douyin-upload
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is primarily designed to execute the local
sau(social-auto-upload) CLI tool to perform video and image note uploads to Douyin.\n - Evidence:
SKILL.mdandreferences/cli-contract.mddefine command structures for account login, cookie verification, and media publishing.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions for the installation of browser binaries necessary for its automation features.\n - Evidence:
references/runtime-requirements.mddirects the agent to install Chromium via a well-known mirror (npmmirror.com).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for video titles and descriptions which is then used in CLI command arguments.\n - Ingestion points: Title, description, and tag parameters defined in
references/cli-contract.md.\n - Boundary markers: Not explicitly defined in the markdown instructions.\n
- Capability inventory: Execution of local CLI tools via shell or Python subprocess.\n
- Sanitization: The
scripts/examples/douyin_cli_template.pyfile demonstrates the use ofshlex.quotefor safe parameter handling.
Audit Metadata