tiktok-ad-research

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 12:55 PM UTC
• Version: 1.0.7

Overview

This skill is a clearly scoped TikTok ad research helper that calls the disclosed Crawlora API and does not show hidden, destructive, or persistent behavior.

Install this only if you are comfortable sending TikTok ad research queries, material IDs, and your Crawlora API-authenticated usage to Crawlora. Keep the API key in the environment, avoid sensitive internal terms in queries, and review Crawlora's own privacy and retention terms if this will be used for confidential research.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes a shell script but does not declare any explicit tool scope or permissions boundary. That creates an avoidable least-privilege gap: an agent/runtime may permit shell execution more broadly than intended, increasing the chance of misuse, command extension, or accidental execution in environments where users did not expect code-capable behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

Set `CRAWLORA_API_KEY` to your key from [crawlora.net](https://crawlora.net).
Run the bundled `scripts/crawlora.sh` from this skill directory or by absolute
path. It sends `x-api-key` to `https://api.crawlora.net/api/v1` and prints JSON.
Keep the key in the environment. Read [reference/endpoints.md](reference/endpoints.md)
for the ten Top Ads endpoints and their exact parameters.

• Confidence: 87% confidence
• Finding: The skill instructs the agent to send an API key in an HTTP header to an external service, which is a real external data transmission path. While this appears necessary for the skill's stated purpose, it still carries security risk because secrets are exposed to a third-party endpoint and any request context, parameters, or returned signed URLs may leak sensitive research activity or be mishandled by downstream logging.

External Transmission

Medium

• Category: Data Exfiltration

Content

Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**10 endpoints across 1 platform group(s).**

• Confidence: 95% confidence
• Finding: This file documents direct outbound communication to `https://api.crawlora.net/api/v1` with an API key, which is a genuine external transmission surface. While expected for this skill's functionality, it still creates a security boundary where user-supplied queries, material identifiers, and usage metadata leave the local environment and are exposed to a third-party processor.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly instructs callers to send requests to an external third-party service using an API key, but it does not warn users that their queries, identifiers, and authentication material are transmitted off-platform. In a research skill, users may reasonably assume they are only querying public TikTok data, so the lack of disclosure can cause unintentional sharing of sensitive search terms, account-linked usage data, or internal research inputs with Crawlora.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.