T09 · Insecure Skill Coding Practices
Warning
- Location
assets/hottrender-runtime/src/providers/tiktok.py:258- Finding
Partial Disclosure of TikTok Session Token in Application Logs
- Content
View full analysis
- Remediation
View remediation
Security audit
HotTrender Basic Crawler
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its crawler purpose, but optional TikTok support handles session material and logs part of an msToken, so it should be reviewed before installation.
Install only if you intend to run a local web-crawling tool and understand that live mode will contact external platforms. Avoid optional TikTok mode until token-prefix logging is removed, use a disposable TikTok session token if testing, keep logs private, and prefer pinned or hash-locked dependencies in an isolated virtual environment or container.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
assets/hottrender-runtime/requirements-tiktok.txt:1- Finding
Floating and Unverified Python and Browser Dependencies
- Content
View full analysis
=6.0 requests>=2.31 beautifulsoup4>=4.12 pytest>=8.0 ``` `assets/hottrender-runtime/requirements-tiktok.txt:1-2`: ```text TikTokApi>=6.0 playwright>=1.40 ``` The documented optional installation flow downloads the resolved dependencies and browser components: ```bash pip install -r requirements-tiktok.txt python -m playwright install ``` ### Technical Analysis Every dependency uses an open-ended lower version bound and no package hashes. Consequently, separate installations can resolve to different and potentially unaudited future releases. There is no lock file or integrity-enforced requirements file to ensure that users receive the versions reviewed with this Skill. The optional TikTok stack has elevated sensitivity because `TikTokApi` and Playwright execute locally with the user's process privileges and receive TikTok session tokens, cookies, proxy credentials, browser access, and network connectivity. Playwright also downloads and installs browser binaries through the documented command. No typo-squatted dependency name, malicious package source, alternate package index, or known malicious package was identified in the reviewed files. The issue is the absence of version and artifact integrity controls, not evidence that the currently named packages are malicious. ### Attack Path 1. A user follows the documented installation instructions. 2. pip resolves the latest releases satisfying the open-ended constraints. 3. Playwright may additionally retrieve browser binaries associ ...[truncated 1310 chars]- Remediation
View remediation
playwright== ``` Apply the same policy to the core dependency set. 2. Generate hash-locked installation files using a reproducible dependency-management tool, such as: ```bash pip-compile --generate-hashes requirements.in pip install --require-hashes -r requirements.txt ``` 3. Keep direct dependency declarations separate from generated transitive lock files. 4. Move `pytest` into a development-only requirements file so production installations receive only runtime dependencies. 5. Pin the Playwright package and document the corresponding browser revision. Review browser-binary download and update behavior. 6. Perform dependency updates through a controlled process that includes vulnerability scanning, changelog review, automated tests, and manual approval. 7. Run the crawler in an isolated virtual environment or container with minimal filesystem and network permissions. 8. Avoid exposing TikTok tokens, cookies, or proxy credentials to the optional stack until installation integrity has been verified. 9. Consider using an internal package mirror or artifact repository containing reviewed packages and browser binaries. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python -m venv .venv . .venv/bin/activate pip install -r requirements.txt cp .env.example .env
text ## Daily Trends
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python shutil.copytree(source, target) (target / "out").mkdir(parents=True, exist_ok=True) env_example = target / ".env.example" env_file = target / ".env" if env_example.exists() and not env_file.exists(): shutil.copy2(env_example, env_file)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to use shell commands, inspect environment variables, search the filesystem, install and run bundled code, and execute tests, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege enforcement and can let the skill operate with broader file, environment, and network access than reviewers or policy expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill enables implicit invocation with no visible trigger constraints, which can cause the agent to auto-select and run a web-crawling capability in situations the user did not explicitly request. Because this skill performs external data fetching, unintended invocation increases the risk of over-broad scraping, privacy issues, and surprising agent behavior, especially when paired with generic prompting.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The markdown renderer uses fixed Chinese strings for the report title, headings, labels, and empty/error messages. This forces a specific language in user-facing output without any visible opt-in or documented region-specific justification in this file, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The default HTTP header explicitly sets "ja" as the preferred language, which imposes a specific locale preference in outbound requests. This is a natural-language/locale policy concern because the file does not offer user choice or document why Japanese should be forced by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code forces specific language/locale pairs for each region, such as Japanese for jp and English for us, and then uses those values in the outbound request. This is a natural-language locale policy concern because the skill does not expose any opt-in or user choice for language selection, and the constraint is not documented here as a justified region-specific requirement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a lightweight HotTrender crawler that should prefer the bundled basic crawler runtime and existing provider scripts, while explicitly excluding broader infrastructure and advanced add-ons. This file instead builds a full Playwright-backed unofficial TikTok scraping client, including session creation, cookie/ms_token credential handling, proxy support, and browser monkey-patching to evade platform loading constraints, which is materially more complex than a lightweight basic crawler implementation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code pulls proxy settings, cookies, and a TIKTOK_MS_TOKEN environment variable to create authenticated scraping sessions against TikTok. For a skill described as a lightweight hotspot crawler that explicitly excludes unrelated infrastructure and advanced features, secret/token ingestion for a non-official scraper is an additional capability not clearly justified by the stated purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The provider logs the first 20 characters of an auto-acquired TikTok msToken, which is sensitive session credential material. Partial token disclosure can aid credential correlation, leak secrets into centralized logs, and expand the blast radius if logs are accessible to operators, other services, or attackers.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The short description is written only in Chinese, which may impose a language/locale expectation without offering user choice or documenting that the skill is intended solely for a Chinese-speaking context. This can conflict with language/locale policy requirements when no opt-in or justification is provided.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency uses a lower-bound version specifier only, which allows installation of any newer release, including unreviewed major versions with breaking changes or compromised upstream packages. In a crawler runtime that pulls third-party libraries with browser automation and social-media access, this weakens supply-chain control and can introduce malicious or vulnerable code during future installs.
- Content
text TikTokApi>=6.0 playwright>=1.40
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The Playwright dependency is not pinned to an exact version, so builds may resolve to different releases over time, increasing exposure to supply-chain compromise and unexpected behavior. Because Playwright executes browser automation and may download browser components, uncontrolled upgrades can materially affect the security posture of the crawler environment.
- Content
text TikTokApi>=6.0 playwright>=1.40
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, which allows builds to resolve to different versions over time. This weakens supply-chain integrity and makes security posture non-reproducible, especially because PyYAML has a history of security advisories and the exact installed version cannot be verified from this manifest alone.
- Content
text PyYAML>=6.0 requests>=2.31 beautifulsoup4>=4.12 pytest>=8.0
Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
PyYAML has multiple known advisories, and because the manifest does not pin a specific version, it is impossible to determine whether deployed environments are using a fixed or affected release. This is particularly relevant if the skill parses YAML from configuration or other untrusted sources, where historical PyYAML issues have included unsafe parsing behaviors.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using an unpinned requests dependency permits installation of any future version satisfying the lower bound, which can introduce vulnerable or breaking releases without review. In a crawler/runtime context that performs network access, this increases supply-chain and runtime risk because HTTP client behavior directly affects outbound requests, redirects, and credential handling.
- Content
text PyYAML>=6.0 requests>=2.31 beautifulsoup4>=4.12 pytest>=8.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
requests has several known advisories, but the absence of version pinning prevents verification that installations are using a secure release. In this skill's crawler context, requests is directly exposed to attacker-controlled URLs and responses, so uncertainty around the exact version increases concern even though the manifest alone does not prove an exploitable vulnerable install.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
An unpinned beautifulsoup4 version makes builds non-deterministic and can silently pull in changed parser behavior or vulnerable releases later. While this package is less obviously security-sensitive than a network client, it still participates in processing untrusted web content in this crawler skill, so version drift is undesirable.
- Content
text PyYAML>=6.0 requests>=2.31 beautifulsoup4>=4.12 pytest>=8.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
pytest is listed as an unpinned dependency, which allows uncontrolled version drift and can pull in vulnerable or incompatible test tooling. The risk is lower than for runtime packages because pytest is typically used in development/test contexts, but it still weakens reproducibility and may affect CI environments.
- Content
text PyYAML>=6.0 requests>=2.31 beautifulsoup4>=4.12 pytest>=8.0
Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
pytest has known advisories and is not pinned, so the security state of the resolved test dependency cannot be verified. The practical risk is lower because this package is generally used in testing rather than production runtime, but CI or developer environments may still be exposed to vulnerable tooling.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
User-visible error hints are written only in Chinese, which imposes a specific language choice in natural-language output. The file does not offer a language selection mechanism or document that the provider is intentionally limited to Chinese-speaking users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The regression-check example includes
--keywords "乙游,短剧", which bakes a specific language/locale into the skill documentation. The file does not indicate that this skill is region-specific or offer a user choice, so this can be read as a language-policy constraint without opt-in.- Content
Static analysis
No suspicious patterns detected.