出海匠 TikTok 直播带货洞察

• Outcome: Review
• Latest audit: Sep 14, 2026 · 5:33 AM UTC
• Version: 1.0.0

Overview

The skill mostly does the advertised TikTok livestream research, but it also handles login, API keys, and payment flows with insufficient endpoint and credential-safety boundaries.

Review this skill before installing. Use it only in an environment where LinkFox endpoint variables are trusted, avoid pasting OTPs or API keys into shared agent transcripts, prefer temporary or secret-manager credential storage over shell-profile exports, and inspect/delete saved response, cache, and payment QR files after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/chuhaijiang_live_search.py:39

Finding

Credential Disclosure Through Unrestricted API Endpoint Overrides

Content

View full analysis

str: """Gateway base address: LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): return get_api_base() + API_PATH def call_api(params): global _LAST_CALL_WAS_HTTP_ERROR _LAST_CALL_WAS_HTTP_ERROR = False api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": (os.environ.get("SESSION_ID") or "").strip(), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script similarly permits overrides for services receiving login credentials and access tokens: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LIN ...[truncated 2658 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/chuhaijiang_live_search.py:247

Finding

Arbitrary Filesystem Write Location Through Unsanitized SESSION_ID

Content

View full analysis

str: """Prefer env SESSION_ID; otherwise generate an ID.""" env = (os.environ.get("SESSION_ID") or "").strip() if env: return env if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """Return (linkfox_root, session_dir); session_dir always exists.""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script has the same trust issue: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as trusted despite being read from the process environment. Values containing `..` components can escape the intended date and `linkfox` directories. On systems where an absolute final component overrides preceding components, ...[truncated 1531 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:481

Finding

Full API Key Exposed Through Standard Output

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel ) _emit(r) if "api_key" in r: print( f"{TAG} Successfully obtained API key " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` ### Technical Analysis The API key is a reusable bearer credential. Printing it as ordinary JSON makes it available to every component that captures stdout. In an AI-agent workflow, command output may be retained in tool-call records, model context, terminal scrollback, CI logs, observability systems, or shared session transcripts. Although the user needs a secure method to configure the key, returning it in general command output is not a least-disclosure mechanism. The project's documentation also instructs the surrounding Agent to forward the key to the user, increasing the chance that it enters conversational history. ### Attack Path 1. A user completes SMS verification and invokes the onboarding `login` command. 2. The script obtains or generates an API key. 3. `_cmd_login` passes the complete result to `_emit`. 4. `_emit` prints the plaintext key to stdout. 5. A terminal logger, Agent tool tr ...[truncated 681 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:162

Finding

Unpinned Runtime Dependency Installation Instructions

Content

View full analysis

dict: try: import qrcode except ImportError: err = ( "Missing qrcode dependency; run: " "pip install qrcode pillow" ) print(f"{TAG} render_qr: {err}", file=sys.stderr) return { "png_path": None, "ascii_qr": None, "error": err, } ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The installation commands resolve mutable package versions from the user's configured package index at installation time. There is no lockfile, exact version constraint, hash verification, or trusted-index requirement. This does not prove that the named packages are malicious. The weakness is that the Skill delegates code selection to an unpinned external package source after review. Package installation may execute build hooks or install a compromised future release, making the effective dependency set non-reproducible. ### Attack Path 1. The runtime lacks `requests`, `qrcode`, or `pillow`. 2. The script displays the suggested `pip install` command. 3. The user or Agent executes that command. 4. `pip` selects the current versions from the configured index or mirror. 5. A compromised index, malicious mirror, dependency compromise, or unsafe future release supplies attacker-controlled package code. 6. Installation hooks or subsequent imports execute that code with the privileges of the user running the Skill. ### Impact Assessment Malicious dependency code would execu ...[truncated 414 chars]

Remediation

View remediation

--hash=sha256: qrcode== --hash=sha256: Pillow== --hash=sha256: ``` 3. Install with `pip install --require-hashes -r requirements.txt`. 4. Use a trusted package index or an internally controlled artifact repository. 5. Install dependencies in an isolated virtual environment rather than the user's global environment. 6. Perform software-composition analysis and routinely review dependency updates before changing pinned versions. 7. Avoid runtime instructions that cause an Agent to install arbitrary current package versions automatically. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (24)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/chuhaijiang_live_detail.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        _LAST_CALL_WAS_HTTP_ERROR = True

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/chuhaijiang_live_related_products.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        _LAST_CALL_WAS_HTTP_ERROR = True

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request sent to urlopen includes multiple headers populated directly from environment variables, including SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME, and potentially the gateway base URL via LINKFOX_TOOL_GATEWAY. Because the destination can also be overridden by environment configuration, a malicious or compromised runtime can redirect the request to an attacker-controlled host and exfiltrate sensitive identifiers and the API key in the Authorization header. In an agent/tooling environment where env vars are shared across components, this makes the tainted flow materially risky rather than merely theoretical.

Content

Scanner excerpt · scripts/chuhaijiang_live_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        _LAST_CALL_WAS_HTTP_ERROR = True

Tainted flow: 'url' from os.environ.get (line 234, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The code allows API base URLs to be overridden via environment variables and then uses those values to send requests that may include SMS login data, access tokens, refresh tokens, API keys, and browser-like headers. In an agent/runtime environment where env vars can be influenced by a wrapper, deployment config, or another component, this becomes a credential exfiltration and SSRF-style sink.

Content

Scanner excerpt · scripts/onboarding.py (reported line 195)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 245, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway request path constructs a Request from environment-derived base URLs and forwards the agent API key and session metadata in headers before calling urlopen. If the environment is tampered with, the skill can be redirected to an attacker-controlled host, leaking credentials and enabling unauthorized billing-related operations or internal network access attempts.

Content

Scanner excerpt · scripts/onboarding.py (reported line 247)May include surrounding context.

python

headers["Content-Type"] = "application/json"
    req = Request(url, method=method, data=body_bytes, headers=headers)
    try:
        with urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is read-only TikTok livestream research, but the skill also directs the agent into authentication, account, API-key, and payment/order workflows via onboarding scripts and LinkFox login/user/payment interfaces. This mismatch is dangerous because it hides materially more sensitive behavior than users would expect, enabling credential handling and paid transactions under the cover of a benign analytics skill.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

These examples were production-validated with non-empty semantic results on 2026-08-29. Public-market IDs are volatile; use a fresh search result if an example stops resolving.

## Display Rules

1. State the requested marketplace, filters, sort, page, page size, and returned total.
2. For search, show title, room ID/link, host, time range, audience, products, units sold, GMV, GPM, and OPM when returned.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements account onboarding, SMS verification, API-key issuance, package listing, ordering, and payment QR generation, which is materially unrelated to a Chuhaijiang TikTok live research skill. Such capability expansion is dangerous because it adds credential collection and monetization flows that can trick users into performing actions outside the declared skill purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code creates orders, queries billing status, and renders payment QR codes despite the skill being described as a market research integration. In context, these payment capabilities are unjustified and increase the risk of deceptive purchases, unauthorized charges, or social engineering through the agent interface.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and appears to use environment access, file writes, and network calls, but it does not declare any explicit tool scope or permissions boundary. That increases the chance an agent will invoke broader capabilities than a reviewer or user expects, especially because the document also instructs writing responses to disk and handling auth/onboarding flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document title and all operational instructions are written in Chinese, which imposes a specific language on users. The file does not state that the skill is region-specific or provide an opt-in or alternative locale, so this appears to violate the language/locale policy rule.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 184)May include surrounding context.

入口脚本会把 HTTP 错误和网关 JSON 错误作为结构化内容回显，不应出现未处理的 Python 堆栈。

curl 示例

bash

curl -X POST "${LINKFOX_TOOL_GATEWAY}/chuhaijiang/lives/search" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The onboarding instructions direct collection and handling of a user's phone number and one-time verification code to register/login via a local script, but provide no privacy notice, minimization guidance, or handling safeguards. This creates avoidable risk of exposing personal data and authentication secrets in chat history, logs, terminals, or agent telemetry, especially because the flow explicitly asks the user to provide sensitive data to the agent-driven process.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file instructs users to persist an API key in shell startup files or via permanent environment-variable commands without warning that these locations store credentials in plaintext and may be readable by other local users, backups, support tools, or later disclosed during troubleshooting. Sourcing profile files immediately after appending the key also increases the chance of accidental exposure through shell history and copied commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script sends user-supplied parameters plus session metadata (SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME) to a remote service, but the runtime behavior is not clearly disclosed to the operator beyond generic usage text and comments. In a skill context, this can cause unintended transmission of sensitive prompts, identifiers, or research inputs to an external endpoint without meaningful consent or minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script always persists the full API response under the current working directory, which may contain sensitive or regulated data, and does so by default without a clear runtime warning or opt-in. In shared workspaces or agent environments, this increases the chance of unintended local data exposure, later reuse by other tools, or accidental check-in to source control.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script always writes full API responses plus session metadata into the current project directory, which can retain potentially sensitive commercial research data, identifiers, and activity traces beyond the immediate task. Persisting data by default broadens exposure to other local users, later tooling, commits, backups, or unintended workspace sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code sends the JSON params payload plus session-related environment values (SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME) to a remote HTTPS endpoint. Although the module docstring mentions the API path and file-output behavior, it does not clearly warn users that their supplied data and contextual metadata will be transmitted over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 195)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code forces the login flow to use areaCode '+86' and later restricts payment methods to WeChat and Alipay, indicating a fixed locale-specific experience. There is no natural-language indication in the code that this is optional, user-selectable, or justified as a region-specific skill, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill writes a payment QR PNG to a session directory on disk and returns the local file path, but this file provides no explicit warning about persistence, location, or cleanup. On shared hosts or agent workspaces, this can leave sensitive payment artifacts accessible to other users or processes beyond the immediate task.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The on-disk cache stores successful API responses for up to 24 hours under a predictable project-local path, creating additional retention of potentially sensitive query results outside the user's immediate expectation. While not overtly malicious, this increases the attack surface for local disclosure and stale-data reuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The top-level docstring presents key usage and behavior information partly in Chinese and partly in English, which imposes a language expectation on users without opt-in. The policy requires avoiding forced language or locale constraints unless the tool offers a choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.