Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed TikTok Shop product lookup workflow that depends on Gecho's MCP server and Chrome extension, with some third-party setup and local-save cautions but no artifact-backed deception or unsafe automatic behavior.
Before installing, confirm you trust Gecho Bridge and its Chrome extension, because this workflow uses your logged-in browser session to access TikTok Shop data. Prefer a trusted save directory, review any raw files before sharing them, and consider pinning or reviewing the MCP package version instead of always using @latest if your environment requires stricter supply-chain control.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Join the [WeCom group](https://github.com/gecho-ai/gecho-bridge/blob/main/qywx.jpg) or use the [1:1 support QR code](https://github.com/gecho-ai/gecho-bridge/blob/main/wx.jpg).
## Output guidelines
For success:
- Say the tool completed.
The skill instructs users to install and run an MCP server via npx ... @latest, which fetches and executes the newest package version at runtime without pinning or integrity verification. If the upstream package is compromised or a breaking/malicious release is published, users could execute attacker-controlled code on their local machine during setup.
The markdown states that the skill 'saves raw results when possible,' which can affect user data handling and local storage, but it does not explicitly warn users about the potential sensitivity of saved marketplace data or advise them to choose an appropriate location carefully. Because this is a markdown skill description, omitted disclosure about data-impacting behavior falls under missing user warnings.
No suspicious patterns detected.