ClawHub
Back to skill

Security audit

douyin-research-kit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Douyin research helper, but it routinely directs agents to read browser cookies without enough consent and safety guidance.

Install only if you are comfortable with an agent running yt-dlp locally and giving it access to browser cookies for Douyin. Prefer trying unauthenticated extraction first, use a dedicated browser profile with only the needed Douyin session if cookies are required, and install yt-dlp from a trusted, pinned source where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–29
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
# macOS
brew install yt-dlp

# pip
pip install yt-dlp

# Verify
yt-dlp --version

Technical Analysis

The installation instructions retrieve and install the latest version of yt-dlp available from Homebrew or the Python Package Index without pinning an exact version or verifying a package hash. Consequently, installations are not reproducible, and the package content may change after the Skill has been reviewed.

Although the document states a prerequisite of yt-dlp >= 2024.01.01, this lower-bound requirement neither identifies a reviewed release nor ensures package integrity. Because package installation can execute package build or installation logic, a compromised upstream release, package repository, maintainer account, or transitive dependency could introduce attacker-controlled code.

The exposure is increased by the documented subsequent use of --cookies-from-browser chrome, which gives the installed program access to browser cookie data needed for authenticated Douyin requests.

Attack Path

  1. An attacker compromises a relevant package release, maintainer account, distribution channel, or transitive dependency.
  2. A user follows the documented brew install yt-dlp or pip install yt-dlp instruction.
  3. The package manager retrieves the current, unverified package rather than a previously reviewed and integrity-pinned artifact.
  4. Malicious package installation logic or runtime code executes with the privileges of the installing user.
  5. When the user later invokes yt-dlp --cookies-from-browser chrome, compromised runtime code may access browser cookie material and other resources available to that user.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the installing or invoking user's privileges. The ...[truncated 470 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin yt-dlp to an exact, reviewed release instead of accepting the latest available version.

  2. For Python installations, provide a locked requirements file containing cryptographic hashes and install it with hash enforcement, for example:

    bash
    python -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

  3. For Homebrew installations, document a controlled versioning strategy and verify the expected formula source and artifact checksums.

  4. Install the dependency in an isolated virtual environment or similarly restricted execution environment.

  5. Document trusted package repositories and require review before dependency upgrades.

  6. Verify the installed version and artifact integrity before granting the tool access to browser cookies.

  7. Prefer a dedicated browser profile containing only the minimum Douyin authentication data required for the task.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

tured data from Douyin videos, profiles, and content for research. Powered by yt-dlp locally — no API key required.

Version: 1.0.0 Prerequisite: yt-dlp >= 2024.01.01

Prerequisites

bash
# macOS
brew install yt-dlp

# pip
pip install yt-dlp

# Verify
yt-dlp --version

Authentication

Douyin often requires cookies for stable access. Export browser cookies:

bash
yt-dlp --cookies-from-browser chrome "URL"

Operations

1. Video Metadata

Extract title, creator, engagement stats from a single video.

bash
yt-dlp --dump-json --skip-download --cookies-from-browser chrome \
  "https://www.douyin.com/video/VIDEO_ID"

Key JSON fields:

FieldJSON path
Title / Caption.title / .description
Creator.uploader
Creator ID.uploader_id
Upload date.upload_date (YYYYMMDD → YYYY-MM-DD)
Duration.duration (seconds)
Views.view_count
Likes.like_count (点赞)
Comment

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs use of --cookies-from-browser and separately normalizes access via proxy/China IP notes, which expands the operation from public-content analysis into authenticated, session-backed access. This is dangerous because it encourages pulling browser session material into command execution without warning about credential sensitivity, increasing the chance of over-collection or misuse of authenticated access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The authentication section tells users to export browser cookies but does not explain that this uses active authenticated browser session data. That omission is dangerous because users may unknowingly grant the skill access to account-scoped content and sensitive session context beyond what is necessary for simple metadata extraction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow directs operators to 'ensure cookies are available' and to run commands with --cookies-from-browser as a routine step, normalizing authenticated access for all URL types. In context, this makes the skill more dangerous because cookie extraction is presented as standard operating procedure instead of an exceptional, consent-driven fallback.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This file includes a natural-language usage pattern that hard-codes Chinese as the subtitle language. Because the skill does not present this as optional or ask for the user's preferred language, it can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation explicitly states the skill is not for downloading, yet earlier instructions use --write-sub, --write-auto-sub, and an output path to save subtitle artifacts locally. Downloading subtitle files is still a form of content download, so the stated intent and documented behavior are not fully aligned.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.