Security audit

TikTok Carousel Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches a TikTok carousel workflow, but it handles TikTok account sessions in a risky and under-disclosed way.

Review before installing. Treat TikTok cookies as full account credentials, avoid using this on an important TikTok account, and do not run the login/posting flow unless you are comfortable with plaintext local cookie storage and browser automation. Prefer a version that uses an official delegated posting flow or stores credentials in an OS secret manager with clear deletion and consent controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/post_carousel.py:20
Finding: TikTok Session Cookies Stored in Plaintext
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/post_carousel.py:48
Finding: Chrome Security Sandbox Disabled for External Web Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:8
Finding: Documented TikTok Cookie Environment Secret Is Unused and Conflicts with Actual Storage
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: This mismatch is especially risky because it involves automated TikTok authentication, cookie reuse, browser automation, and local cookie storage while presenting itself as a benign content-generation skill. Hidden auth-handling behavior can enable account takeover, unauthorized posting, or session theft if cookies are exposed or reused outside the user's expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch is especially risky because it involves automated TikTok authentication, cookie reuse, browser automation, and local cookie storage while presenting itself as a benign content-generation skill. Hidden auth-handling behavior can enable account takeover, unauthorized posting, or session theft if cookies are exposed or reused outside the user's expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script persists TikTok authentication cookies to a local JSON file, which effectively stores reusable session credentials. If that file is read by another local user, process, backup system, or accidentally committed, an attacker may hijack the TikTok session without needing the password or MFA.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Selenium automation loads saved cookies into a browser session and then performs account actions, enabling automated use of a TikTok account outside the generation-only purpose described for the skill. In context, this makes the skill more dangerous because it bridges from content creation into authenticated account control, which could be abused for unauthorized posting or account misuse.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares access to sensitive environment variables and implies operational capabilities, but it does not declare an explicit tool scope or permissions boundary. This creates a transparency and least-privilege problem: an agent or user may authorize the skill without understanding that it can access secrets and local state, increasing the chance of unintended secret exposure or file misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to provide TikTok session cookies for posting without warning that session cookies are effectively account credentials. If mishandled, these cookies can permit unauthorized account access, posting, or account compromise, and the social-media automation context makes the consequence more severe because it directly targets a live user account.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says this skill generates TikTok photo carousels, and this record is labeled with niche 'music' and product 'gothic rock band Forsaken'. However, the actual slide prompts describe a kitchen, food scanning, meal prep, progress charts, and an app/dashboard, which is a different subject entirely. This indicates the generated/stored output behavior is inconsistent with the skill’s claimed purpose for this carousel instance.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says the skill 'includes learning loop for continuous improvement,' but this file only defines data file paths and never reads, updates, or uses metrics/prompts data to adapt future carousel generation. Carousel generation is based on hardcoded templates and timestamp-based hook selection rather than any feedback-driven optimization.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file header presents this as a simple TikTok poster, while the skill metadata says the skill generates AI carousels. That mismatch matters because the script handles authentication state and posting automation, which are materially more sensitive capabilities than content generation and can surprise users or downstream systems reviewing the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's core behavior is browser automation, login state reuse, and upload flow handling rather than carousel generation or a learning loop. This creates a deceptive capability gap: operators may approve or run a generation tool without realizing it also automates access to a real TikTok account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Sensitive authentication material is written to disk without a meaningful warning, consent flow, or explanation of retention. Users may not realize they are creating a long-lived local credential artifact, increasing the chance of accidental exposure through shared machines, backups, logs, or source-control mistakes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Describing automatic tracking of views, conversion metrics, and strategy updates without a user-facing notice creates a consent and privacy issue. While less severe than credential misuse, silent analytics collection and behavioral automation can still expose user or audience data practices that operators did not knowingly approve.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The top-level documentation presents the skill as producing a fixed 6-slide format, but the code accepts a user-supplied --slides value and generate_carousel() iterates over any requested count. That is a direct contradiction between the documented intent and actual behavior, not merely omitted detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code generates user-facing content such as hooks and post text entirely in English, and the CLI exposes no option to select language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This is a code file, so SQP-2 applies to safety-relevant file writes. Although the script performs visible writes to metrics data, strategy data, and hook performance data, the only disclosure is brief internal docstrings and post-write status prints, which do not clearly warn users in advance that running the command will persist or overwrite local analytics files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The function docstring says 'Post carousel to TikTok' and the module says it 'Posts carousels to TikTok using cookies,' but the implementation only checks login, clicks upload, and prints 'Would post carousel' while noting the upload is a placeholder. This is an active mismatch between the code documentation and actual behavior.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification (+1 more)

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/anyio/to_process.py:241

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/pydantic/_internal/_namespace_utils.py:37

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/pydantic/_internal/_typing_extra.py:669

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/pydantic/v1/utils.py:195

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/tqdm/cli.py:38

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/typing_extensions.py:1485

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/httpx/_client.py:469

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/openai/_client.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/openai/lib/azure.py:235

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/openai/resources/beta/realtime/sessions.py:46

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/openai/resources/beta/realtime/transcription_sessions.py:46

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/openai/types/beta/realtime/session_update_event_param.py:165

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/openai/types/beta/realtime/transcription_session_update_param.py:123

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/openai/types/realtime/realtime_session_create_response.py:420

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_internal/network/auth.py:97

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/requests/adapters.py:257

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connectionpool.py:991

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/httpx/_config.py:43

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_internal/network/session.py:312

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/truststore/_macos.py:371

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/truststore/_windows.py:458

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:794

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/util/ssl_.py:140

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: venv/lib/python3.14/site-packages/httpx/_decoders.py:335