ClawHub
Back to skill

Security audit

TikTok

Security checks for vulnerabilities and agentic risk

Overview

This TikTok planning skill is a local-only content and analytics helper with disclosed JSON storage and no evidence of posting, login, scraping, network access, or hidden automation.

Before installing, be comfortable with the skill storing TikTok profile details, unpublished content ideas, scripts, captions, and manually entered performance metrics as local JSON files under ~/.openclaw/workspace/memory/tiktok/. It does not log into TikTok, post content, scrape, or automate engagement, but you should still avoid saving sensitive private business plans unless you want them retained locally.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
Do not guarantee virality or follower gains.
Always frame outputs as strategic guidance.

## Output rules

When generating TikTok content, prefer:
- spoken-language phrasing
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill describes local file read/write behavior via named scripts and memory paths, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization ambiguity: an agent may infer it can read or write local files broadly, increasing the chance of unintended filesystem access beyond the intended TikTok memory directory.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The invocation description is broad enough to match generic content-planning, scripts, analytics, or performance-review requests that are not specifically about TikTok. Over-broad triggering can cause the wrong skill to activate and access or write local memory in contexts the user did not intend, creating data-mixing and least-surprise issues.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The save_json function performs persistent file writes under ~/.openclaw/workspace/memory/tiktok, which can affect user data on disk. In this file there is no confirmation prompt, logging/print statement, or explanatory comment/docstring disclosing that the skill stores data locally.

Missing User Warnings

Low
Confidence
91% confidence
Finding
This code performs a persistent write via save_json("content_bank", bank), which can modify local stored data. Although the script prints a success message afterward, there is no pre-action warning, confirmation prompt, or inline comment/docstring disclosing that running the command will append and save data to local storage.

Static analysis

No suspicious patterns detected.