ClawHub
Back to skill

Security audit

TikTok Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims at its core: it helps publish TikTok videos through MyBrandMetrics, with disclosed credential use and outbound uploads, but users should treat public posting and local file uploads carefully.

Before installing, confirm that you trust MyBrandMetrics and the publisher with the connected TikTok account and API key. Use SELF_ONLY for tests, verify the exact local file or URL before publishing, and do not rely on the documented Google Sheet scheduling capability unless the publisher supplies and explains the missing implementation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The core declared purpose of posting/uploading TikTok videos via the MyBrandMetrics API is accurate for the provided code. The script does support local files, remote URLs, titles, privacy levels, and an option to wait for publication with polling-related parameters. However, the description materially overstates capabilities that are not present in this code chunk: there is no scheduler, no Google Sheets integration, no chat interface, and no standalone endpoint or command for checking publishing status. Because several explicit advertised features are absent from the actual implementation, the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tainted flow: 'files' from open (line 53, file read) → requests.post (network output)

High
Category
Data Flow
Confidence
80% confidence
Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/publish_tiktok.py (reported line 66)May include surrounding context.

python
if args.poll_timeout:
            data["poll_timeout_ms"] = str(args.poll_timeout)
        
        response = requests.post(url, headers=headers, files=files, data=data)

    if response.status_code == 200:
        print("Success! Response:")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill describes capabilities that involve reading local configuration, using credentials, and making network requests, but it does not declare an explicit tool/permission scope. That weakens security boundaries and user visibility into what the skill may access, increasing the risk of unintended file access or outbound actions when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill enables real external side effects—publishing to TikTok and scheduling future posts—but does not present a strong explicit warning or mandatory confirmation step before public-account actions. In practice, this can lead to accidental public posting, unintended scheduling, or misuse of a connected social media account if the user input is ambiguous or manipulated.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/check_status.py (reported line 27)May include surrounding context.

python
print("Error: TikTok API key not found in config.json")
        sys.exit(1)

    url = "https://api.mybrandmetrics.com/tiktok/publishing/post"
    
    # Check if source is a URL or a local file
    is_url = args.source.startswith('http://') or args.source.startswith('https://')

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_tiktok.py (reported line 27)May include surrounding context.

python
print("Error: TikTok API key not found in config.json")
        sys.exit(1)

    url = "https://api.mybrandmetrics.com/tiktok/publishing/post"
    
    # Check if source is a URL or a local file
    is_url = args.source.startswith('http://') or args.source.startswith('https://')

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_tiktok.py (reported line 46)May include surrounding context.

python
"privacy_level": args.privacy_level,
            "wait_for_published": args.wait_for_published
        }
        response = requests.post(url, headers=headers, json=data)
    else:
        # Local File (Multipart/form-data)
        if not os.path.exists(args.source):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script transmits local files and associated metadata to a third-party API without any explicit runtime warning, confirmation, or safeguard to ensure the operator understands data will leave the local environment. In an agent/automation context, this increases the risk of unintended disclosure if a user provides the wrong path or the skill is invoked indirectly on sensitive files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script reads API credentials from environment variables and a config path, but provides no user-facing notice that it will access sensitive authentication material. There is no confirmation prompt, comment/docstring disclosure, or broader skill description in this file explaining this behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends a network request to an external endpoint and includes the API key in the request headers, but the file contains no explicit warning beyond the generic CLI description. For safety auditing, this is a network operation transmitting sensitive data without a user-facing disclosure in code comments, docstrings, or prompts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.