抖音搜索爬虫

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 1.2.0

Overview

This is a coherent Douyin scraper, but it asks agents to run browser scraping and file-writing commands without confirmation while using unsafe browser and installation defaults.

Install only if you are comfortable with a scraper that downloads browser automation components and runs Chromium against Douyin pages. Use an isolated, unprivileged environment with no sensitive files mounted, pin reviewed dependency versions, avoid running as root, and require confirmation before scraping or writing output files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scraper.py:87

Finding

Browser sandbox is explicitly disabled while processing remote web content

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Executable dependencies and browser components are not reproducibly pinned

Content

View full analysis

=1.40.0 ``` The primary installer does not use a lock file and requests the latest available Playwright package: ```bash source venv/bin/activate pip install --upgrade pip pip install playwright # 安装浏览器 echo "" echo "🌐 正在安装 Playwright 浏览器..." playwright install chromium ``` The alternative installer also permits mutable version and download-source selection: ```python PLAYWRIGHT_VERSION = os.environ.get("PW_VERSION", "1.50.0") IMAGE_TAG = f"mcr.microsoft.com/playwright/python:v{PLAYWRIGHT_VERSION}-noble" ``` ```python def mode_native() -> None: env = os.environ.copy() env.setdefault("PLAYWRIGHT_DOWNLOAD_HOST", "https://npmmirror.com/mirrors/playwright") env.setdefault("PLAYWRIGHT_CHROMIUM_DOWNLOAD_HOST", "https://cdn.npmmirror.com/binaries/chrome-for-testing") venv_python = Path("venv/bin/python") venv_pip = Path("venv/bin/pip") if not venv_python.exists(): run([sys.executable, "-m", "venv", "venv"]) run([str(venv_pip), "install", "-r", "requirements.txt"], env=env) run([str(venv_python), "-m", "playwright", "install", "chromium"], env=env) ``` ### Technical Analysis `playwright>=1.40.0` allows any later release to be selected at installation time. Moreover, `install.sh` bypasses even that lower-bound declaration and installs `playwright` without a version constraint. Consequently, two installations of the reviewed project can receive different package code. The installation subsequently downloads and executes a Chromium binary associated with the resolved Playwright package. The native installer defaults browser downloads to external mirror domains and permits inherit ...[truncated 1641 chars]

Remediation

View remediation

`. - Generate and commit a lock file containing cryptographic hashes for all transitive Python dependencies. Install with hash enforcement, such as `pip install --require-hashes`. - Make `install.sh` install from the locked requirements file rather than running unconstrained `pip install playwright`. - Pin the Playwright container image by immutable digest, not only by tag. - Use trusted first-party artifact sources where possible. Do not silently default to third-party mirrors. - Reject or explicitly validate externally supplied download-host environment variables in security-sensitive or automated installations. - Record and verify expected checksums or signatures for downloaded browser artifacts where the distribution mechanism supports it. - Run dependency installation in an isolated, unprivileged build environment without production secrets. - Add automated dependency review and vulnerability scanning before updating locked versions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scraper.py:270

Finding

User-controlled output paths permit unrestricted file overwrite

Content

View full analysis

None: output.write_text( json.dumps([i.to_dict() for i in items], ensure_ascii=False, indent=2), encoding="utf-8", ) def write_csv(items: list[VideoData], output: Path) -> None: if not items: output.write_text("", encoding="utf-8") return fieldnames = list(items[0].to_dict().keys()) with output.open("w", newline="", encoding="utf-8") as f: writer = csv.DictWriter(f, fieldnames=fieldnames) ``` The path is accepted directly from command-line input: ```python if args.output: output = Path(args.output) if args.format == "csv": write_csv(items, output) else: write_json(items, output) print(f"\n💾 已保存到 {args.output}", file=sys.stderr) ``` The JavaScript implementation has equivalent behavior: ```javascript function saveToJson(videos, filepath) { fs.writeFileSync(filepath, JSON.stringify(videos, null, 2), 'utf-8'); console.log(`💾 已保存到: ${filepath}`); } ``` ### Technical Analysis Neither implementation restricts output to a dedicated export directory, checks whether the destination already exists, rejects absolute paths or `..` traversal, or protects against symbolic-link targets. Standard write operations truncate existing files and follow symbolic links. This is particularly relevant in the skill context because `SKILL.md` instructs the agent to execute mapped scraper commands directly without additional confirmation. If an untrusted request can influence the generated `--output` value, it can direct the agent to overwrite any writable path available to th ...[truncated 1767 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is scraping Douyin content, but the skill also includes bootstrap and dependency installation instructions such as pip installation and browser binary installation. This expands execution from task-specific scraping into environment modification, which can surprise operators, increase supply-chain risk, and cause the agent to run setup commands not clearly scoped by the skill description.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · install_playwright_docker.py (reported line 30)May include surrounding context.

python

def mode_native() -> None:
    env = os.environ.copy()
    env.setdefault("PLAYWRIGHT_DOWNLOAD_HOST", "https://npmmirror.com/mirrors/playwright")
    env.setdefault("PLAYWRIGHT_CHROMIUM_DOWNLOAD_HOST", "https://cdn.npmmirror.com/binaries/chrome-for-testing")
    venv_python = Path("venv/bin/python")

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises executable shell commands, file output, and environment-related setup behavior but does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations increase the chance of over-privileged execution, unintended file writes, or shell access being granted implicitly when the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language matching rules are broad enough that many ordinary Douyin-related requests could automatically trigger browser automation and scraping. In an agent setting, this can cause unintended command execution, external network access, and data collection when the user did not explicitly ask to run a scraper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to execute scraping commands without confirmation, including variants that write output files. This removes an important consent checkpoint and can lead to unintended scraping, network activity, and filesystem modifications, especially when user requests are ambiguous or casually phrased.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples state that the agent will automatically convert natural-language requests into scraper commands, but they do not define clear trigger boundaries, confirmation requirements, or exclusions. This can cause ordinary conversational text to be interpreted as an actionable scraping request, leading to unintended browser automation or data collection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger examples are generic phrases like everyday user speech, which are likely to overlap with normal conversation. In an agent environment, this increases the chance of accidental activation and unintended execution of scraping actions, especially if the agent routes free-form chat directly into the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script presents all user-facing messages and usage guidance in Chinese, including installation status and next-step instructions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · install_playwright_docker.py (reported line 14)May include surrounding context.

python

def run(cmd: list[str], cwd: str | None = None, env: dict[str, str] | None = None) -> None:
    print("\n>>>", " ".join(cmd))
    subprocess.run(cmd, cwd=cwd, env=env, check=True)


def mode_official() -> None:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The browser context is hard-coded to use locale 'zh-CN', which imposes a specific language/locale behavior on all runs. The file does not offer a user opt-in or configuration path for other locales, nor does it document a clear policy justification for the restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description says the skill supports '获取热榜', implying hot-list retrieval is a working capability. However, the only hot-list method logs that the feature requires login and is unavailable, then always returns an empty array. This is a direct mismatch between the advertised behavior and actual code behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code hard-codes locale="zh-CN" for every browser context, which imposes a specific locale on all users without opt-in. The policy allows locale constraints only when the user is given a choice or when the restriction is clearly documented and justified as region-specific, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A natural-language policy issue exists when a skill effectively forces a specific language without user opt-in. This README presents all instructions and warnings only in Chinese and does not indicate any alternative language support or explicit locale limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The markdown includes multiple examples that persist scraped results to local files, which affects user data and the local filesystem. Although there are general platform-usage cautions, the README does not explicitly disclose that running these commands will create or overwrite output files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language interface, invocation rules, and user guidance are entirely in Chinese, which effectively imposes a single language for use. The file does not offer multilingual use, opt-in language selection, or explain that the skill is intentionally restricted to a Chinese-language audience for a documented reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

All user-facing examples and instructions are presented only in Chinese, with no indication that other languages are supported or that Chinese is a justified region-specific requirement. This can violate language/locale policy when a skill implicitly enforces one language without user opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower-bound only (playwright>=1.40.0), which allows future major or minor releases to be installed without review. That can introduce breaking changes or a compromised/upstream-vulnerable version into the scraping skill's browser automation stack, reducing build reproducibility and increasing supply-chain risk.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

playwright>=1.40.0

Static analysis

No suspicious patterns detected.