TKSeller

• Outcome: Review
• Latest audit: Jul 12, 2026 · 4:09 AM UTC
• Version: 3.4.0

Overview

This looks like a real TKSeller automation client, but it needs Review because it handles passwords, local platform credentials, background polling, and external service setup with weak disclosure and insecure transport.

Install only if you trust this publisher and backend with your TKSeller credentials, device binding, local OpenClaw channel tokens, and Discord or Feishu bot administration. Prefer a dedicated low-privilege account and test server, avoid production bot credentials, and be aware that the skill may keep a local polling process running and cache media locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to verbatim forward any `[tkseller_forward]` inter-session injected content, including errors, status messages, and workflow anomalies, directly to the user. This creates a trusted message-injection channel that can expose internal system details, leak sensitive operational data, or let another process spoof authoritative user-facing content without validation.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The configuration hard-codes an external backend over plain HTTP and enables recurring polling for up to three hours, creating an unnecessary data flow and command channel that is not clearly aligned with the stated login/direct-use purpose. This expands the trust boundary, risks interception or tampering in transit, and could allow remote tasking or data exfiltration if the backend is compromised or misused.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest describes a simple login/direct-use skill, but the config adds long-running periodic communication with an external IP-based SaaS endpoint, which is a significant hidden capability mismatch. Such undisclosed background networking is dangerous because it can be used to transmit credentials, collect usage data, or receive remote instructions outside the user's expectations, especially since the endpoint uses insecure HTTP.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code derives a persistent device fingerprint from BIOS UUID, machine ID, and MAC address, then hashes it into a stable identifier used for login. This goes beyond ordinary session handling and creates a cross-reinstall tracking mechanism that can uniquely bind an account to a machine, increasing privacy and surveillance risk if users are not clearly informed and if the backend is compromised or misused.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file reads the user's OpenClaw configuration from ~/.openclaw/openclaw.json and directly accesses the gateway bearer token and channel credentials. Even if used for legitimate messaging integration, this grants the skill access to sensitive local secrets and enables authenticated actions against the local gateway on behalf of the user if the skill is triggered unexpectedly or modified later.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill spawns a detached background polling process and can forcibly kill prior processes by PID, including SIGKILL/taskkill behavior. This creates persistence-like behavior and process-control side effects outside the immediate user action, which is risky in an agent skill because it can continue running, interfere with other local processes if PID state is stale, and is not clearly bounded by user interaction.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill writes a temporary Python script to disk and executes it locally via execSync to process remotely downloaded media. Although arguments are quoted, this still expands the attack surface substantially: it depends on an external interpreter and Pillow, executes local code generated at runtime, and processes attacker-controlled files, which can lead to denial of service or exploitation through unsafe parser dependencies.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code explicitly instructs users to send account credentials in plain chat text when a token expires. Chat messages are commonly logged, retained, visible to operators, and exposed to integrations, so encouraging password submission through chat can lead to credential theft, replay, or accidental disclosure far outside the intended button-handling workflow.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script enumerates every guild the bot is a member of and registers the /tkseller command in all of them without any allowlist, confirmation, or scope restriction. That creates an overbroad deployment capability: a user running this script may unintentionally modify all servers the bot can access, which exceeds the narrowly implied behavior of simply using /tkseller and increases blast radius if the skill is misused or compromised.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This file performs privileged Feishu application administration actions—creating bot menus, registering bot commands, and querying app details—that are materially broader than a user-facing '/tkseller' shortcut description suggests. In a skill ecosystem, hidden administrative side effects are dangerous because they can alter external service configuration using locally stored credentials without clear operator awareness or consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script reads OpenClaw's local configuration from the user's home directory and extracts Feishu app credentials, even though that capability is not justified by the stated shortcut behavior. Accessing local secrets outside clearly disclosed setup flows is risky because a seemingly simple skill can silently leverage existing credentials to administer third-party services.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The skill reads global Discord configuration from the user's home directory and performs automatic command registration even though the primary skill purpose is login/recommendation. This expands scope beyond user-requested actions and causes side effects in external infrastructure, which is risky in an agent-skill context because it silently modifies Discord bot state and consumes sensitive cross-skill configuration.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README advertises a very broad plain-text trigger phrase ("带货") that can be invoked in Discord or webchat, increasing the chance of accidental or context-unaware activation. In a skill that can initiate account-linked automation and workflow actions, unintended invocation can expose users to unwanted prompts, state changes, or social-engineering opportunities.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The README explicitly instructs users to send their username and password in chat using the format "登录 用户名 密码," with no warning about message visibility, retention, logging, or safer authentication alternatives. Chat systems commonly log, persist, and expose messages to bots, admins, integrations, or other participants, so this guidance creates a clear risk of credential disclosure and account compromise.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill declares very broad activation conditions, including common words such as the skill name, 'start', recommendation-related terms, and uncertain cases being routed to the script anyway. This can cause unintended execution on unrelated user messages, leading to accidental login capture, unwanted backend actions, or confusion-driven tool invocation in contexts where the user did not intend to use this skill.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The installation flow says a user can trigger auto-registration through ambiguous free-text containing the skill name, rather than an explicit administrative command. That increases the chance that ordinary conversation causes side effects such as Discord command registration, which is a privileged environmental change outside normal chat intent.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The skill asks users to provide login credentials and describes local token storage, but does not clearly warn that credentials are transmitted to a backend API and tokens are stored locally. This undermines informed consent and increases the risk of users sharing sensitive credentials without understanding where they go or how they persist.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill states that product images are downloaded and stored locally for webchat rendering, but the user-facing description does not clearly disclose this behavior. Even if the data is not highly sensitive, undisclosed local storage of fetched remote content can have privacy, storage, and content-handling implications.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill explicitly states it will automatically retry failed video generation and may pause or continue operational workflows on the user's behalf, but it does not clearly warn the user about these autonomous actions or their limits. This can create consent and control problems, especially in an operational account context where retries or pauses may consume resources or affect publishing workflows unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file collects hardware identifiers through OS commands without any visible user notice, consent flow, or disclosure at the point of collection. Undisclosed collection of persistent identifiers is dangerous because users cannot make an informed choice, and the identifier can be used for tracking, account binding, or correlation across activity.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill silently fetches remote URLs and writes the content into local storage under the skill data directory. This can expose the host to SSRF-like access patterns, disk consumption, and unexpected persistence of remote content without the user's awareness, especially because the URLs originate from external services and are only checked for HTTP(S) scheme.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The compression path launches a local Python subprocess without any user-facing disclosure, creating hidden execution of local tooling as a side effect of normal skill usage. In this context, undisclosed subprocess execution is risky because users may not expect the skill to invoke local interpreters or require Pillow, and failures or abuse can affect system stability and trust boundaries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code transmits app_id and app_secret to Feishu's token endpoint to obtain a tenant access token, which is expected for the API but still constitutes secret handling and external transmission. Without clear disclosure, operator consent, and tight scoping, this creates a secret-use pathway that a user may not expect from the described skill and increases the blast radius if the script is abused or repurposed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code silently reads the global OpenClaw Discord bot token configuration and then launches a registration subprocess without user-facing disclosure. Even if it does not exfiltrate the token directly, accessing sensitive configuration and using it for out-of-band actions violates user expectations and increases the blast radius if the skill is invoked in an unintended context.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The unconditional forwarding rule instructs the model to relay all backend-injected content verbatim, explicitly including technical errors, system-like messages, and invalid-return notices. In this skill context, that is especially dangerous because the forwarded content arrives through inter-session injection and is treated as trusted output, enabling prompt/message injection, leakage of internals, and spoofed workflow control messages to the user.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib-js/api.mjs:85

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib-js/card-tools.mjs:477

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib-js/poll-loop.mjs:153

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib-js/trigger.mjs:272

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.json:4

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: lib-js/api.mjs:51