TikTok Comment Replies API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.0

Overview

The skill appears purpose-aligned, but its API token handling can expose the token in URLs or command history.

Install only if you trust the API provider with the token and request data. Prefer running it in a private environment, avoid pasting tokens into chat or logs, and rotate the token if it may have appeared in command history, process listings, or logged URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill accepts the API token via a CLI flag and then injects it into the request as the `token` query parameter, causing the secret to appear in the full URL. Query-string secrets are commonly exposed through shell history, process listings, logs, proxies, monitoring systems, and upstream server access logs, so the token may be disclosed beyond the intended recipient.

VirusTotal

63/63 vendors flagged this skill as clean.