TikTok Made Me Buy It

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:23 AM UTC
• Version: 1.0.1

Overview

The skill’s stated workflow is narrow, but it installs and runs a broader third-party PipiAds MCP server globally with access to the user’s API key.

Review the pipiads-mcp-server package before installing, use a revocable and quota-limited PipiAds API key, and prefer running it in an isolated environment if account credits or local workstation exposure matter. This is not evidence of malware, but it deserves review because the installed server has broader authority than the narrow skill instructions enforce.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unreviewed Third-Party npm Package Is Installed Globally and Executed with an API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-24
Vulnerability Type: Third-party dependency and supply-chain exposure
Risk Level: Medium

yaml

    install:
      command: npm
      args:
        - install
        - -g
        - "pipiads-mcp-server@1.0.3"
    primaryEnv: PIPIADS_API_KEY
    emoji: "📊"
    homepage: https://www.pipiads.com
    mcpServers:
      pipiads:
        command: pipiads-mcp-server
        env:
          PIPIADS_API_KEY: "{{PIPIADS_API_KEY}}"

Technical Analysis

The skill directs the host to retrieve pipiads-mcp-server@1.0.3 from the configured npm registry, install it globally, and subsequently execute its command. The dependency's implementation is not included in the audited project, so its installation scripts and runtime behavior cannot be verified from the available source.

Pinning the version reduces unexpected version drift, but it does not provide cryptographic integrity verification, a lockfile, or protection against compromise of the package publisher, registry account, or referenced release. npm lifecycle scripts may execute during installation with the permissions of the npm process. The global installation scope also exposes shared system-level package locations rather than isolating the dependency inside the project.

When the installed MCP server is launched, it is explicitly given PIPIADS_API_KEY. Consequently, the external package is inside the credential trust boundary and can access that secret by design.

Attack Path

1. The skill installer executes npm install -g pipiads-mcp-server@1.0.3.
2. npm retrieves the package and its transitive dependencies from the configured registry without a project lockfile or integrity value supplied by this skill.
3. If the selected package release, publisher account, registry response, or a transitive dependency is compromised, malicious lifecycle code can execute during installation ...[truncated 1239 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor or otherwise obtain and review the exact MCP server source and all transitive dependencies before deployment.
2. Replace the global installation with a project-local dependency managed by a committed lockfile.
3. Verify package provenance, publisher ownership, release signatures or attestations, and registry integrity metadata.
4. Use deterministic installation such as npm ci against an approved lockfile rather than resolving dependencies dynamically.
5. Disable npm lifecycle scripts during installation with --ignore-scripts where the package can operate without them. If scripts are required, inspect and explicitly approve them first.
6. Run the MCP server in a sandbox or container with a non-privileged account, a read-only filesystem where practical, and restricted network and filesystem access.
7. Provide a narrowly scoped, revocable API key with account spending or quota limits. Avoid exposing unrelated environment variables to the process.
8. Monitor API-key use and outbound connections, rotate the credential periodically, and revoke it immediately if package compromise is suspected.
9. Avoid global npm installation unless operationally necessary. If it is unavoidable, use an isolated npm prefix owned by a dedicated service account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.