Security audit
Security checks for vulnerabilities and agentic risk
This is a Douyin mini-game API reference skill with sensitive platform API examples, but it does not install code, run commands, persist itself, or hide behavior.
Install this as a development reference, not as a runtime component. When using its examples, review privacy and consent requirements for location, microphone, clipboard, uploads, analytics, subscriptions, payments, and deletion APIs before shipping them in a game.
This markdown file contains user-facing natural-language documentation entirely in Chinese, including the main body and examples, but it does not indicate that the skill is region-specific or offer an alternative language option. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- IDE 包大小计算不包含: unix dot 隐藏文件、node_modules、js.map 文件
### 支持的文件类型
png, jpg, jpeg, gif, svg, json, cer, mp3, aac, m4a, mp4, wav, flac, ape, ogg, wma, midi, ogv, webm, mkv, ttc, ttf, woff, otf, obj, dae, fbx, mtl, stl, 3ds, pvr, plist, fnt, gz, ccz, bmp, atlas, swf, ani, part, proto, bin, sk, mipmaps, txt, zip, tt, map, silk, dbbin, dbmv, etc, lmat, lm, ls, lh, lani, lav, lsani, ltc, xml, pkm, scene, csv, prefab, mesh, astc, wasm, br, heic, ico, cur, wasm.br, dat, dds, glb, gltf, ktx, lmani, lml, skel
---
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- IDE 包大小计算不包含: unix dot 隐藏文件、node_modules、js.map 文件
### 支持的文件类型
png, jpg, jpeg, gif, svg, json, cer, mp3, aac, m4a, mp4, wav, flac, ape, ogg, wma, midi, ogv, webm, mkv, ttc, ttf, woff, otf, obj, dae, fbx, mtl, stl, 3ds, pvr, plist, fnt, gz, ccz, bmp, atlas, swf, ani, part, proto, bin, sk, mipmaps, txt, zip, tt, map, silk, dbbin, dbmv, etc, lmat, lm, ls, lh, lani, lav, lsani, ltc, xml, pkm, scene, csv, prefab, mesh, astc, wasm, br, heic, ico, cur, wasm.br, dat, dds, glb, gltf, ktx, lmani, lml, skel
---
The clipboard section demonstrates both reading clipboard contents and writing new clipboard data, which can affect user privacy and overwrite user data. The markdown does not include any caution that these actions access or modify user-controlled data.
This markdown file includes example code to retrieve precise location data, including latitude, longitude, speed, altitude, and accuracy, but does not warn users about the privacy impact of accessing sensitive location information. Under the markdown-specific warning rule, descriptions that could affect user privacy should disclose that behavior.
该 markdown 文件演示了 tt.getRecorderManager() 的录音能力，并直接展示 recorder.start() 开始采集音频，但周围说明未提示这类行为会采集用户麦克风数据，也未提醒开发者应先向用户说明或取得授权。对于会影响用户隐私的数据采集行为，技能说明中缺少显式警示，符合缺少用户告知的情形。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
tt.request({
url: "https://api.example.com/data",
method: "GET", // GET | POST | PUT | DELETE | OPTIONS | HEAD | PATCH
data: { key: "value" }, // Object/String/ArrayBuffer
header: { "Content-Type": "application/json" },
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
tt.request({
url: "https://api.example.com/data",
method: "GET", // GET | POST | PUT | DELETE | OPTIONS | HEAD | PATCH
data: { key: "value" }, // Object/String/ArrayBuffer
header: { "Content-Type": "application/json" },
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
tt.request({
url: "https://api.example.com/data",
method: "GET", // GET | POST | PUT | DELETE | OPTIONS | HEAD | PATCH
data: { key: "value" }, // Object/String/ArrayBuffer
header: { "Content-Type": "application/json" },
This markdown file describes file upload, file download, and HTTP transfer APIs, including sending local files and form data to remote servers, but it does not include any user-facing warning about privacy, data handling, or the risks of transmitting local content. Under the markdown criteria for SQP-2, skills that describe behaviors affecting user data or system integrity should disclose those impacts.
This markdown file describes tt.setUserCloudStorage, tt.getUserCloudStorage, and tt.removeUserCloudStorage for relationship-chain cloud storage, including deletion of tempData, but provides no warning about effects on user data or persistence. Under the markdown-file criteria for SQP-2, data-affecting behavior should be accompanied by disclosure when it can affect user data or integrity.
The tt.requestSubscribeMessage section shows how to request message subscription but does not warn that this enables later user-facing messaging and may have privacy/consent implications. For markdown descriptions, SQP-2 applies when behaviors affecting user privacy are presented without warning.
The data analysis section documents tt.reportAnalytics and tt.reportScene, which transmit event and scene information, but provides no disclosure about collection or transmission of user or usage data. This matches SQP-2 for markdown files because privacy-impacting behavior is described without warning.
The examples include tt.clearStorageSync(), tt.clearStorage(), and fs.removeSavedFile(...) as routine operations, but the document provides no warning that these actions can erase persisted user data. In markdown documentation, safety-relevant behavior that affects user data should be explicitly disclosed.
This markdown file includes examples for deleting files with fs.unlink and later deleting directories recursively with fs.rmdir, but it does not warn that these actions remove user data and may be irreversible. For markdown files, omission of warnings about behaviors affecting user data or system integrity is in scope for SQP-2.
This markdown file documents use of a realtime log manager that uploads logs to a backend, which can affect user privacy or transmit system/application data. The surrounding description provides no warning or disclosure about what may be uploaded or the need to avoid sensitive data in logs.
This plain-text file contains natural-language instructions exclusively in Chinese, and nowhere indicates that users may choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern.
The entire skill file is written only in Chinese, with no indication that language selection is optional or that the skill is intended exclusively for a Chinese-speaking or region-specific audience. Under the stated policy, a fixed language without user opt-in or documented justification is a natural-language policy concern.
The calendar example adds a phone calendar event with an alarm, which changes user data on the device and can trigger future notifications. The section lacks a warning that this operation modifies personal device state and should be clearly disclosed to the user.
The entire skill content is presented only in Chinese, with no indication that the skill is region-specific or that users can choose another language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
No suspicious patterns detected.