douyin-video-analyst

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill shows API keys being set inline in shell commands (e.g., DOUYIN_API_KEY="" mcporter ...), which requires the LLM to place secret values verbatim into generated commands, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该工作流在 Step 2 使用 browser 打开用户提供的抖音账号主页 URL 并读取 snapshot/aria tree 提取视频列表与标题等文本，再在 Step 3 调用 douyin-mcp 以这些视频的 share_link 读取视频语音转文字，因此外部作者可通过其抖音主页/视频内容注入任意文本进入 LLM 运行时处理。