Social Media Marketing Hub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:36 AM UTC
• Version: 8.3.1

Overview

The skill mostly matches its marketing-analysis purpose, but it has unsafe and under-disclosed credential, command, process-control, and file-write behavior that should be reviewed before installation.

Install only if you are comfortable granting API credentials, subprocess execution, browser automation, media download/transcription, and local persistent storage. Treat the current version as needing maintainer fixes for the TikHub host mismatch, shell-command construction, unsafe filename handling, credential setup output, and broad Xvfb process killing before use in a sensitive or shared environment.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

other

Error

• Location: scripts/marketing_hub.js:348

Finding

Bearer Credential Transmitted to an Undeclared and Non-Allowlisted Host

Content

View full analysis

v.aweme_info?.product_info?.product_id); return videos; } ``` The same destination and authorization header are used by `douyinSearchUser()` and `douyinUserVideos()`. The manifest instead declares: ```yaml permissions: network_mode: allowlist allowed_hosts: - www.douyin.com - douyin.com - api.tikhub.io - api.deepseek.com clientPermissions: network: httpsOutbound: true documentedHosts: - api.tikhub.io - api.deepseek.com ``` ### Technical Analysis The implementation reads `TIKHUB_TOKEN` from the environment or a legacy configuration file and places it in an HTTP `Authorization: Bearer` header sent to `api.tikhub.dev`. The manifest only authorizes and documents `api.tikhub.io`. The audited project provides no evidence establishing that the undeclared `.dev` hostname is an approved alias or is controlled by the intended API provider. This therefore constitutes sensitive credent ...[truncated 1117 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/marketing_hub.js:803

Finding

Remote Video URL Enables Shell Command Injection

Content

View full analysis

{ const dl = exec('curl -s -L -A "Mozilla/5.0" "' + videoUrl + '" -o "' + mp4Path + '" --max-time 60', err => err ? rej(err) : res()); dl.on('error', rej); }); ``` ### Technical Analysis `videoUrl` comes from TikHub API response data and is concatenated into a command string passed to `child_process.exec()`. `exec()` invokes a shell, so quotation marks, command substitutions, separators, redirections, and other shell syntax embedded in the URL can be interpreted as commands. Wrapping the URL in double quotes is not sufficient. An attacker-controlled value containing a double quote can terminate the argument and append shell syntax. Because no URL parsing, protocol restriction, hostname validation, or shell escaping occurs, remote metadata becomes a command-execution primitive. The adjacent `ffmpeg` and `whisper` commands use locally generated paths and do not expose the same direct remote-input path in the audited code. ### Attack Path 1. An attacker causes a target account's API metadata to contain a crafted `play_addr.url_list[0]` value. 2. The victim runs `author` for that account. 3. The crafted video is selected among the top three videos for transcription. 4. The value is inserted into the `curl` command string. 5. A quote in the value escapes the intended URL argument, and appended ...[truncated 768 chars]

Remediation

View remediation

{ execFile('curl', [ '-s', '-L', '-A', 'Mozilla/5.0', parsedUrl.href, '-o', mp4Path, '--max-time', '60' ], { shell: false }, err => err ? reject(err) : resolve()); }); ``` 2. Restrict video URLs to HTTPS and an explicit allowlist of trusted media hosts. 3. Reject URLs containing embedded credentials, unexpected ports, or noncanonical hostnames. 4. Apply response size and redirect limits; validate every redirect destination against the host policy. 5. Run media processing in a sandbox with no access to API-key environment variables and minimal filesystem permissions. 6. Add tests using quotes, semicolons, command substitutions, and newline characters to confirm that input is never interpreted by a shell. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/marketing_hub.js:33

Finding

Unsanitized Keywords and Author Names Permit Path Traversal

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/marketing_hub.js:561

Finding

Untrusted Social-Media Content Can Persistently Poison AI Memory

Content

View full analysis

v.rank + '. "' + v.title.substring(0, 40) + '" @' + v.author + ' | ' + v.duration + 's | 👍' + formatNumber(v.likes) + ' | 💬' + formatNumber(v.comments) + ' | ' + v.tags.map(t => '#' + t).join(' ')).join('\n') + '\n时长分布：' + Object.entries(stats.durationRanges).map(([k, v]) => k + ':' + v + '个').join(' ') + '\n均点赞:' + formatNumber(stats.avgLikes) + ' | 均时:' + stats.avgDuration + 's\n\n输出JSON：\n{\n "openingPatterns": ["开头1","开头2"...],\n "structures": ["结构1"...],\n "commentNeeds": ["用户关心1"...],\n "titleTemplates": ["模板1"...],\n "insights": ["洞察1"...],\n "bestDuration": "最佳时长",\n "tagStrategy": "标签策略"\n}'; let insights = { openingPatterns: [], structures: [], commentNeeds: [], titleTemplates: [], insights: [], bestDuration: '15-30秒', tagStrategy: '' }; try { const result = await callAI(prompt); insights = JSON.parse(result.replace(/```json|```/g, '').trim()); } catch (e) { console.log('⚠️ AI解析失败，仅保存数据'); } const memoryData = { keyword, stats, videos: vl.slice(0, 10), ...insights, topTags: stats.topTags }; const saved = saveMemory(keyword, memoryData); ``` Transcribed speech from remote videos is also placed directly in an AI prompt: ```javascript const transcriptionSection = transcriptionText ? '\n\n【TOP视频口播原文】\n' + transcriptionText.substring(0, 3000) : ''; const basePrompt = '你是抖音高级运营分析师。请深度分析博主 @' + nickname + ' 的' + videos.length + '个视频。' + transcriptionSection + '\n\n基础指标：均赞' + formatNumber(avgLikes) + ' | 均评' + forma ...[truncated 3219 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/marketing_hub.js:21

Finding

Configuration Command Exposes API Credentials in Process Arguments and Logs

Content

View full analysis

``` ### Technical Analysis The fallback setup method places both credentials in the process command line. Command-line arguments can be recorded in shell history and may be visible through process inspection while the command is running. `saveConfig()` then prints the supplied token and key verbatim as shell export commands. This exposes them to terminal logs, CI output, agent transcripts, session recording, and centralized logging. The function does not actually save the credentials, even though the dispatcher reports that configuration was saved, potentially encouraging users to repeat the insecure operation. ### Attack Path 1. A user follows the documented fallback configuration command. 2. Both secrets are stored in shell history and appear in the Node process arguments. 3. The Skill prints both values verbatim to standard output. 4. A local user, monitoring tool, CI logger, terminal recorder, or retained agent transcript captures the credentials. 5. The observer reuses the exposed API credentials within their granted privileges and quota. ### Impact Assessment Exposure ...[truncated 277 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/marketing_hub.js:238

Finding

Browser Setup Terminates Unrelated Xvfb Processes

Content

View full analysis

/dev/null 2>&1', { stdio: 'ignore' }); _xvfbDisplay = ':99'; return ':99'; } catch { // 启动新的 Xvfb execSync('pkill -f "Xvfb :[0-9]*" 2>/dev/null; sleep 1', { stdio: 'ignore' }); const rand = Math.floor(Math.random() * 10) + 90; execSync(`Xvfb :${rand} -screen 0 1280x720x24 >/dev/null 2>&1 &`, { stdio: 'ignore' }); sleep(2); _xvfbDisplay = `:${rand}`; return _xvfbDisplay; } } ``` The manifest grants: ```yaml allowed_commands: - pkill ``` ### Technical Analysis When display `:99` cannot be queried, the Skill executes `pkill -f "Xvfb :[0-9]*"`. This pattern is not limited to an Xvfb process created by the current Skill. It can match and terminate Xvfb instances owned by unrelated applications or concurrent users, subject to the operating-system account's authority. Killing all matching display servers is unnecessary for the legitimate task. The Skill can select an unused display and track a child process that it starts itself. The global process-kill permission therefore exceeds minimum privilege. There is also an asynchronous correctness issue: `sleep(2)` is called without `await` inside the synchronous function, so the code does not actually wait before returning the selected display. ### Attack Path 1. Browser mode runs in an environment without a detected desktop. 2. The check for X display `:99` fails. 3. The fallback executes a global `pkill` pattern. 4. Every accessible Xvfb process whose command line matches ...[truncated 520 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The public description presents the skill as a marketing-analysis tool, but the detected behavior includes browser automation, shell process control, remote file download, local media processing, filesystem persistence, and external API credential use. That mismatch is dangerous because users may consent to a narrow analytical function while the skill performs materially broader actions that expand attack surface and create risks around scraping, code execution, local data retention, and secret handling.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.yaml (reported line 66)May include surrounding context.

yaml

model: none
  doNotCommitToVcs:
    - scripts/memory/
    - scripts/.env

clientPermissions:
  network:

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code kills and starts Xvfb instances via shell commands (pkill, Xvfb) to control the local display environment. For a social-media analysis skill, modifying host display processes is overprivileged behavior that can disrupt co-located workloads and gives the skill unnecessary environmental control.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 100% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/marketing_hub.js (reported line 310)May include surrounding context.

js

let match;
    const seen = new Set();
    
    while ((match = videoIdRegex.exec(output)) !== null) {
      if (seen.has(match[1])) continue;
      seen.add(match[1]);
      const blockStart = Math.max(0, match.index - 500);

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill invokes local shell commands and external binaries (curl, ffmpeg, whisper) on data derived from remote video metadata. This materially expands the capability of a marketing-analysis tool into downloading and processing untrusted media with privileged host tooling, increasing the attack surface for command injection, unsafe binary execution, and abuse of local system resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes competitor-account analysis of third-party creators but does not warn users that account names and related queries may be transmitted to external services such as TikHub and DeepSeek. This creates a transparency and privacy risk because users may unknowingly send third-party identifiers and marketing intelligence requests off-platform, and the analyzed subjects have no notice or consent mechanism described.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises a natural-language trigger phrase, "用浏览器分析咖啡", that is broad enough to overlap with ordinary user requests rather than being clearly scoped to this skill. In agent environments, overly generic trigger phrases can cause unintended invocation of the skill, leading to surprise external data access, API use, or content generation without the user realizing this specific skill was selected.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill appears to require shell and environment-variable access, but the manifest does not declare any explicit tool scope or permissions. This creates a transparency and policy-enforcement gap: a user or host system may invoke a skill with more capability than is apparent from the metadata, increasing the chance of unintended command execution or secret exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description and command guidance are presented as Chinese-first and explicitly instruct users that they can 'directly speak human language' using Chinese examples, without offering a language or locale choice. This can violate language/locale policy when a skill effectively assumes a specific language without user opt-in or documented regional limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language invocation model is described so broadly that ordinary user phrasing could be interpreted as a command, potentially triggering browsing, scraping, external API calls, or file writes without a sufficiently explicit action boundary. In a skill with shell, browser, and persistence capabilities, ambiguous triggering materially raises the risk of unintended side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest contains user-facing natural language only in Chinese across comments, category, tags, and summary, with no indication that other languages are supported or that the locale is region-specific by design. This can violate language/locale policy where skills must not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code creates a temporary directory, downloads source videos, extracts audio, transcribes speech, and then saves derived analysis into the skill's memory store. While there is some progress logging, there is no explicit user-facing warning that external content and transcription-derived data will be processed and stored locally, which is relevant to privacy and data-retention expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Whisper invocation forces --language Chinese, which imposes a specific language setting regardless of user preference or the actual language of the audio. This is a natural-language locale policy issue because the skill does not provide opt-in, fallback, or a documented justification for restricting transcription to Chinese.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that analysis results and reports are written to disk, but it does not prominently warn users about local persistence, retention, or the sensitivity of stored keyword/author data. Even if the stored content is not inherently secret, silent or underemphasized persistence can expose user interests, research subjects, or third-party data to other local users or later compromise.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/marketing_hub.js:244