ClawHub
Back to skill

Security audit

TikTok Shop Commerce Intelligence

Security checks for vulnerabilities and agentic risk

Overview

The skill's TikTok commerce API use fits its stated purpose, but it under-discloses external data flow and silently creates a persistent install identifier that is sent with requests.

Review this skill before installing. It appears designed for TikTok commerce research, but using it sends TikTok identifiers and query data to an external gateway, may send your API key if configured, and creates a persistent local install ID that is transmitted with requests. Install only if that tracking and third-party API routing are acceptable, and keep any .env API key out of shared repositories or logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tainted flow: 'req' from os.getenv (line 178, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url=url, method=op["method"], headers=req_headers, data=data)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8")
            try:
                payload = json.loads(raw) if raw else None
Confidence
92% confidence
Finding
The request destination and authentication material are influenced by environment variables, especially SCRUMBALL_BASE_URL and SCRUMBALL_API_KEY, and are then sent directly via urllib.request.urlopen. This enables exfiltration of API credentials and request metadata to an attacker-controlled endpoint if the environment or .env source is manipulated, which is more concerning because the skill also auto-loads configuration and attaches a persistent install identifier.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documents executable tooling that reads environment variables, loads local files such as `.env`, and performs network calls, but it does not declare corresponding permissions. This creates a transparency and policy gap: a host or user may authorize the skill without understanding it can access secrets and transmit data externally.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code creates a stable cross-run installation identifier and stores it in the user's home directory or skill directory, then transmits it as x-install-id on every request. For a TikTok commerce intelligence skill, this persistence is not necessary for core functionality and creates unnecessary tracking across sessions and potentially across skills.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill instructs use of `--env-file .env` and environment variables for API authentication without any warning about safe secret handling. This can lead users to place API keys in local files or logs insecurely, increasing the chance of accidental credential disclosure through filesystem access, shell history, or debugging output.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The documentation exposes endpoints for collecting creator/shop performance, live, product, and video-ad data tied to TikTok identifiers, but it provides no statement about authorization requirements, lawful basis, permitted use, retention, or privacy constraints. In a commerce-intelligence skill, that omission can enable misuse for unauthorized profiling, scraping, or surveillance of creators and shops, especially if integrators assume any resolvable `unique_id` or `user_id` is fair game.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code performs network requests that include authorization data and a persistent x-install-id without any user-facing disclosure or consent mechanism. In this skill context, hidden transmission of telemetry and identifiers is risky because users would reasonably expect product research functionality, not opaque cross-run tracking and metadata sharing.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
A persistent installation ID is generated and written to disk silently, creating lasting user tracking without notice or consent. This is dangerous because it survives sessions and can be correlated across requests, increasing privacy risk and making deanonymization or behavioral profiling easier if server-side logs are compromised or misused.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Free tier**: a limited number of calls per day, zero-config (no key required — the skill defaults to a hosted gateway that injects the key server-side).
- **When any operation returns HTTP 429, or the response body has `code=429` / contains `quota_exceeded`, you (the assistant) MUST immediately and clearly tell the user** (do not silently retry, do not treat it as a generic error):

  > Free quota exhausted. Register and get your own API key at **https://data.scdata.cc/pricing**, then set the environment variable `SCRUMBALL_API_KEY` to your key (in your host/agent environment or a local `.env`). You can then continue with your own quota.

- The 429 response body usually includes `apply_url` and `env_var` fields you can quote directly.
Confidence
82% confidence
Finding
The skill directs the assistant to send users to an external domain and describes a hosted gateway that injects API keys server-side. In context, external transmission is expected for an API-integration skill, but the undocumented hosted-gateway behavior increases risk because user queries and identifiers may be routed through third-party infrastructure without clear disclosure or consent.

Credential Access

High
Category
Privilege Escalation
Content
## Tooling

Execution commands:
- List operations: `python3 scripts/execute_operation.py --env-file .env list`
- Sale snapshot: `python3 scripts/execute_operation.py --env-file .env call --operation tiktok_user_shop_sale --query '{"unique_id":"nike"}'`
- Goods list: `python3 scripts/execute_operation.py --env-file .env call --operation tiktok_user_shop_goods_list --query '{"unique_id":"nike","page":1,"page_size":20}'`
Confidence
90% confidence
Finding
The skill explicitly relies on `.env`-based credential loading and environment variable access for `SCRUMBALL_API_KEY`. In an agent setting, encouraging local secret-file access materially increases the chance that credentials are exposed to the skill runtime, adjacent tools, logs, or unintended file reads, especially since permissions are not clearly declared.

Static analysis

No suspicious patterns detected.