出海匠 TikTok 视频情报

• Outcome: Review
• Latest audit: Sep 14, 2026 · 5:33 AM UTC
• Version: 1.0.0

Overview

The skill can perform the advertised TikTok research, but it also handles LinkFox login, API keys, billing, and payment-order flows with weak safeguards, so it needs Review before installation.

Install only if you trust LinkFox with your TikTok research queries, LinkFox account details, API key, and any billing actions. Verify service URL environment variables before use, avoid pasting SMS codes or API keys into shared logs, review any shell-profile key export, and clean the local linkfox output directory if saved responses should not remain on disk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/chuhaijiang_video_search.py:38

Finding

Credentials and authentication data can be transmitted to unrestricted environment-controlled destinations

Content

View full analysis

str: """Gateway base URL: LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get( "LINKFOXAGENT_API_KEY" ) if not key: sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": (os.environ.get("SESSION_ID") or "").strip(), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") ``` The onboarding script similarly permits replacement of every sensitive service destination: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.lin ...[truncated 3211 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:486

Finding

Onboarding exposes the complete API key through standard output

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` The login command sends the returned object directly to the output function: ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key obtained successfully", file=sys.stderr) return 0 return 1 ``` ### Technical Analysis The onboarding flow returns the complete generated or retrieved API key in a dictionary and serializes that dictionary to stdout. Standard output is not a secure secret-delivery channel. In Agent-driven, CI, terminal-multiplexer, or automated environments, stdout may be retained in conversation transcripts, build logs, command histories, process captures, or monitoring systems. The behavior also conflicts with the Skill documentation's stated rule that credentials should not be exposed. Masking the phone number does not mitigate exposure of the more sensitive API key. ### Attack Path 1. A user runs `scripts/onboarding.py login` with a valid phone number and SMS verification code. 2. The authentication flow obtains or generates an API key. 3. `_cmd_login()` passes the result to `_emit()`. 4. `_emit()` prints the complete key as JSON to stdout. 5. An Agent transcript, CI logger, shell capture, terminal log, or other observer retains the output. 6. A party with access to the retained output extracts and reuses the credentia ...[truncated 437 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/chuhaijiang_video_search.py:247

Finding

Unsanitized SESSION_ID permits output-path traversal

Content

View full analysis

str: """Prefer SESSION_ID; otherwise generate an identifier.""" env = (os.environ.get("SESSION_ID") or "").strip() if env: return env if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` Onboarding uses the same unvalidated value: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name, but it is obtained directly from the environment. The value is not checked for: - `..` traversal components. - Absolute paths. - Platform-specific directory separators. - Drive prefixes on Windows. - Excessive length or special filesystem names. Because `os.path.join()` discards preceding components when a later comp ...[truncated 1573 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:33

Finding

Onboarding recommends installation of unpinned third-party dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` No dependency lockfile, exact version constraints, or package hashes are present in the audited project structure. ### Technical Analysis The onboarding path depends on `requests`, `qrcode`, and Pillow, but directs users to install package names without versions or integrity hashes. Installation behavior consequently depends on the latest package versions and the package index configured in the user's environment. This is a supply-chain hardening weakness rather than evidence that the named packages are malicious. Risks include version drift, compromised future releases, malicious package-index substitution, or unexpected dependency resolution from an untrusted mirror. Because imported Python packages execute code in the user's process, compromise of a resolved dependency can affect all data handled by onboarding, including credentials and payment information. ### Attack Path 1. A user invokes onboarding in an environment where one or more dependencies are missing. 2. The script instructs the user to run an unpinned `pip install` command. 3. The user's package manager resolves packages from its configured index or mirror ...[truncated 727 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (31)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request destination is partly controlled by the LINKFOX_TOOL_GATEWAY environment variable, and the code blindly forwards sensitive headers including the API key plus SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME to whatever host that variable specifies. In an agent or multi-tenant runtime where environment variables can be influenced, this enables credential and metadata exfiltration to an attacker-controlled server via urlopen.

Content

Scanner excerpt · scripts/chuhaijiang_video_detail.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        _LAST_CALL_WAS_HTTP_ERROR = True

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/chuhaijiang_video_related_products.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        _LAST_CALL_WAS_HTTP_ERROR = True

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The request sent via urlopen includes multiple HTTP headers populated directly from environment variables, and the destination base URL is also overridable through LINKFOX_TOOL_GATEWAY. In an agent/runtime context, environment variables are often influenced by the host or orchestration layer, so this creates a true SSRF/exfiltration risk: secrets such as the API key and session metadata can be transmitted to an attacker-controlled endpoint if the gateway variable is poisoned.

Content

Scanner excerpt · scripts/chuhaijiang_video_reviews.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        _LAST_CALL_WAS_HTTP_ERROR = True

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request destination and several outbound headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY and SESSION_ID/MESSAGE_ID/MODE_ID/APP_NAME, and the code sends the Authorization API key to whatever base URL is configured. In a hostile or multi-tenant execution environment, an attacker who can control environment variables can redirect requests to an attacker-controlled server and exfiltrate the API key and request metadata, which is more serious here because this skill is specifically a networked data-access tool.

Content

Scanner excerpt · scripts/chuhaijiang_video_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        _LAST_CALL_WAS_HTTP_ERROR = True

Tainted flow: 'url' from os.environ.get (line 234, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 195)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 245, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 247)May include surrounding context.

python

headers["Content-Type"] = "application/json"
    req = Request(url, method=method, data=body_bytes, headers=headers)
    try:
        with urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a read-only TikTok research capability, but it also instructs the agent to handle onboarding, authentication, billing, order creation, payment QR generation, account/team lookup, and local file output. This hidden expansion into identity, payment, and account-management workflows materially changes the trust boundary and could lead to credential handling, unwanted charges, or sensitive account actions without clear user understanding.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

These examples were production-validated with non-empty semantic results. IDs are volatile public-market examples; use a fresh search result when they stop resolving.

## Display Rules

1. State request context/site code, filters, sort, page, page size, and returned total.
2. For search results, show caption, video ID, creator, country, plays, likes, comments, shares, engagement rate, and product/commerce metrics only when returned.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements SMS login, API key issuance, package listing, and ordering flows that are unrelated to a TikTok public-video research skill. This expands the skill from data retrieval into account onboarding and monetization, creating unnecessary credential-handling and financial-operation attack surface in a context where users would not expect it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Order creation and QR payment rendering enable real billing actions inside a skill whose stated purpose is TikTok video analysis. In this context, financial operations are especially risky because they can trigger purchases, payment artifact generation, and session-linked billing behavior users do not associate with simple research queries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code collects phone numbers and SMS codes, performs login, and returns API keys, which is far beyond the declared scope of a TikTok research tool. In a mismatched skill context, credential capture and token minting are dangerous because they normalize sensitive-auth flows where users expect content analysis, increasing phishing and misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This login flow transmits a phone number and SMS code to remote services and then returns an API key, all without strong in-file warnings or explicit consent controls. Because the skill is supposed to research TikTok videos, this behavior is contextually dangerous and resembles credential harvesting or covert account bootstrap.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The order command performs a real purchase path and then generates a payment QR code without a confirmation prompt. In a research-oriented skill, triggering billable transactions without a strong user-approval checkpoint creates a significant risk of accidental or manipulated purchases.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares no explicit tool scope even though its documented behavior includes environment access, file writes, and network/API calls. Without an allowlist or permissions boundary, an agent may invoke broader capabilities than users expect, increasing the chance of unintended data access, filesystem writes, or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains user-facing operational instructions exclusively in Chinese, including API usage, error handling, and safety guidance. Under the language/locale policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 211)May include surrounding context.

| 视频带货商品 | 18 | | 视频评论 | 18 |

curl 示例

bash

curl --request POST "${LINKFOX_TOOL_GATEWAY}/chuhaijiang/videos/search" \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes this skill as researching public TikTok videos via Chuhaijiang, limited to search, detail, related products, and comment drilling. The file additionally documents a Feedback API endpoint and conditions for submitting reports to a separate service, which is a distinct outbound capability not mentioned in the manifest’s stated scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

A public feedback submission API is not an obvious requirement for searching TikTok videos, fetching video details, related products, or comments. Even though the documentation restricts it to user-authorized situations, it still represents an extra data-export capability outside the skill’s core research purpose as described in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The onboarding instructions direct the agent to collect a user's phone number and use it in a script-driven registration/login flow, but provide no privacy notice, consent language, retention limits, or handling constraints for that personal data and OTP flow. In an agent setting, this increases the risk of unnecessary collection, insecure transmission, logging of sensitive identifiers, and mishandling of account-creation credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends request parameters plus session/application metadata to a remote endpoint automatically, without any runtime notice or consent step in the execution path. In an agent setting, this can expose user task context or identifiers to an external service unexpectedly, especially because LINKFOX_TOOL_GATEWAY can redirect traffic to a different host via environment configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script persistently stores full API responses in both cache files and session data files under the working directory, and the header comments even mandate this behavior. If responses contain sensitive business data, identifiers, or user-derived content, this creates a local confidentiality risk and expands the retention surface beyond the immediate execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script always persists the full API response to the local project directory, including potentially sensitive review data, identifiers, or other user-linked metadata, without runtime opt-in or redaction. In an agent skill context this increases data exposure because responses remain on disk beyond the immediate task and may be accessible to other processes, users, or later workflow steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script always writes the full API response to a project-local file before deciding what to print, which can persist sensitive or regulated data such as TikTok video metadata, comments, or linked commerce information without an explicit runtime confirmation. In shared workspaces or repositories this increases the risk of unintended retention, later disclosure, or accidental commit of collected data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file's user-facing documentation and messages are entirely in Chinese, and the flow is explicitly tied to Chinese phone numbers and payment methods without offering any language or locale choice. This is a natural-language policy concern because the skill forces a specific language/locale experience rather than making it opt-in or clearly documenting a justified regional constraint.

Content

No source excerpt is available for this finding.