ClawHub
Back to skill

Security audit

tiktok-search

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed TikTok research skill that uses Gecho's MCP and Chrome extension to collect TikTok data and save results locally, with no artifact-backed hidden or destructive behavior.

Install this only if you trust Gecho's MCP server and Chrome extension and are comfortable using them with a logged-in TikTok browser session. Choose a safe save directory for collected JSON files, review or delete saved TikTok metadata/comments when no longer needed, and be cautious with @latest package updates because the runtime code is external to this skill artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger language is broad enough to intercept many ordinary TikTok-related requests and steer the agent toward this skill's toolchain by default. In a skill that invokes external tooling, browser-linked sessions, and local file writes, overbroad activation increases the chance of unintended execution and unnecessary exposure of session-derived data.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states that it saves full raw result sets to a local JSON file, but the description and early setup guidance do not prominently warn users about local persistence, potential retention of comments/metadata, or where data may be written by default. This can lead to unintentional storage of third-party content or sensitive research artifacts on disk without informed user consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.