EchoTik-视频详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.3

Overview

This TikTok analytics skill appears legitimate, but it needs Review because it can handle accounts and payments, auto-send feedback, and writes or redirects sensitive data too broadly.

Review carefully before installing. Use it only if you trust LinkFox with the TikTok URLs/IDs, analytics queries, account data, and payment workflow. Do not allow automatic feedback submission without seeing and approving the payload, avoid storing API keys in shell startup files if possible, verify endpoints are official LinkFox domains, and clean up local linkfox output/cache files that may contain full responses.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/echotik_batch_video_detail.py:36

Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Endpoints

Content

View full analysis

str: """Gateway base address: LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } ``` The onboarding script similarly allows the login and account API destinations to be overridden: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive tokens are attached to requests made to these configurable destinations: ```python if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ``` ### Technical Analysis The scripts trust environment variables as complete network origins without enforcing HTTPS or validating the destination hostname. The affected requests may contain: - LinkFox API keys - Access and refresh tokens - Phone numbers an ...[truncated 1527 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:176

Finding

Automatic Feedback Instructions Can Exfiltrate Conversation-Derived Content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/echotik_batch_video_detail.py:58

Finding

Analytics Requests Transmit Unnecessary Agent and Session Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/echotik_batch_video_detail.py:249

Finding

Unvalidated Session Identifier Allows Output-Path Traversal

Content

View full analysis

str: """Prefer env SESSION_ID; otherwise generate HHMMSS-<6 hex>.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script follows the same pattern: ```python sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) ``` ### Technical Analysis `SESSION_ID` is used as a filesystem path component without rejecting absolute paths, separators, or `..` traversal sequences. In Python, an absolute final component passed to `os.path.join` discards earlier components. Relative traversal sequences can similarly escape the intended date and LinkFox directories after path resolution. The batch script subsequently writes `_meta.json` and full API-response files below the resulting directory. The onboarding script may write payment QR images there. Although filenames are mostly fixed or generated, the destination dir ...[truncated 1093 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Onboarding Directs Users to Install Unpinned Third-Party Packages

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The installation guidance fetches the latest available versions of `qrcode`, `pillow`, and `requests` from the user's configured Python package index. No version constraints, hashes, lock file, or authenticated repository policy is supplied. The package names are legitimate and no typosquatting was identified. The risk arises from mutable dependency resolution: future releases, a compromised package index, or an unsafe custom index could deliver code that was not reviewed with this Skill. Python packages may execute build-system code during installation and arbitrary module initialization code when imported. ### Attack Path 1. The user invokes onboarding in an environment where one of the dependencies is absent. 2. The script instructs the user to run the unpinned `pip install` command. 3. `pip` resolves packages from the user's configured index at that time. 4. A compromised index, compromised release, or unexpectedly unsafe future version supplies malicious code. 5. Installation hooks or later imports execute that code with the privileges of the user running the Skill. ### Impact Assessment A malicious dependency can execute code with the full privileges of the Python process, potentially accessing files, environment variables, API keys, and networ ...[truncated 210 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request URL and outbound headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY and session/app metadata, and are sent directly via urlopen without any allowlist or validation. In an agent/runtime context where environment variables may be attacker-controlled or inherited from an untrusted wrapper, this can redirect authenticated requests to an arbitrary host and leak the API key plus session metadata.

Content

Scanner excerpt · scripts/echotik_batch_video_detail.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The POST target URL is derived from environment-controlled base URLs, and the request can carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables, they can redirect these authentication flows to an attacker-controlled endpoint and exfiltrate credentials or impersonation tokens.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The gateway URL is also built from environment-controlled configuration and is used with the Authorization header carrying the LinkFox API key. An attacker who can set the environment can cause the CLI to send authenticated requests and billing/order operations to a malicious server, exposing credentials and enabling request forgery against downstream systems.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is TikTok video analytics lookup, but the skill also appears to support authentication, API key generation, account/team inspection, package listing, payment order creation, QR-code payment flows, and payment-status checks. This hidden expansion of behavior is dangerous because it can collect sensitive user data, initiate billing-related actions, or alter account state outside the user's expected intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

}

text

## Display Rules

1. **Present a comparison table**: Show one row per video with video description (truncated if long), views, likes, comments, shares, video sales, video GMV, publish date, and creator
2. **Link to original**: When `officialUrl` is available, provide it so users can view the video on TikTok

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented behavior says writing to /tmp is forbidden and failures on an unwritable current directory should error, but the implementation silently falls back to home and temporary directories. This mismatch is dangerous because operators may rely on the documented storage guarantee while the code actually writes full API responses and session metadata into less controlled locations, including temp storage that is often broadly accessible or routinely monitored.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements account onboarding, SMS login, API-key issuance, plan purchase, and payment handling rather than the advertised TikTok batch video-detail capability. This mismatch expands the skill's privilege and attack surface far beyond user expectations, making credential capture and monetization flows appear under an unrelated analytics skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Purchasing and payment QR generation are unrelated to TikTok video detail lookup and introduce financial transaction capability into a data-retrieval skill. In this context, hidden payment functionality is especially risky because users or agents may trigger billing actions they did not anticipate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises capabilities that require environment access, file writing, and network use, but it declares no explicit tool scope or permission boundaries. That makes it harder for the host or reviewer to constrain what the skill may do, increasing the chance of unintended data access, persistence, or external transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation rules are broad enough to trigger on many generic TikTok video analysis requests, including cases where the user did not ask for this specific provider or for a paid external lookup. In context, this is more dangerous because the skill has cost and broader hidden onboarding/payment behaviors, so over-triggering can lead to unnecessary external data sharing or paid operations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill requires unconditional persistence of full responses to session-linked local files, even when only a small subset of the data is needed for the reply. This creates avoidable data retention risk, especially since responses may include user-supplied URLs/IDs, creator metadata, and session-correlated information that can linger on disk beyond the immediate task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 95)May include surrounding context.

}

text

## curl 示例

### 按视频ID批量查询

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document introduces a separate feedback POST endpoint unrelated to the core batch video-detail function. In an agent-skill context, unrelated outbound actions expand the skill’s capability surface and can cause user content or operational metadata to be transmitted to a third party without a clear necessity tied to the requested task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation advertises an external feedback endpoint but provides no privacy notice, data-sharing constraints, or prohibition on sending user prompts/results. That creates a realistic risk that an agent implementer may forward user content, identifiers, or business data to an unrelated external service, causing unintended data exfiltration or compliance issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs operators to collect a user's phone number and drive a registration/login flow via a local script, but it provides no privacy notice, consent guidance, retention limits, or handling requirements for the phone number and SMS verification code. This creates a real risk of unnecessary collection or unsafe handling of personal data and authentication factors during support interactions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script always persists full API responses and also maintains per-session metadata/index files, which expands the data handling surface beyond a simple query-and-return skill. Because the API returns detailed TikTok analytics and creator-related data, automatic local retention can create unnecessary exposure of potentially sensitive or proprietary data to other local users, later processes, or unintended check-ins.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code forwards SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME to the remote service without any notice or narrowing of scope. While such headers may be operationally useful, they expose internal workflow and correlation metadata to the external API provider, which increases privacy and tracking risk, especially when combined with persisted local session indexes.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs SMS-based login and API-token provisioning, which exceeds the expected scope of a batch video lookup tool. This creates unnecessary access to user accounts and secrets, and in the context of a mismatched skill, increases the risk of covert credential harvesting or account abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The SMS verification and login flow is restricted to 11-digit numbers with a fixed area code of +86, and the CLI help text also describes only domestic mobile numbers. This enforces a specific locale/language context without user opt-in or documented justification in the file, matching the language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The login flow prints the newly obtained API key in JSON output without an in-flow warning or masking, increasing the chance of disclosure through terminal history, logs, transcripts, or agent tooling that captures stdout. Since this skill is not primarily an onboarding tool, the surprise exposure of a reusable credential is more dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file primarily uses Chinese for the API reference but switches to English-only instructions in the Feedback API section. This creates an implicit language constraint for part of the skill documentation without user opt-in or a documented justification for the mixed locale usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill creates a session directory and saves payment QR images as PNG files on the local filesystem. While this behavior is functionally related to rendering a QR code, there is no explicit user-facing notice in the order command that a file will be written and where it will be stored.

Content

No source excerpt is available for this finding.