ClawHub
Back to skill

Security audit

Huo15 Douyin Video Summary

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it automatically gives a video downloader access to local browser cookie stores without clear per-run consent or tight URL scoping.

Review this before installing if you care about browser-session privacy. The skill may let yt-dlp read cookies from Chrome, Safari, or Firefox automatically; prefer an isolated browser profile, a narrowly scoped cookie file, or a version that requires explicit per-run consent and validates Douyin domains before cookie access.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/douyin_download.py:65
Finding

Automatic Browser Cookie-Store Access Triggered by Weak URL Validation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:112
Finding

Unpinned External Skill Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that it will automatically import fresh browser cookies from Chrome/Safari/Firefox, but this sensitive behavior is not prominently disclosed in the top-level description or as an explicit consent step. Accessing browser cookies can expose session material and private account context, making silent or poorly disclosed retrieval especially dangerous in an agent setting.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
91% confidence
Finding

Automatic import of cookies from installed browsers matches credential-access behavior because cookies are authentication artifacts that can grant account access even without passwords. In this skill's context, the stated purpose is media retrieval rather than credential theft, which lowers the likelihood of malicious intent, but the mechanism is still high risk because it touches sensitive browser data and could be abused or over-collect beyond what users expect.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
`

输出：
- `output/video.mp4` — 无水印视频（yt-dlp 从抖音 API 获取无水印源）
- `output/audio.mp3` — 音频（MP3 格式，ASR skill 的标准输入）

**依赖**：`yt-dlp` + `ffmpeg`（macOS: `brew install yt-dlp ffmpeg`）

**无水印原理**：yt-dlp 的 Douyin extractor 从抖音 API 获取 `play_addr`（无水印源），非录屏去水印。抖音需浏览器 fresh cookies，脚本自动从 Chrome/Safari/Firefox 导入（无需登录态）。

---

## 步骤 2：转写（复用 ASR skill）

拿到 `audio.mp3` 后，**调用 `huo15-openclaw-asr` skill** 做转写：

- 本地优先：openai-whisper（`whisper "audio.mp3" --model base --language Chinese`）
- 说话人分离：WhisperX
- 云端（可选）：`huo15-openclaw-asr-bailian`（百炼 Paraformer）

转写产出 `transcript.txt`（逐字原文）。

> 不要在本 skill 内重复实现 ASR——那是 `huo15-openclaw-asr` 的职责。

---

## 步骤 3：内容总结（OpenClaw 自身）

Open

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly instructs running shell-based tooling (python3, yt-dlp, ffmpeg) but declares no permissions or allowed-tools scope. That creates an authorization gap where an agent may invoke shell capabilities without an explicit least-privilege contract, increasing the chance of unsafe execution or misuse through prompt routing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The aliases include broad phrases like '视频总结', '视频转文字', and '去水印下载', which can match many unrelated user requests outside the intended Douyin-only scope. Overbroad triggers can cause accidental invocation of a skill that performs downloading, browser-cookie use, and shell execution in contexts the user did not explicitly intend.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/douyin_download.py (reported line 27)May include surrounding context.

python
def run(cmd, **kw):
    """运行外部命令，失败抛异常。"""
    return subprocess.run(cmd, check=True, **kw)


def check_bin(name):

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest and CLI help describe this as a Douyin video downloader/transcoder, yet the code comment and logic explicitly note '抖音/B站需要浏览器 cookies' and will probe browser cookies whenever the URL contains Douyin, while otherwise still passing arbitrary URLs to yt-dlp. This broadens behavior from a Douyin-specific deterministic helper into a more general video-downloading wrapper around yt-dlp.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script reads cookies from local browsers, which are sensitive authentication artifacts, even though the skill description does not clearly warn that local browser data will be accessed. In an agent-skill context, this is more dangerous because users may invoke a simple 'video summary' capability without realizing it will inspect browser profiles.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Automatically importing browser cookies without a warning or confirmation bypasses informed consent for access to sensitive local data. In a skill ecosystem, this hidden privilege escalation is particularly concerning because the advertised purpose is video downloading/transcoding, not browser credential access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
84% confidence
Finding

This call probes browser-cookie access automatically against a user-supplied URL, causing the script to access sensitive local browser data without explicit user confirmation. While not direct code execution, it expands the trust boundary and can expose authenticated session context to yt-dlp for remote requests, which is risky in a download skill.

Content

Scanner excerpt · scripts/douyin_download.py (reported line 69)May include surrounding context.

python
test_cmd = ["yt-dlp", "--cookies-from-browser", browser,
                        "--no-warnings", "-F", url]
            try:
                subprocess.run(test_cmd, capture_output=True, timeout=30)
                cmd.extend(["--cookies-from-browser", browser])
                print(f"  ↳ 使用 {browser} cookies")
                break

Static analysis

No suspicious patterns detected.