EchoTik-视频详情

• Outcome: Review
• Latest audit: Jul 23, 2026 · 1:35 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its TikTok analytics purpose, but it adds automatic feedback reporting and has storage/network scoping issues users should review before installing.

Install only if you are comfortable sending TikTok video IDs or URLs, your LinkFox API key, and session/app metadata to LinkFox services, and with full responses being saved locally. Review or disable automatic feedback reporting if you do not want user comments or operational context sent to a separate feedback endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 90% confidence
• Finding: with urlopen(req, timeout=120) as response:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs use of environment variables, network access, and persistent file writes, yet no explicit permissions are declared. That creates a transparency and policy-enforcement gap: a host system or reviewer may not realize the skill can access credentials, call external services, and write response data to disk, including under session-derived paths. In this context the risk is increased because the skill also specifies downloading/installing another skill and saving full API responses locally.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The file documents a separate feedback submission API that is outside the skill’s stated purpose of batch TikTok video detail lookup. Adding an unrelated write-capable endpoint expands the skill’s effective capabilities and could enable unintended outbound transmission of user content or operational metadata to a third party without a clear task-driven need.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documented feedback reporting capability is not justified by this skill’s read-oriented analytics purpose, making it an unnecessary data egress path. In the agent context, such hidden or weakly justified write operations are dangerous because they can be repurposed to exfiltrate user prompts, results, identifiers, or usage details under the guise of operational feedback.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill persistently stores full API responses and also maintains a cache on disk, even though its stated purpose is only to batch-query TikTok video details. Because the returned data may include account identifiers, commercial metrics, and other potentially sensitive analytics, persistent storage expands the data exposure window and creates unnecessary local data retention risk.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module documentation explicitly states that writing to /tmp is forbidden, but the implementation can fall back to tempfile.gettempdir()/linkfox when preferred locations are not writable. This mismatch is dangerous because users or calling agents may rely on the stronger documented guarantee and unknowingly allow sensitive response data to be written into less trusted temporary storage.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger text is broad enough to activate on generic TikTok video analysis requests even when the user did not ask for this specific paid batch-lookup capability. That can cause unintended tool invocation, unnecessary external data transfer, and unexpected billing, especially since the skill emphasizes triggering even without explicit mention of EchoTik. The context makes this more concerning because each call consumes credits and may write retrieved data to disk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script always writes the full API response to disk by default, without any explicit runtime warning or user confirmation in the execution flow. This is risky because users may expect a transient query tool, while the implementation silently creates durable local copies of potentially sensitive analytics and account-related data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The request includes SESSION_ID, MODE_ID, and APP_NAME from the environment and sends them over the network without any user-facing disclosure or necessity proof in the code path. Even if these are not secrets by themselves, they are contextual metadata that can enable correlation, tracking, or workspace/session leakage to the remote service.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.