Tiktok Ads CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for TikTok Ads reporting, but it asks users to install an unpinned global third-party CLI and handle OAuth credentials without enough safeguards.

Review before installing. Prefer a pinned, verified, project-local CLI install; use least-privilege and short-lived TikTok tokens; store credentials privately; do not paste tokens into chat or logs; and confirm whether the audience commands are read-only before granting permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Global Installation of a Credential-Handling Third-Party CLI

Content

View full analysis

Remediation

View remediation

``` 2. Document the expected npm publisher, source repository, package version, and integrity checksum so users can verify package provenance before installation. 3. Prefer a project-local installation governed by a committed lockfile instead of a global installation: ```bash npm install --save-exact tiktok-ads-cli@ ``` 4. Use npm provenance and integrity verification where supported, and periodically audit the pinned package and its transitive dependencies. 5. Disable lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact tiktok-ads-cli@ ``` 6. Run the CLI in a restricted environment with minimal filesystem and network access. 7. Use short-lived, least-privilege TikTok tokens restricted to only the advertiser accounts and read operations required for the task. 8. Protect credential files with restrictive permissions and avoid passing secrets through command-line arguments where they may be exposed through process listings or shell history. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The authentication section centers the workflow around access tokens and optional app credentials without constraining how the agent should handle them. In practice, such instructions can lead to secret collection, reuse, or leakage through command examples, error messages, or conversational prompts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

## Authentication

The CLI requires a TikTok **OAuth access token**. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variable: `TIKTOK_ADS_ACCESS_TOKEN` (also reads `TIKTOK_ADS_APP_ID` and `TIKTOK_ADS_SECRET` if set)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill explicitly directs the agent to look for credentials via a file path, environment variables, or a --credentials flag. In an agent environment, this materially increases the chance of credential discovery, access, or accidental disclosure beyond what is necessary for normal user interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

1. `--credentials <path>` flag (per-command)
2. Environment variable: `TIKTOK_ADS_ACCESS_TOKEN` (also reads `TIKTOK_ADS_APP_ID` and `TIKTOK_ADS_SECRET` if set)
3. Auto-detected file: `~/.config/tiktok-ads-cli/credentials.json`

The credentials JSON file requires only `access_token`. The `app_id` and `secret` fields are optional:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Telling the agent to ask the user to verify their access token during authentication troubleshooting can easily turn into requesting or exposing the token itself. In a conversational or tool-using agent context, that creates a realistic path to credential disclosure.

Content

Scanner excerpt · SKILL.md (reported line 365)May include surrounding context.

md

## Error handling

- **Authentication errors** -- ask the user to verify their access token; run `tiktok-ads-cli advertiser <id>` to test
- **"No credentials found"** -- ask the user to set up one of: `--credentials` flag, `TIKTOK_ADS_ACCESS_TOKEN` env var, or `~/.config/tiktok-ads-cli/credentials.json`
- **Empty report results** -- check the date range, data level, and whether the account had active ads in the period
- **API error codes** -- the CLI surfaces the TikTok API error message; common issues include invalid advertiser IDs, expired tokens, or insufficient permissions

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The error-handling section tells the operator to set up credentials using a secret-bearing file, flag, or environment variable, normalizing workflows that may prompt the agent to access or expose secrets during remediation. This is especially risky because troubleshooting steps are often echoed back to the user or logged by automation.

Content

Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.

md

## Error handling

- **Authentication errors** -- ask the user to verify their access token; run `tiktok-ads-cli advertiser <id>` to test
- **"No credentials found"** -- ask the user to set up one of: `--credentials` flag, `TIKTOK_ADS_ACCESS_TOKEN` env var, or `~/.config/tiktok-ads-cli/credentials.json`
- **Empty report results** -- check the date range, data level, and whether the account had active ads in the period
- **API error codes** -- the CLI surfaces the TikTok API error message; common issues include invalid advertiser IDs, expired tokens, or insufficient permissions
- **Page out of range** -- check `page_info.total_page` in the response to avoid requesting pages beyond the total

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: >
  TikTok Ads data analysis and reporting via tiktok-ads-cli.
  Use when the user wants to check TikTok ad performance, pull campaign/ad group/ad stats,
  manage audiences, inspect creatives, check pixel tracking, or create async reports.
  Triggers: "TikTok Ads", "TikTok ad performance", "TikTok campaign stats",
  "TikTok ad spend", "TikTok report", "TikTok pixel", "TikTok audience",
  "TikTok creatives", "TikTok ad account", "TikTok ad groups", "TikTok async report".

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill describes the CLI as 'read-only' while also stating it can 'manage custom and lookalike audiences,' which are operationally mutable resources. This can mislead an agent or user into approving commands under a false assumption of non-destructive behavior, increasing the risk of unintended state changes in an ad account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs use of OAuth access tokens, app IDs, secrets, and a credentials file without any explicit warning not to paste secrets into chat, logs, or shared command history. In an agent setting, this increases the chance that sensitive credentials are exposed, persisted, or mishandled during troubleshooting and execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

md

### When the user asks for large date-range reports

1. Use `async-report` to create an async task (avoids timeout for large datasets)
2. Use `report-status` to poll for completion
3. The completed task response will include a download URL

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The workflow guidance says to check reports with the 'conversions' metric, but the documented common metrics list uses 'conversion' and 'cost_per_conversion' instead. This is a direct documentation inconsistency about what the code/CLI expects, which can mislead users about the actual command behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.