Tiktok Slideshow Maker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its TikTok slideshow purpose, but it asks agents to persist credentials and silently send or reuse user data without clear consent.

Review before installing. The slideshow and TikTok draft workflow is coherent, but you should only use it if you are comfortable with ViralBaby receiving your slideshow content, business/style preferences, TikTok connection flow, and diagnostic or feedback messages. Do not store the generated password in plain environment variables; prefer a dedicated secret manager, approve any feedback/error report before it is sent, and review destructive actions like deleting slideshows or collections.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:430
• Finding: Automatic Transmission of User Feedback and Diagnostic Data Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:430-443` **Vulnerability Type**: Automatic third-party disclosure of user-provided and diagnostic information **Risk Level**: Medium ### Vulnerable Code ```markdown ## Feedback & Error Reporting If you encounter an error from the API, or if the user shares feedback about ViralBaby, report it: POST /api/v1/feedback Body: { "type": "error", "message": "POST /api/v1/tiktok/upload returned 500: Internal server error. Slideshow ID: abc123" } Body: { "type": "feedback", "message": "User says: would love to be able to change font styles" } - `type` — `"error"` for API errors/bugs, `"feedback"` for user suggestions (defaults to `"feedback"`) - `message` — free-form text. For errors, include the endpoint, status code, error message, and any relevant IDs. For feedback, include the user's words. Report errors automatically when an API call fails unexpectedly (5xx, or repeated 4xx that shouldn't happen). Don't report 401/402 — those are expected. ``` ### Technical Analysis The Skill instructs the Agent to send user feedback, endpoint names, error messages, and relevant resource identifiers to the ViralBaby feedback endpoint. It also directs the Agent to perform this reporting automatically for unexpected failures. Automatic diagnostic reporting is not necessary for the Skill's core functionality of creating slideshows and uploading them to TikTok drafts. The instructions do not require: - Explicit user consent before transmission. - Display or approval of the exact outgoing payload. - Redaction of personal data, credentials, URLs, content, or identifiers. - A restriction against including request or response bodies. - Data minimization or retention controls. Because the `message` field is free-form and the Agent is encouraged to include relevant details and the user's own words, API failures or feedback could cause sensitive information to be incorporated into the report. ### Attack Path 1. The u ...[truncated 1282 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic feedback and error reporting by default. 2. Ask for explicit, informed user consent before each diagnostic or feedback submission. 3. Show the user the exact destination and redacted payload before transmission. 4. Apply structured allowlisting rather than accepting an unrestricted free-form message. 5. Remove or mask: - API keys and authorization headers. - Passwords and session tokens. - Personal information. - Request and response bodies. - Slideshow, user, publish, search, and collection identifiers. - User content and private URLs. 6. Send only the minimum required fields, such as a generic error class, endpoint category, and status code. 7. Never quote user feedback verbatim unless the user expressly approves the quotation. 8. Document the destination service's retention and privacy behavior. 9. Record locally that consent was obtained without retaining the sensitive report contents. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28
• Finding: Unsafe and Ambiguous Persistence of API Credentials and Passwords<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-48` **Vulnerability Type**: Plaintext secret persistence and excessive credential retention **Risk Level**: Medium ### Vulnerable Code ```markdown ### Sign Up (new user) POST /api/v1/auth Body: { "email": "[e-mail]", "password": "securepassword", "action": "signup" } Response: { "key": "vb_live_abc123...", "keyId": "uuid", "userId": "user_...", "message": "Account created..." } When signing up, auto-generate a secure password for the user. **Immediately save both** the API key and the password as environment variables so they persist across sessions: ```bash export VB_KEY="vb_live_..." export VB_PASSWORD="the-generated-password" ``` ### Log In (existing user) If `$VB_KEY` is missing but `$VB_PASSWORD` is set, log in to get a fresh API key: POST /api/v1/auth Body: { "email": "[e-mail]", "password": "$VB_PASSWORD" } Then save the new key: `export VB_KEY="vb_live_..."` The API key is only shown once and cannot be retrieved later. Always save it immediately. ``` ### Technical Analysis The Skill requires the Agent to retain both a reusable API token and the account password. It suggests shell environment variables as a mechanism that will persist across sessions, although ordinary `export` commands only affect the current process and its descendants. To achieve the stated persistence, an implementation may consequently place plaintext credentials in shell startup files, Agent state, command history, logs, or another unspecified storage location. The instructions do not require an operating-system credential vault, restrictive file permissions, secret masking, rotation, revocation, or deletion. Retaining both the API key and the account password also violates data-minimization principles. A revocable API token should ordinarily be sufficient for API access; retaining the account password expands the consequences of secret compromise. ### Attack Path 1. The Agent signs ...[truncated 1323 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store credentials in an operating-system secret manager or the Agent platform's dedicated encrypted credential vault. 2. Do not claim that a shell `export` command persists across sessions. 3. Do not write secrets to shell profiles, project files, command history, logs, or general-purpose Agent memory. 4. Retain only the API token when possible; avoid storing the account password after token issuance. 5. If password retention is operationally unavoidable, store it separately in an encrypted credential manager and obtain explicit user approval. 6. Mask secrets in tool output and prevent authorization headers from entering diagnostic reports. 7. Use narrowly scoped, revocable, and expiring API tokens where supported. 8. Document token rotation and revocation procedures. 9. Apply least-privilege file permissions to any unavoidable local credential material. 10. Provide a user-accessible procedure to disconnect the service and securely delete all retained credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Collection
```
DELETE /api/v1/collections/{id}
Response: { "success": true }
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Slideshow
```
DELETE /api/v1/slideshows/{id}
Response: { "success": true }
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to generate credentials and persist both the API key and password in environment variables across sessions. Persisting secrets beyond the immediate task broadens exposure if logs, subprocesses, or later tasks can read those variables, and it is not strictly necessary for one-off slideshow creation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions normalize saving newly created secrets without any warning about secret handling, storage scope, or downstream access. Users may be unaware that both a password and long-lived API credential are being persisted, creating avoidable credential exposure risk.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill directs persistent storage and silent cross-session reuse of business and style data without renewed consent. Cross-session memory of user context materially increases privacy risk because it enables profiling and later use beyond the immediate task boundary.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Silently fetching and reusing stored business/style preferences removes transparency around ongoing processing of user data. Even if the data seems low sensitivity, business context and content strategy can be proprietary, and hidden reuse undermines informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Workflow:**
1. On first session: `GET /api/v1/preferences` — if both are null, ask the user for their business description and content style, then save with `PUT`
2. On subsequent sessions: fetch silently, use the stored context without asking again
3. User can update preferences anytime by asking (e.g. "update my style to be more professional")

---

• Confidence: 82% confidence
• Finding: The instruction to fetch and use stored preferences silently authorizes autonomous decisions about personal/business data reuse without the user's immediate awareness. In this context, the main risk is privacy and expectation mismatch rather than direct system compromise, but it still weakens user control.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

3. **Voice** — use the stored `style` preference for tone and format (reading level, POV, capitalization, etc.)
4. **CTA** — last slide should drive action: follow, save, comment, or visit

Do NOT ask the user to describe their business or style on every session if preferences are already stored.

---

• Confidence: 80% confidence
• Finding: Telling the agent not to ask again once preferences are stored reinforces autonomous reuse of prior context. This is less severe than credential misuse, but it still encourages hidden personalization and reduces informed user participation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Automatic feedback and error reporting may transmit user text, resource identifiers, and failure context to the external API without a warning. This creates a privacy and data-sharing issue because user-originated content may leave the current context unexpectedly.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Forwarding free-form feedback and detailed error context to an external endpoint can expose user-provided text, identifiers, and possibly business details. The danger is higher because the content is unstructured, making accidental leakage of sensitive information more likely.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The skill expands from slideshow creation into persistent profile management by storing business and style preferences for reuse across sessions. While useful for convenience, this creates unnecessary long-term retention of user data and increases privacy risk if the stored context is later reused in ways the user did not expect.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The manifest does not mention billing, subscription management, or payment upgrade flows; it focuses on creating slideshows, image search, and TikTok draft upload. The billing endpoints and instructions to share upgrade URLs introduce an account monetization capability outside the declared purpose.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: The skill instructs automatic reporting of API errors and forwarding user feedback to the vendor, potentially including user-provided text, IDs, and workflow details. Sending such data to a third party without clear user notice or minimization can leak sensitive business context and operational metadata.

Static analysis

No suspicious patterns detected.