douyin-upload

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). Insecure: the skill explicitly instructs the agent to ask users for SMS verification codes and then embed those codes verbatim into shell commands (uv run douyin verify --account --code <user_code>), which requires the LLM to handle and output sensitive secret values.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). 技能明确要求在“国内服务器”初始化步骤中运行 sudo apt install -y pipx（需要提权并修改系统包），这指示代理获得并使用 root 权限来改变机器状态，存在明显的安全风险。