tiktok-live-cart-automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

This skill is framed as TikTok Live shopping automation, but the shipped code is mostly simulation while the instructions still point users toward real account, cart, checkout, and unofficial dependency use.

Review before installing. Treat this as a prototype or simulator, not working TikTok shopping automation. Do not run it while logged into a TikTok account or install the optional unofficial dependencies unless the publisher clearly separates simulation from production use, pins and verifies dependencies, and documents exact browser/account permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unpinned Unofficial Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–66
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code Snippet

markdown

*   **Dependencies (for real-world usage beyond simulation):**
    *   **Selenium WebDriver:** `pip install selenium`
    *   **TikTok Live API Library:** `pip install TikTokLive` (Note: This is an unofficial API and may be subject to changes or discontinuation by TikTok.)
    *   **ChromeDriver:** Download the appropriate version for your Chrome browser from [https://chromedriver.chromium.org/](https://chromedriver.chromium.org/) and ensure it's in your system's PATH.

Technical Analysis

The setup instructions direct users to install packages by mutable package name without pinning reviewed versions, verifying cryptographic hashes, or supplying a lockfile. They also explicitly identify TikTokLive as an unofficial API package.

Python packages can execute code during installation through build-system hooks, and their imported runtime code executes with the invoking user's privileges. Because no version or artifact hash is specified, the content installed by these commands may differ from what was originally reviewed. The separately downloaded ChromeDriver binary likewise lacks a specified version, checksum, or signature-verification procedure.

Neither Selenium nor TikTokLive is imported by the supplied implementation. Recommending their installation for the current simulation therefore unnecessarily increases the project's supply-chain attack surface.

Attack Path

1. A user follows the prerequisites in SKILL.md.
2. The user runs pip install TikTokLive or pip install selenium without a version constraint or hash verification, or downloads an unspecified ChromeDriver binary.
3. The package manager or user retrieves the latest artifact available under that dependency name.
4. If the upstream project, maintainer account, distributi ...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Selenium, TikTokLive, and ChromeDriver installation instructions while the shipped implementation remains a local simulation that does not use them.
2. If these dependencies become necessary, pin each dependency to a reviewed exact version in a requirements or lock file.
3. Record and enforce cryptographic hashes for Python distribution artifacts, such as through pip install --require-hashes.
4. Review the source, maintainership, release history, and transitive dependencies of the unofficial TikTokLive package before adoption.
5. Obtain ChromeDriver only from the official verified distribution channel, pin the compatible version, and document checksum or signature verification.
6. Install dependencies in an isolated virtual environment under a non-privileged account.
7. Add automated dependency vulnerability and integrity scanning to the release process.
8. Document which source files require each dependency so users are not instructed to install unused components.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims live-stream monitoring, cart interaction, and checkout preparation, but the analyzed behavior indicates only placeholder output with none of the promised automation. This mismatch is dangerous because users or downstream agents may rely on the documented behavior and permissions model, leading to unsafe trust assumptions, accidental execution of incomplete code, or later substitution with more privileged behavior than reviewers approved.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises automation that would require file access and shell/script execution, but it declares no explicit tool scope or permissions. In an agent environment, this creates an authorization ambiguity where the runtime may grant broader capabilities than reviewers or users expect, increasing the risk of unintended file access or command execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/monitor_pinned_products.py (reported line 27)May include surrounding context.

python

print("[*] Calling cart_automation.py to add product to cart...")
    # Execute the cart automation script
    try:
        subprocess.run(["python3", "cart_automation.py"], check=True)
        print("[+] Cart automation script executed successfully.")
    except subprocess.CalledProcessError as e:
        print(f"[-] Error executing cart_automation.py: {e}")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is presented as TikTok Live shopping automation, but it does not integrate with TikTok, Selenium, a browser session, or any cart/checkout system; instead it only simulates detections with random data. In a commerce automation skill, this mismatch is dangerous because users or higher-level agents may rely on fabricated state, leading to incorrect purchase decisions, broken workflows, or unsafe assumptions about what actions were actually performed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline comments explicitly say real operation would require TikTok Live API or WebSocket connectivity, yet the implemented logic generates random products locally. This creates deceptive behavior inside an automation context: downstream systems may treat synthetic events as real shopping signals, causing false cart contents, bad operational decisions, and loss of trust in agent actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.