douyin-video-parser

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed Douyin video transcription tool whose network, browser, model-download, and local file behaviors fit its stated purpose, with some install and local-temp safety caveats.

Install only if you are comfortable with a skill that runs Python, installs third-party packages, downloads a Whisper model, opens a headless browser, accesses Douyin/CDN network resources, and writes local transcript/report files. Use a dedicated output directory, avoid privacy-sensitive videos on shared machines, and prefer a virtual environment with pinned dependencies if you need stronger reproducibility.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:56

Finding

Unpinned third-party dependencies and remotely downloaded model artifacts

Content

View full analysis

10_000_000: model = WhisperModel(local_model, device="cpu", compute_type="int8") else: model = WhisperModel( model_size, device="cpu", compute_type="int8", download_root=MODEL_DIR, ) ``` ### Technical Analysis The documented installation procedure retrieves `faster-whisper` and `websocket-client` without pinned versions, package hashes, or a dependency lock file. The implementation also optionally imports `yt_dlp` and allows `faster-whisper` to download model artifacts dynamically. Python packages can execute arbitrary code during installation and import. Because no reviewed versions or hashes are specified, the effective dependency code may change after the Skill itself has been audited. The model download is also accepted without an application-level expected digest. This behavior is related to the declared transcription and browser functionality, but the mutable supply-chain trust exceeds the minimum risk necessary to provide that functionality. ### Attack ...[truncated 1237 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/transcribe.py:234

Finding

Predictable media files are written unsafely in a shared temporary directory

Content

View full analysis

.mp4`, where the video ID is normally public or visible in the command line. The files are opened with `open(path, "wb")`, which follows symbolic links and truncates an existing target. The implementation does not use exclusive creation, verify file ownership, reject symbolic links, or place the files inside a private per-run directory. On a multi-user system, another local account can pre-create one of these paths as a symbolic link to a file writable by the victim. When the Skill opens the path, downloaded media bytes are written to the symbolic-link target. Concurrent Skill runs can also overwrite or consume one another's media files. The final `os.remove()` removes the path entry rather t ...[truncated 1441 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

python3 scripts/transcribe.py "https://www.douyin.com/video/7634579290163531035"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

python3 scripts/transcribe.py "https://www.douyin.com/video/7634579290163531035"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

python3 scripts/transcribe.py "https://www.douyin.com/video/7634579290163531035"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

python3 scripts/transcribe.py "https://www.douyin.com/video/7634579290163531035"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to perform network access, shell/Python execution, and file reads/writes, but it does not declare an enforceable tool scope such as permissions or allowed-tools metadata. That mismatch is dangerous because a host agent may grant broader capabilities than reviewers expect, enabling the skill to launch browsers, install packages, download models, access remote content, and read generated files without machine-checkable restrictions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill launches and drives a local browser through CDP, which is a substantially more privileged capability than simple HTTP fetching. Even though this code targets Douyin pages, CDP control can access browser-rendered content, trigger navigation, and harvest session-derived data, increasing privacy and attack surface if the skill is used in broader agent contexts or modified inputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring states fetch_video_via_cdp returns (title, mp4_url, local_path) and even documents failure as (None, None, None). In multiple branches, the function instead returns only two values, contradicting the documented interface and intent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 315)May include surrounding context.

python

shutil.rmtree(profile, ignore_errors=True)

    print("      [cdp] 启动 headless 浏览器获取直链…")
    proc = subprocess.Popen(
        [browser, "--headless=new", "--disable-gpu", "--no-first-run",
         "--disable-extensions", "--mute-audio",
         f"--remote-debugging-port={port}", "--remote-allow-origins=*",

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest emphasizes a local, free pipeline without API keys, which suggests primarily on-device processing. However, when a local model is not already present, the code invokes WhisperModel with a model name and download_root, causing the model artifacts to be fetched externally at first run.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code file contains a natural-language locale constraint in the HTML template via <html lang="zh-CN">. The skill also defaults to Chinese-oriented output, but does not offer a user-facing locale choice for the report itself or explain why the report must always be Chinese, which conflicts with the policy against forcing a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.