ClawHub
Back to skill

Security audit

Tiktok Bulk Publisher Test

Security checks for vulnerabilities and agentic risk

Overview

This TikTok publishing skill does what it says, but it handles account publishing credentials and public posting with enough weak safeguards that users should review it carefully before installing.

Review this before installing if you will connect a real TikTok account. Use a test account first, avoid passing tokens or client secrets on the command line, prefer tightly scoped environment/secret storage, set privacy explicitly instead of relying on the public default, and consider reducing OAuth scope to only what the workflow actually needs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
tiktok_publisher.py:310
Finding

OAuth Flow Uses a Static and Predictable State Parameter

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Note
Location
tiktok_publisher.py:310
Finding

OAuth Authorization Requests an Unused User Information Scope

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
tiktok_publisher.py:383
Finding

CLI Unnecessarily Requires and Retains the Client Secret for Token-Based Uploads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

Accepting client secrets and access tokens via command-line arguments is dangerous because process arguments are often exposed to shell history, process listings, job control tools, crash dumps, and telemetry. In this skill context, the risk is elevated because the code handles high-value OAuth credentials that allow publishing actions on a user's TikTok account.

Content

Scanner excerpt · tiktok_publisher.py (reported line 391)May include surrounding context.

python
default='PUBLIC_TO_EVERYONE', help='隐私级别')
    parser.add_argument('--client-key', help='TikTok Client Key')
    parser.add_argument('--client-secret', help='TikTok Client Secret')
    parser.add_argument('--access-token', help='Access Token')
    
    args = parser.parse_args()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README promotes bulk publishing to TikTok and lists account-affecting features such as upload, publish, privacy settings, and interaction controls, but it does not warn users that the skill sends content to a third-party platform and can change account state. In this context, omission of consent, privacy, and account-impact warnings can lead to unintended publication, metadata exposure, or misuse of connected TikTok accounts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx clawhub install tiktok-bulk-publisher without pinning a specific version of the package or tool, which introduces a supply-chain risk. If the upstream package or a dependency is compromised, users may execute unexpected code during installation; the risk is elevated because this is an install command users are likely to copy and paste directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill clearly describes uploading videos to TikTok using OAuth tokens, but it does not explicitly warn users that executing the skill will transmit video files, captions, and related metadata to a third-party service. This is a real transparency and privacy issue because users may supply sensitive or unpublished content without understanding the data disclosure involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The environment variable examples instruct users to set a client secret and access token but provide no warning about secure secret handling, storage, shell history exposure, or accidental logging. This increases the risk of credential leakage, which could allow unauthorized publishing actions or abuse of the linked TikTok developer application.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The package description is written entirely in Chinese and presents the skill as a general TikTok bulk publishing tool, but there is no indication that the language constraint is optional or limited to a China-specific audience. Under the policy, a skill that effectively forces a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tiktok_publisher.py (reported line 180)May include surrounding context.

python
"source_info": source_info
        }
        
        response = requests.post(url, headers=headers, json=payload, timeout=60)
        result = response.json()
        
        if response.status_code == 200 and result.get('error', {}).get('code') == 'ok':

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tiktok_publisher.py (reported line 260)May include surrounding context.

python
"source_info": source_info
        }
        
        response = requests.post(url, headers=headers, json=payload, timeout=60)
        result = response.json()
        
        if response.status_code == 200 and result.get('error', {}).get('code') == 'ok':

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tiktok_publisher.py (reported line 288)May include surrounding context.

python
"source_info": source_info
        }
        
        response = requests.post(url, headers=headers, json=payload, timeout=60)
        result = response.json()
        
        if response.status_code == 200 and result.get('error', {}).get('code') == 'ok':

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs a network call to TikTok's OAuth token endpoint using the client key, client secret, authorization code, and redirect URI, which is a sensitive credential-handling operation. Although the file has general docstrings, there is no user-facing print, prompt, or explicit warning in the CLI flow that credentials will be sent to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The primary description line is in Chinese while the rest of the README is in English, but the document does not state any intended language policy or provide user choice. This can be a natural-language policy concern when a skill implicitly forces or assumes a language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

All user-facing instructions in the file are presented in Chinese, and there is no indication that the skill is intentionally limited to a Chinese-speaking audience or that alternative language support is available. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Natural-language strings, docstrings, comments, and CLI help text are entirely in Chinese, and the file does not provide any opt-in or alternative language selection. This can violate a language/locale policy when skills must not force a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.