T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_douyin_no_watermark.sh:39- Finding
Douyin domain validation can be bypassed through substring matching
- Content
View full analysis
- Remediation
View remediation
Security audit
Douyin To Photos
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Douyin-to-Photos shortcut helper, but users should understand that shared links go to third-party resolver APIs and downloaded media is added to Photos.
Install only if you are comfortable sending Douyin share links to TikWM or your configured resolver and adding the downloaded video to Photos. Prefer a trusted or self-hosted fallback endpoint, avoid using arbitrary parser APIs, and review the Shortcut so it validates real Douyin hostnames and confirms before saving media.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/shortcut-logic.json:15- Finding
Provider-controlled media URLs are downloaded without destination or content validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description claims end-to-end local Shortcuts automation, Photos import, cleanup, and privacy-safe behavior, but the documented implementation relies on external API resolution and included resources that do not actually provide the full stated workflow. This mismatch can mislead users and reviewers about what executes, what data leaves the device, and which privacy or platform actions are really implemented.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/fetch_douyin_no_watermark.sh`: provider-chain URL resolver with timeout and structured errors.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises shell-backed functionality via an included resolver script but does not declare any tool scope such as shell or network permissions. This creates a transparency and policy-enforcement gap: reviewers and users cannot accurately assess what capabilities the skill needs, and automated guardrails may fail to apply the right restrictions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON manifest accepts input from the share sheet, arbitrary text, and the clipboard, but it does not specify when the skill should activate versus when it should ignore unrelated content. For a manifest-scoped file, that lack of trigger specificity can lead to unintended invocation from common user inputs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow transmits a user-provided Douyin share URL to a third-party API service to resolve the downloadable video URL, but this file shows no disclosure, consent step, or trust boundary warning. Share links can reveal viewing interests, creator relationships, referral data, and other metadata to an external service, creating a privacy leak and possible compliance issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The shortcut automatically saves downloaded media into the Photos app, but this file does not show a confirmation step, provenance warning, or disclosure that external content will be written into the user's library. Saving untrusted remote content directly to Photos can surprise users, pollute personal libraries, and create privacy or content-safety issues if the fetched file is not what the user expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest routes user-supplied Douyin links to configurable third-party API providers, but it does not clearly warn users that shared links are transmitted off-device. This creates a privacy and consent issue because those links may reveal viewing interests, identifiers embedded in share URLs, or other metadata to external services despite the local-storage privacy statement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest allows invocation from generic input types like text and clipboard, but does not specify what exact content qualifies beyond the high-level description. For a manifest file, this leaves activation scope ambiguous and could cause unintended triggering from ordinary shared text or clipboard contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The shortcut is designed to send Douyin share links, potentially sourced from the clipboard, to third-party resolver APIs such as tikwm or a fallback provider. Those links may contain user-specific tracking parameters or private sharing context, and the guide does not require an explicit user-facing disclosure or consent step before transmitting them off-device.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This curl call performs direct external transmission of the provided Douyin URL to a third-party API. In the context of a shortcut meant to process user-shared links, that behavior is expected, but it still creates a privacy and trust boundary because link contents and associated metadata leave the local device.
- Content
sh local share_url="$2" local timeout_sec="$3" curl -fsS --max-time "$timeout_sec" \ -X POST "$api_url" \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode "url=$share_url" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends the user-provided Douyin share URL to a third-party service (tikwm) to resolve a downloadable video URL. Even if functionally necessary, this is still an external disclosure of user-supplied data and can expose viewing/sharing interests, tracking tokens embedded in URLs, or other metadata without any visible consent or notice at this layer.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The fallback path transmits the same share URL to another external API, again disclosing user input to a third party. Because the fallback endpoint is configurable, the privacy risk can increase further if a malicious or untrusted endpoint is supplied, making the data flow less predictable for users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language strings in the errors section force Chinese responses for all users, which can violate language or locale policy when no opt-in or locale selection is provided. There is no accompanying field indicating that the skill is region-specific or that users can choose their preferred language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
All user-facing error messages are hard-coded in Chinese, while the manifest otherwise uses English and does not document a Chinese-only audience or offer locale selection. This creates a language policy concern because the skill appears to force one language without user opt-in or a stated regional limitation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The guide automates saving downloaded media into the Photos library but does not emphasize this with an explicit warning or confirmation in the user flow. While the skill description mentions saving to Photos, omission in the build guide can still lead to unintended persistence of content in a sensitive personal media store.
- Content
Static analysis
No suspicious patterns detected.