抖音违禁词检测

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:49 AM UTC
• Version: 1.0.2

Overview

This skill mostly does what it claims, but it also gives explicit advice for disguising flagged wording to get content past moderation and automatically trusts mutable third-party word lists.

Review this before installing if you want a compliance checker rather than a moderation-evasion helper. Disable or manually control updates if you need reproducible results, and do not rely on the downloaded word lists as authoritative because they come from mutable third-party GitHub sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/update_words.py:27

Finding

Automatic Updates Trust Mutable and Unverified Remote Word Lists

Content

View full analysis

Vulnerability Details

File Location: scripts/update_words.py:27-44, 65-69, 124-132; automatic invocation at scripts/check.py:214-220
Vulnerability Type: Unverified supply-chain content retrieved from mutable branches
Risk Level: Medium

Vulnerable Code

python

# Upstream raw file URLs
SOURCES = [
    # konsheng/Sensitive-lexicon
    ("konsheng/Sensitive-lexicon", "广告类型", "https://raw.githubusercontent.com/konsheng/Sensitive-lexicon/main/Vocabulary/%E5%B9%BF%E5%91%8A%E7%B1%BB%E5%9E%8B.txt"),
    ("konsheng/Sensitive-lexicon", "政治类型", "https://raw.githubusercontent.com/konsheng/Sensitive-lexicon/main/Vocabulary/%E6%94%BF%E6%B2%BB%E7%B1%BB%E5%9E%8B.txt"),
    ("konsheng/Sensitive-lexicon", "暴恐词库", "https://raw.githubusercontent.com/konsheng/Sensitive-lexicon/main/Vocabulary/%E6%9A%B4%E6%81%90%E8%AF%8D%E5%BA%93.txt"),
    ("konsheng/Sensitive-lexicon", "色情词库", "https://raw.githubusercontent.com/konsheng/Sensitive-lexicon/main/Vocabulary/%E8%89%B2%E6%83%85%E8%AF%8D%E5%BA%93.txt"),
    ("konsheng/Sensitive-lexicon", "涉枪涉爆", "https://raw.githubusercontent.com/konsheng/Sensitive-lexicon/main/Vocabulary/%E6%B6%89%E6%9E%AA%E6%B6%89%E7%88%86.txt"),
    ("konsheng/Sensitive-lexicon", "其他词库", "https://raw.githubusercontent.com/konsheng/Sensitive-lexicon/main/Vocabulary/%E5%85%B6%E4%BB%96%E8%AF%8D%E5%BA%93.txt"),
    ("konsheng/Sensitive-lexicon", "补充词库", "https://raw.githubusercontent.com/konsheng/Sensitive-lexicon/main/Vocabulary/%E8%A1%A5%E5%85%85%E8%AF%8D%E5%BA%93.txt"),
    # bigdata-labs/sensitive-stop-words
    ("bigdata-labs/sensitive-stop-words", "广告", "https://raw.githubusercontent.com/bigdata-labs/sensitive-stop-words/master/%E5%B9%BF%E5%91%8A.txt"),
    ("bigdata-labs/sensitive-stop-words", "政治类", "https://raw.githubusercontent.com/bigdata-labs/sensitive-stop-words/master/%E6%94%BF%E6%B2%BB%E7%B1%BB.txt"),
    ("bigdata-labs/sensitive-stop-words", "色情类", "https://raw.githubusercontent.com/bigdata-labs
...[truncated 4421 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every remote source to an immutable, reviewed Git commit instead of main or master.
2. Maintain expected SHA-256 hashes or a signed manifest and reject any response that fails verification.
3. Require explicit user consent for updates, or make automatic daily updates opt-in rather than part of ordinary scanning.
4. Enforce a maximum response size while streaming the download instead of calling unrestricted resp.read().
5. Limit line length, total line count, decoded character count, and final unique word count.
6. Validate HTTP status, expected content type, and the final URL after redirects; reject redirects outside the declared raw.githubusercontent.com host.
7. Download into a temporary file, validate all sources, and atomically replace the cache only after validation succeeds.
8. Preserve and automatically restore the last-known-good cache if validation fails or an update produces implausible changes.
9. Record source commit identifiers and verified hashes in .update_state.json to support auditing and rollback.
10. Consider shipping a reviewed baseline word list so the scanner remains functional without granting routine network access.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly recommends using disguised wording to get content past platform moderation, which turns a compliance-checking tool into an evasion aid. In this context, the guidance is not neutral quality control; it materially helps users bypass safety and trust systems on content platforms.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill recommends specific paraphrasing tactics—homophones, symbol splitting, and synonym substitution—that are commonly used to defeat keyword-based moderation. This is directly dangerous because it lowers the barrier for distributing disallowed or deceptive content while avoiding automated enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented invocation phrases are broad natural-language triggers such as '违禁词、敏感词、检测、合规、抖音风控、限流词、能不能发', which can easily appear in ordinary conversation. In an agent environment, this can cause unintentional activation of the skill on unrelated user text, increasing the chance of unnecessary processing or unexpected network activity from the auto-update behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares operational capabilities including local file reads/writes and optional network access, but does not expose an explicit tool-scope or permission boundary. That increases the chance of unintended execution in broader contexts and makes it harder for a host agent or reviewer to enforce least privilege, especially because the skill updates local state and fetches remote content from GitHub.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases include very generic words such as '检测' and '合规', which can cause the skill to activate in unrelated conversations. Over-broad invocation raises the risk that the agent will unnecessarily read user content, perform file operations, or initiate update logic when the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented workflow tells users to repeatedly rewrite text until it passes sensitive-word checks, which operationalizes compliance-avoidance as a process. Combined with the target platforms and moderation-sensitive wordlists, this creates a practical bypass loop rather than a safety review tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all user-facing documentation in a single language and does not state that the skill is Chinese-only or region-specific. Under the language/locale policy rule, forcing one language without user opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, usage instructions, status output, and runtime messages are all Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script automatically fetches remote content from multiple GitHub raw URLs and writes the merged result to a local cache without any explicit user consent, trust verification, or integrity checking. This creates a supply-chain risk: if an upstream repository is compromised or the fetched content is unexpectedly changed, the skill will silently ingest and persist untrusted data into future local scans.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language documentation and user-facing description in the module header are entirely Chinese, which effectively forces a specific language without any opt-in or indication that the skill is region-specific. Under the stated policy, language constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.