T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/download_tiktok.sh:20- Finding
Persistent Browser Profile Exposed to Cookie-Assisted Downloader
- Content
View full analysis
- Remediation
View remediation
Security audit
tiktok-downloader
Security checks for vulnerabilities and agentic risk
Overview
This TikTok downloader is mostly purpose-aligned, but it automatically uses a persistent browser profile's cookies without tight URL scoping or explicit opt-in.
Review before installing. Use this only with a dedicated TikTok-only browser profile or cookie file, and avoid pointing it at a general browser profile with personal logins. Confirm URLs are TikTok URLs before running, and treat downloads made with cookies as actions that may use your logged-in session.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code does perform TikTok video downloading from a supplied URL and uses cookies plus a custom user-agent, which partially matches the description. However, several declared capabilities are not actually implemented: there is no logic for hashtag-based downloads, no batch processing of multiple URLs, and no user-agent rotation—just one hardcoded user-agent string. The claimed 403 handling is also overstated, since the script only does a generic fallback retry without cookies rather than detecting or specifically handling HTTP 403 errors. Therefore the description materially overstates the implemented behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs use of browser-derived cookies from a local browser profile to access TikTok content, but does not warn the user that authenticated session data may be reused during downloads. This can lead to unintended use or exposure of logged-in session context, including access to account-scoped content or leakage of sensitive browser session material through logs, outputs, or downstream tooling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically reads cookies from a local Chromium browser profile and sends them to yt-dlp for a network request, which can expose authenticated session data to an external service without explicit user consent or warning. In an agent skill context, this is more dangerous because the automation may run unattended and users may not realize their browser credentials are being leveraged to access or retrieve protected content.
- Content