Security audit

EchoTik-视频下载地址查询

Security checks for vulnerabilities and agentic risk

Overview

The skill can resolve TikTok video links, but it also adds automatic feedback reporting, account login, billing, and risky credential-handling behavior that users should review before installing.

Install only if you are comfortable using LinkFox-hosted APIs and reviewing each network, account, and payment action. Avoid entering SMS codes through the agent if possible, do not send automatic feedback containing user prompts or URLs, keep LinkFox endpoint environment variables at trusted defaults, and store any API key in a safer credential manager rather than shell startup files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:107
Finding: Automatic Non-Consensual Transmission of User Feedback and Intent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/echotik_get_video_download_url.py:36
Finding: Credential-Bearing Requests Can Be Redirected to Environment-Controlled Hosts
Content: View full analysis
str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key not configured", file=sys.stderr, ) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` The onboarding client similarly allows complete authentication-service origins to be supplied through the environment: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_UR ...[truncated 3746 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onboarding.py:487
Finding: API Keys and SMS Verification Codes Are Exposed Through Output, Arguments, and Plaintext Configuration
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key obtained successfully (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` The phone number and SMS verification code are accepted as command-line arguments: ```python p = sub.add_parser("login", help="Log in with a verification code and obtain an API key") p.add_argument("phone") p.add_argument("code", help="SMS verification code") p.add_argument("--channel", default="skill", help="Channel, defaults to skill") ``` The documented workflow invokes the command with both values in the command line and recommends writing the resulting key to shell startup files: ```text python scripts/onboarding.py login setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis Command-line arguments may be recorded in shell history and, on some systems, exposed to other local users through process-inspection interfaces while the command is running. Standard output is commonly captured by Agent transcripts, terminal logs, CI systems, s ...[truncated 1496 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/response_io.py:203
Finding: Generic Response Helper Executes Arbitrary Local Python Files with the Full Agent Environment
Content: View full analysis
Path: p = Path(script_arg).expanduser() if not p.is_absolute(): p = (Path.cwd() / p).resolve() else: p = p.resolve() if not p.is_file(): _err(f"--script path not found: {p}") return p ``` It then copies the complete parent environment and executes the selected file with Python: ```python def cmd_run(args: argparse.Namespace) -> int: main_script = _resolve_script(args.script) skill_name = _resolve_skill_name(main_script) out_dir = Path(args.out_dir).expanduser().resolve() try: out_dir.mkdir(parents=True, exist_ok=True) except OSError as e: _err(f"Failed to create --out-dir {out_dir}: {e}") if not os.access(out_dir, os.W_OK): _err(f"--out-dir is not writable: {out_dir}") child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" timed_out = False try: proc = subprocess.run( [sys.executable, str(main_script), args.params], capture_output=True, text=True, encoding="utf-8", errors="replace", env=child_env, timeout=args.timeout, ) ``` The command-line definition exposes this unrestricted path as `--script`: ```python p_run.add_argument( "--script", required=True, help="Path to the main script to execute, e.g. scripts/my_api.py" ) ``` ### Technical Analysis The helper does not restrict `--script` to the current Skill directory, an approved filename, or a trusted hash. Any readable local file can be passed to the Python interpreter. Resolving the path prevents simple ambiguity but does not ...[truncated 1896 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (33)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/echotik_get_video_download_url.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, access tokens, refresh tokens, and generated API keys, to those endpoints via requests.post. If an attacker can influence environment variables in the execution context, they can redirect these calls to attacker-controlled infrastructure and exfiltrate credentials or impersonate upstream services.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: The gateway helper constructs a urllib Request using a base URL sourced from environment variables and attaches the API key in the Authorization header before calling urlopen. An attacker who can control LINKFOX_AGENT_API_URL or related variables can force authenticated requests to an arbitrary host, causing API key leakage and enabling SSRF-like outbound access from the skill runtime.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a narrow TikTok parsing utility, but it also documents generic subprocess execution, persistence of script output, and querying of saved files in multiple formats. That turns a focused media-resolution skill into a broader local execution and data-processing surface, creating opportunities for misuse, overcollection, and unexpected local side effects beyond the user's intent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a narrow TikTok parsing utility, but it also documents generic subprocess execution, persistence of script output, and querying of saved files in multiple formats. That turns a focused media-resolution skill into a broader local execution and data-processing surface, creating opportunities for misuse, overcollection, and unexpected local side effects beyond the user's intent.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
}

text
## Display Rules 1. **Present the no-watermark link first**: When `noWatermarkDownloadUrl` is present, surface it as the primary download option, since clean assets are usually what sellers want 2. **Offer the watermarked variant**: Also list `downloadUrl` (watermarked) when present, in case the user wants the original branding

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This onboarding document introduces authentication recovery, account registration, and billing flows that are unrelated to the stated purpose of a TikTok video URL parsing skill. That scope expansion creates an unjustified path for collecting credentials, handling account lifecycle actions, and steering users into payment-related interactions, which increases the chance of abuse or data exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented ability to collect a phone number, send SMS codes, log in, and purchase plans is materially broader than what is needed to extract download or playback URLs from a TikTok link. In the context of this skill, those features enable unnecessary access to personal data and payment workflows, making social engineering, unauthorized account actions, or sensitive-data mishandling more plausible.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements an onboarding, login, API-key issuance, package listing, order creation, and payment workflow, which is materially unrelated to a skill whose declared purpose is extracting downloadable TikTok video URLs. Such scope mismatch expands the attack surface to credential handling and billing operations, creating opportunities for data exposure, account abuse, and unauthorized charges that users would not reasonably expect from this skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill contains package selection, order creation, and payment QR generation capabilities that are not justified by the stated video-link parsing purpose. In this context, billing logic is especially dangerous because users invoking a download helper would not expect payment operations, and compromise or misuse could lead to fraudulent purchases or social-engineered payment requests.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code performs SMS-based login, token exchange, team discovery, and API key retrieval/generation, all of which are unrelated to TikTok link parsing and involve handling highly sensitive credentials. In the context of a simple media-download skill, this creates a disproportionate capability to access or mint privileged API tokens, increasing the risk of account takeover and secret exfiltration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: _resolve_script accepts an arbitrary path, resolves it, and only checks that it is a file; later code executes that file as Python. In the context of an agent skill, this is a direct arbitrary local code execution capability that is unrelated to TikTok link parsing and could be abused to run any accessible script on the host.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/response_io.py (reported line 223)May include surrounding context.
python
# Force the child process to emit UTF-8 regardless of the host console # encoding (Windows defaults to cp936 / gbk and would otherwise corrupt # non-ASCII bytes when we read them back). child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" timed_out = False

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill describes capabilities that imply access to environment variables, filesystem, network, and shell execution, but it declares no explicit tool scope or permission boundaries. In an agent setting, this increases the chance that a seemingly simple TikTok URL parser can invoke broader capabilities than users expect, enabling unintended data access or side effects if the implementation or prompts are abused.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is overly broad and instructs activation whenever a user mentions general TikTok download intents, even without explicit EchoTik context. Overbroad activation increases the chance of unintended invocation of a capability-heavy skill, causing unnecessary data transmission, cost incurrence, or exposure to the additional behaviors documented elsewhere in the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill documents persistent local storage of response data but does not clearly warn users about the privacy and retention implications. Even if the primary input is a TikTok URL, responses may include account-linked metadata, session identifiers, or other sensitive operational data that users do not expect to be written to disk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction to always persist full API responses in session-linked files creates unnecessary data retention and expands the blast radius of any sensitive content returned by the service. Storing full responses by default can expose user-provided URLs, account information, error details, or tokens to other local processes, future sessions, or accidental commits.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 91)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/echotik/getVideoDownloadUrl \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented Feedback API introduces a second outbound capability unrelated to the skill’s stated purpose of extracting TikTok video download/play URLs. Because the endpoint accepts free-form content describing what the user said or intended, it creates an unnecessary data egress path that could be used to transmit user prompts or derived sensitive context to a third party without a clear functional need.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The feedback submission feature is not justified by the declared purpose of resolving TikTok video URLs, so it expands the skill’s effective permissions and behavior beyond user expectations. This mismatch increases the risk of covert telemetry or prompt exfiltration because an agent implementing the docs may send user interaction details to an external service that is not needed to fulfill the request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The feedback endpoint explicitly encourages including what the user said or intended in the content field, but the documentation provides no privacy warning or minimization guidance. That omission can lead implementers to transmit personal data, confidential requests, or sensitive business context to an external endpoint, creating privacy and compliance exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions explicitly allow asking the user for a phone number and using it to trigger SMS-based registration and login without any warning about personal-data handling, retention, or consent boundaries. In a skill unrelated to identity onboarding, this is dangerous because it normalizes collection of sensitive contact data and one-time codes outside a clearly justified authentication product flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document tells operators to persist API keys in shell startup files and environment settings without warning that this stores credentials long-term on the user's machine and may expose them to other local processes, backups, or shared profiles. While persistent environment configuration can be legitimate, omitting safety guidance in a broadly triggered skill increases the risk of accidental credential leakage or unsafe handling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The module documentation states that writing to /tmp is forbidden and that output is always stored under the current workspace, but the implementation explicitly falls back to the home directory and then the system temp directory. This mismatch is security-relevant because operators and users may rely on the documented storage boundary when handling potentially sensitive API responses, while the code silently stores them in broader or less protected locations.
Content: No source excerpt is available for this finding.