EchoTik-Tiktok新品排行

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.8

Overview

The skill performs the advertised TikTok product ranking lookup, but it also handles account login, API keys, billing orders, local persistence, and automatic feedback reporting in ways users should review carefully.

Before installing, treat this as a paid LinkFox integration that may collect phone numbers, SMS codes, API keys, account/team data, product research queries, and payment-order details. Use it only if you trust LinkFox and the runtime environment, avoid endpoint override variables unless you control them, do not paste API keys into chat or shared logs, and prefer a first-party account page or secret store over shell-profile plaintext storage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/echotik_list_new_product_rank.py:35

Finding

Configurable Network Endpoints Can Exfiltrate API Keys, Access Tokens, and Session Metadata

Content

View full analysis

str: """Gateway base address: environment override, then production.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script applies the same pattern to three endpoints: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` These endpoint values are used in requests carrying phone numbers, SMS verification codes, API keys, access tokens, refresh ...[truncated 2499 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/echotik_list_new_product_rank.py:250

Finding

Unvalidated SESSION_ID Enables Path Traversal and Writes Outside the Intended Session Directory

Content

View full analysis

str: """Prefer SESSION_ID; otherwise generate a local identifier.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script repeats the same issue: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` Examples such as `../../outside` escape the expected dated directory. On POSIX systems, an absolute value such as `/var/tmp/chosen` causes `os.path.join` to discard preceding components. The scripts subsequently create `_meta.json`, append index metadata, write full API responses, or save payment QR images under the ...[truncated 1520 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:478

Finding

Generated Long-Lived API Key Is Printed to Standard Output and Encouraged in Shell History

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} Successfully obtained API key " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` In an agent environment, standard output is commonly captured in transcripts, orchestration logs, CI logs, or tool-call records. The secret therefore becomes visible beyond the process that needs it. The documented invocation also puts the phone number and SMS verification code in command-line arguments: ```text python scripts/onboarding.py login ``` Command-line arguments may be retained in shell history and can be visible in process listings. The documentation then recommends inserting the API key directly into shell commands and persistent shell configuration: ```text setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ...[truncated 1301 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:170

Finding

Automatic Feedback Instructions Can Disclose User Intent Without Explicit Consent

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (25)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/echotik_list_new_product_rank.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material to them via requests.post. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect SMS login, access tokens, refresh tokens, and generated API keys to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The gateway request path uses an environment-derived base URL and attaches the LINKFOX_AGENT_API_KEY in the Authorization header before calling urlopen. An attacker who can alter LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY can redirect requests to a rogue server and capture the API key, order data, and account metadata.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is ranking TikTok Shop new products, but the skill also references onboarding flows that include phone login, API key generation, account lookup, subscription purchase, payment QR generation, and order-status queries. This is a major scope expansion into authentication, account access, and billing operations, which could enable sensitive actions unrelated to the user’s original product-research intent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions are overly broad, allowing activation for loosely related product-research or trend-discovery requests even when the user does not explicitly ask for EchoTik or TikTok new-product rankings. Overbroad triggering can cause unexpected tool use, unnecessary paid API calls, and collection or processing of data outside the user’s intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

| Image URL | imageUrl | Product image URL |
| Image URLs | productImageUrls | List of product image URLs |

## Display Rules

1. **Present data only**: Show query results in clear tables without subjective business advice
2. **Sales trend clarification**: When showing sales trend data, translate the numeric flag into human-readable labels: 0 = Stable, 1 = Rising, 2 = Declining

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file documents authentication recovery, phone-based registration, and billing purchase flows that are outside the stated purpose of a TikTok new-product ranking skill. This capability expansion is dangerous because it enables the skill to collect sensitive user data and steer users into account creation and payment workflows unrelated to its declared analytics function, increasing phishing, overcollection, and abuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented ability to collect a phone number, send a verification code, log in, and create purchase orders is unjustified for a product-discovery skill. In context, this greatly broadens the skill's authority from analytics into identity, account, and payment operations, which creates unnecessary exposure to credential theft, social engineering, and unauthorized transactions.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements LinkFox onboarding, SMS authentication, API key retrieval, plan listing, ordering, and payment QR generation, which is materially unrelated to the declared EchoTik/TikTok product-ranking purpose. This capability mismatch increases risk because users invoking a data-discovery skill may be prompted into credential submission, account provisioning, or billing flows they did not expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Embedding account provisioning and billing operations inside a product-trend skill creates unjustified access to authentication and payment workflows. In context, this is especially dangerous because the skill description promises TikTok new-product discovery, so users and orchestrators may not anticipate SMS login, API-key issuance, or purchase operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation indicates capabilities involving environment variables, file writes, and network access, but it does not declare any explicit tool scope or allowed-tools restrictions. In an agent setting, missing least-privilege boundaries can let the skill access more resources than users would reasonably expect, increasing the risk of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The activation text embeds both Chinese and English trigger phrases, but the skill does not explain how language choice is determined or whether the user's preferred language will be respected. This can violate language/locale policy expectations when a skill implicitly fixes or mixes languages without explicit user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 80)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/echotik/listNewProductRank \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions direct the agent to ask for the user's phone number and pass it to a registration script without any explicit warning about privacy, retention, or who operates the backend. That makes the flow risky because users may disclose personal data to an agent-mediated process without informed consent or understanding how that data will be used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions tell the agent to help users obtain and configure an API key but do not warn that the key is a sensitive credential that grants account access. In an agent context, this omission is dangerous because it normalizes sharing, displaying, and persistently storing secrets without guidance on secrecy, least exposure, or revocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring explicitly says writing to /tmp is forbidden, but the implementation falls back to the system temp directory when other locations are unavailable. This can violate operator expectations and may expose persisted API responses in a less controlled location, especially because the script stores full responses and session-organized artifacts on disk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring explicitly says writing to /tmp is forbidden, but the implementation falls back to the system temp directory when other locations are unavailable. This can violate operator expectations and may expose persisted API responses in a less controlled location, especially because the script stores full responses and session-organized artifacts on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends the full JSON parameters to a remote HTTPS endpoint and also includes SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME from the environment in request headers. Although the file documents output behavior, it does not disclose this outbound transmission or prompt the user before sending potentially sensitive task data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persistently caches full API responses and writes complete results to disk under predictable session-linked paths without any retention limit, access control hardening, or sanitization. In this skill context, responses may include commercially sensitive product research data and session metadata, so uncontrolled local persistence increases the risk of data exposure to other local users, processes, or later tasks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The onboarding flow is fixed to 11-digit domestic phone numbers and area code +86, and the user-facing text is entirely in Chinese. This enforces a specific locale/language behavior without offering a user choice or documenting an explicit opt-in within the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code generates or retrieves an API token and returns it in stdout JSON without any built-in protection, masking, or warning about safe handling. In agent or CLI environments, stdout is often logged, captured in transcripts, or exposed to downstream tools, which can lead to credential leakage and unauthorized use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The comment for SMALL_THRESHOLD says small responses are output directly and not persisted. Later in main, the script always resolves an output path and writes the serialized response before deciding whether to print the full body or a summary. This contradicts the comment about non-persistence for small responses.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The function comment promises a path rooted at the current working directory and grouped by SESSION_ID. But resolve_data_path ultimately depends on _linkfox_root, which may choose ACPX workspaces, the user's home directory, or a temp directory instead of <cwd>. This is a direct mismatch between inline documentation and implementation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.