Security audit

Douyin Mini Game Unity

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Unity/Douyin API reference that covers sensitive game APIs but does not install or run code itself.

Safe to install as a reference skill, but treat its C# snippets as documentation rather than drop-in production code. Keep debug-command guards, verify payments server-side, avoid production logging of identifiers or launch metadata, require user consent for clipboard and screen recording, and add explicit runtime checks around recording and destructive storage operations.

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file repeatedly states that TT.RegisterCommandEvent must never be present in production, yet this later example still shows privileged GM-style commands such as add_resource and jump_level. Even though guarded with conditional compilation in the snippet, documenting concrete cheat/admin command handlers in a reusable skill makes unsafe copy-paste far more likely and creates a ready-made abuse surface if the guard is removed, misconfigured, or bypassed in downstream projects.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The 'best practice' sample initializes recorder enablement only after a permission check, but the record button handler later calls `_recorder.Start()` unconditionally. This creates a contradictory implementation that can encourage integrators to start screen recording without revalidating authorization or recorder state, increasing privacy-compliance risk and the chance of unauthorized capture attempts.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The example iterates and logs all RefererInfo entries without any development-only guard or warning, even though RefererInfo may contain appId, extraData, and other origin metadata that can be sensitive or privacy-relevant. In a reference skill, sample code is likely to be copied directly into production, so this omission can lead to unintended information disclosure through client logs.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: --- ### 3.10 Rmdir / RmdirSync **说明**: 删除目录。
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: --- ### 3.10 Rmdir / RmdirSync **说明**: 删除目录。
Confidence: 26% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.