. Because the skill automatically navigates to Douyin and submits extracted keywords, a misfire could send unintended queries to a third-party service and start browser actions without clear consent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The phrase encouraging users to 'say anything' makes invocation boundaries ambiguous and increases the chance the agent will treat ordinary conversation as an instruction to launch browser automation. In a skill that opens websites, performs searches, and persists session state, accidental invocation can trigger unintended external actions and data disclosure.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description advertises a very broad natural-language trigger: saying phrases like '搜索一下海鲜视频' can directly invoke the skill from ordinary conversation. Broad invocation patterns increase the chance of accidental or unauthorized activation, especially in voice or chat-driven agent environments where users may mention similar phrases without intending to run browser automation. Because this skill performs web scraping via browser automation, unintended activation has higher practical risk than a passive skill.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The examples include single-topic and very short triggers such as “健身”, “Python”, and similar minimal phrases that are common in ordinary conversation. In an agent environment, this can cause unintended skill activation when a user is merely chatting or asking for general help, leading to unprompted browser automation and scraping behavior.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The conversational examples are broad natural-language requests like '我想看…' or '帮我找点…看看', which closely resemble normal user dialogue and can overlap with benign assistant interactions. Because this skill performs browser-driven scraping, accidental routing of ordinary chat into tool execution increases the risk of unintended external actions and data access.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: User-facing comments, usage examples, prompts, and keyword parsing are all written specifically for Chinese-language input. This enforces a single language/locale behavior without an opt-in choice or explicit justification, which matches the language-policy violation criterion.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The natural-language description is presented only in Chinese and explicitly frames usage through Chinese-language examples, while the activation examples likewise assume Chinese input. There is no indication that users may choose another language or that the locale restriction is documented as a justified region-specific requirement.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The file presents the skill entirely in Chinese and all trigger examples assume Chinese input, but it does not state that the skill is intentionally Chinese-only or offer an explicit language choice. Per policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale limitation is clearly justified.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The skill does not disclose that user search terms and browser activity are transmitted to Douyin during automated scraping. This lack of transparency can lead users to reveal sensitive interests or internal terms to a third-party platform without informed consent.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The script writes a screenshot to /tmp using a filename derived from user-controlled input without sanitizing the keyword or warning the caller that a local artifact will be created. In this browser-automation scraping context, that can lead to unintended local file creation, filename manipulation, overwrite/collision issues, and possible exposure of searched content to other local users or processes monitoring shared temporary storage.

Static analysis

No suspicious patterns detected.