ClawHub
Back to skill

Security audit

Douyin Text

Security checks across malware telemetry and agentic risk

Overview

The skill matches its transcript purpose, but it under-discloses sensitive browser-cookie use and relies on a missing hard-coded local script path.

Review this skill before installing. Use --no-cookies unless you specifically need authenticated Douyin access, and avoid browser-cookie import unless you trust the local script that will receive those cookies. Also verify that extract.py exists in the installed skill directory and is the intended code, because this artifact does not include it and references a hard-coded local Windows path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to download a Douyin video, process its audio, and then write a transcript Markdown file to a fixed local path, but the top-level description does not clearly warn users that invoking it causes local downloads and persistent file creation. This can surprise users, create privacy issues, and overwrite expectations about where data is stored, especially when handling third-party media or spoken content.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill supports importing browser cookies or a cookies file for Douyin access, but it does not prominently warn about the sensitivity of browser session data. Using browser cookies can expose authenticated session tokens and potentially grant access to account-scoped content if mishandled, copied, logged, or reused.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.