EchoTik-商品详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.6

Overview

The skill mainly performs a paid TikTok product-detail lookup, but it also includes account login, API-key generation, payment ordering, automatic feedback reporting, and broad local persistence that deserve manual review.

Install only if you are comfortable with LinkFox/EchoTik receiving product IDs or TikTok Shop URLs and with the skill writing full responses locally. Treat onboarding and recharge flows as sensitive: prefer self-service key setup, avoid sharing SMS codes through the agent unless necessary, confirm any paid plan/order explicitly, and clean up saved response/cache/QR files if they contain business-sensitive data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), args.params],
            capture_output=True,
            text=True,

• Confidence: 95% confidence
• Finding: The script executes a Python file whose path is supplied via the --script argument, with only an existence check in _resolve_script and no restriction that it must belong to the current skill directory or an allowlisted path. In an agent setting, this creates arbitrary code execution if an attacker can influence the script path or trick the agent into invoking a different file.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in headers, including the API key and session metadata, and the destination host is partly controlled by the LINKFOX_TOOL_GATEWAY environment variable. That creates a tainted flow from environment data to network egress, so a manipulated runtime environment can redirect credentials and contextual identifiers to an attacker-controlled endpoint.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST destination is derived from helper functions that accept environment-variable overrides for base URLs, and this function can send sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In a hostile or misconfigured runtime, an attacker can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials and personal data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: This gateway request path also uses a base URL sourced from environment variables and attaches the API key in the Authorization header. If the runtime environment is attacker-influenced, requests can be redirected to an untrusted host, leaking the API key and enabling unauthorized account, billing, and order operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require access to environment variables, local file reads/writes, network calls, and shell execution. This hidden capability expansion breaks least-privilege expectations and can expose secrets, modify local project files, or make external requests without transparent user understanding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is product-detail lookup, but the skill also references account login via SMS, API key generation/retrieval, package queries, order creation, payment QR generation, and payment-status polling. That is a major behavior mismatch that can lead to credential handling and financial actions far outside user intent, materially increasing the risk of unauthorized account access or charges.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documentation introduces a separate feedback API that is unrelated to the core batch product detail lookup capability. In an agent-skill context, this creates an unexpected secondary data flow to another external endpoint, which can lead to user content being transmitted off-purpose without clear consent boundaries or strict trigger conditions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script always persists full API responses, keeps a response cache, and maintains per-session metadata files unrelated to the core act of querying product details. This expands the data-retention surface and can leave sensitive business data, identifiers, or usage traces on disk longer than users expect.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure should occur if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This mismatch undermines operator expectations and can cause sensitive API data to be written into less controlled locations, including shared temp storage.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements account onboarding, SMS login, plan purchasing, and payment handling rather than the declared TikTok product-detail batch lookup behavior. This scope mismatch is dangerous because it introduces privileged account and commerce actions users and reviewers would not expect from an analytics/query skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: These routines perform SMS-based login, token exchange, team discovery, and API key generation, which are unrelated to read-only TikTok product analytics. Hidden credential issuance inside a mismatched skill materially increases the risk of credential theft, unauthorized account access, and user deception.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: Order creation and payment QR rendering are commercial transaction features that do not match a batch product-detail lookup tool. This broadens the blast radius from data retrieval to financial actions, making misuse or silent abuse far more severe.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The skill contains billing-related logic, including QR payment generation and storage, without a manifest justification tied to TikTok analytics. Unjustified financial capability in a read-oriented skill creates elevated risk of surprise charges, phishing-style payment collection, and unauthorized transaction initiation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code accesses account, package, and order-management APIs that are not necessary for the stated product-detail query use case. This excessive capability violates least privilege and can expose users to account changes, purchase flows, and sensitive data handling outside expected behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger scope is broad enough to activate on general TikTok product-analysis requests, even when the user did not ask for this specific external service or for a paid batch lookup. Over-broad invocation can cause unintended external API usage, unnecessary cost, and disclosure of user-supplied product data to a third party.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown instructs posting free-form feedback content to a separate external API without any privacy warning, minimization guidance, or consent requirement. Because the content field may include what the user said or intended, an agent could forward sensitive user data, internal prompts, or conversation context to a third party, creating a meaningful privacy and data-exfiltration risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding instructions explicitly tell the operator to collect a user's phone number and submit it through a script-driven registration flow, but provide no consent language, privacy notice, retention limits, or guidance on secure handling of that personal data. In a skill context, this creates a real privacy and compliance risk because users may be induced to share sensitive contact information without being informed how it will be used or protected.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script always writes the full response to disk and may print the complete JSON to stdout for smaller responses or when --inline is used. In an agent environment, stdout is often captured in logs or transcripts, so product analytics data and related metadata can be exposed beyond the immediate caller.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The function generates or retrieves an API token and returns it to stdout/consumer code without any in-file warning, masking, or handling guidance. In agent environments, emitted secrets are often logged, persisted, or shown to downstream tools, increasing the chance of credential leakage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The helper always writes full subprocess stdout to disk, even on failure and even when output may contain API responses, tokens, PII, or other sensitive business data. In this skill context, which retrieves bulk TikTok product and sales data, persisted responses could expose commercial data or credentials if the wrapped script emits them.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code runs an arbitrary resolved script path as a subprocess without any trust boundary, sandboxing, or explicit execution warning. Although implemented with subprocess.run using an argument list rather than a shell, the core risk remains arbitrary code execution by running attacker-chosen Python code.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This code transmits sensitive onboarding and authentication data to external services, including phone numbers, verification codes, and tokens. External transmission is expected for such workflows, but in this skill it is more dangerous because the functionality is outside the declared purpose and the destination can be environment-overridden.

Static analysis

No suspicious patterns detected.