Security audit

TikTok Shop Research by Gecho

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed TikTok Shop research wrapper for Gecho MCP tools, with account/session use and local result saving that fit its stated purpose.

Install this only if you are comfortable using Gecho's MCP server and Chrome extension with a logged-in TikTok Shop session. Treat saved JSON output as local research data that may include proprietary product or competitor context, and choose a workspace or directory you are comfortable retaining and deleting later.

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Low

Confidence: 88% confidence
Finding: This markdown file explicitly states that raw results may be saved locally, but it does not include a user-facing warning that product research data will persist on disk and may contain sensitive or proprietary research context. Under the markdown-file criteria for missing user warnings, behaviors affecting user data should be disclosed clearly.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Content: Join the [WeCom group](https://github.com/gecho-ai/gecho-bridge/blob/main/qywx.jpg), visit [Discord](https://discord.gg/RFDVZMR6Tn), or use the [1:1 support QR code](https://github.com/gecho-ai/gecho-bridge/blob/main/wx.jpg). ## Output guidelines For successful discovery:
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Static analysis

No suspicious patterns detected.