T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:430- Finding
Automatic Transmission of User Feedback and Diagnostic Data Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Tiktok Slideshow Maker
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its TikTok slideshow purpose, but it asks agents to persist credentials and silently send or reuse user data without clear consent.
Review before installing. The slideshow and TikTok draft workflow is coherent, but you should only use it if you are comfortable with ViralBaby receiving your slideshow content, business/style preferences, TikTok connection flow, and diagnostic or feedback messages. Do not store the generated password in plain environment variables; prefer a dedicated secret manager, approve any feedback/error report before it is sent, and review destructive actions like deleting slideshows or collections.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:28- Finding
Unsafe and Ambiguous Persistence of API Credentials and Passwords
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Delete Collection
text DELETE /api/v1/collections/{id} Response: { "success": true }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Delete Slideshow
text DELETE /api/v1/slideshows/{id} Response: { "success": true }
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to generate credentials and persist both the API key and password in environment variables across sessions. Persisting secrets beyond the immediate task broadens exposure if logs, subprocesses, or later tasks can read those variables, and it is not strictly necessary for one-off slideshow creation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions normalize saving newly created secrets without any warning about secret handling, storage scope, or downstream access. Users may be unaware that both a password and long-lived API credential are being persisted, creating avoidable credential exposure risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs persistent storage and silent cross-session reuse of business and style data without renewed consent. Cross-session memory of user context materially increases privacy risk because it enables profiling and later use beyond the immediate task boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Silently fetching and reusing stored business/style preferences removes transparency around ongoing processing of user data. Even if the data seems low sensitivity, business context and content strategy can be proprietary, and hidden reuse undermines informed consent.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 82% confidence
- Finding
The instruction to fetch and use stored preferences silently authorizes autonomous decisions about personal/business data reuse without the user's immediate awareness. In this context, the main risk is privacy and expectation mismatch rather than direct system compromise, but it still weakens user control.
- Content
md **Workflow:** 1. On first session: `GET /api/v1/preferences` — if both are null, ask the user for their business description and content style, then save with `PUT` 2. On subsequent sessions: fetch silently, use the stored context without asking again 3. User can update preferences anytime by asking (e.g. "update my style to be more professional") ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Telling the agent not to ask again once preferences are stored reinforces autonomous reuse of prior context. This is less severe than credential misuse, but it still encourages hidden personalization and reduces informed user participation.
- Content
md 3. **Voice** — use the stored `style` preference for tone and format (reading level, POV, capitalization, etc.) 4. **CTA** — last slide should drive action: follow, save, comment, or visit Do NOT ask the user to describe their business or style on every session if preferences are already stored. ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Automatic feedback and error reporting may transmit user text, resource identifiers, and failure context to the external API without a warning. This creates a privacy and data-sharing issue because user-originated content may leave the current context unexpectedly.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Forwarding free-form feedback and detailed error context to an external endpoint can expose user-provided text, identifiers, and possibly business details. The danger is higher because the content is unstructured, making accidental leakage of sensitive information more likely.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill expands from slideshow creation into persistent profile management by storing business and style preferences for reuse across sessions. While useful for convenience, this creates unnecessary long-term retention of user data and increases privacy risk if the stored context is later reused in ways the user did not expect.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest does not mention billing, subscription management, or payment upgrade flows; it focuses on creating slideshows, image search, and TikTok draft upload. The billing endpoints and instructions to share upgrade URLs introduce an account monetization capability outside the declared purpose.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs automatic reporting of API errors and forwarding user feedback to the vendor, potentially including user-provided text, IDs, and workflow details. Sending such data to a third party without clear user notice or minimization can leak sensitive business context and operational metadata.
- Content