ClawHub
Back to skill

Security audit

EchoTik-TikTok商品搜索

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a paid TikTok product analytics use case, but it also handles credentials, onboarding, payments, persistent response storage, and automatic feedback reporting in ways users should review carefully.

Install only if you are comfortable giving this skill LinkFox API credentials and using LinkFox-hosted onboarding and billing flows. Avoid sharing SMS codes or API keys through transcripts when possible, review payment steps before showing or scanning any QR code, and clear the local linkfox output/cache directory if product results or account details should not remain on disk.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
94% confidence
Finding
The request sent via urlopen includes multiple environment-derived values in HTTP headers, including the API key and session metadata, and the destination base URL is also environment-controlled through LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path: if an attacker can influence the runtime environment, they can redirect authenticated requests and attached identifiers to an attacker-controlled server.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
88% confidence
Finding
The POST destination is derived from environment-controlled base URLs, and this function sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and token-generation requests. If an attacker can influence environment variables, they can redirect these requests to an attacker-controlled host and exfiltrate credentials or session tokens. The skill context makes this more dangerous because this file performs account onboarding and token provisioning unrelated to the declared TikTok analytics purpose, so it expands the blast radius beyond expected data access.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
87% confidence
Finding
The gateway request target is also built from environment-controlled base URLs, while attaching the LinkFox API key in the Authorization header. An attacker who can alter the environment can redirect requests and capture the API key, user/account data, and order/payment operations. In this skill, that is especially risky because the script includes purchasing and account-management actions that exceed the stated product-analysis scope.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions while its instructions clearly require environment-variable access, network calls, and local file writes. This undermines informed consent and policy enforcement because a host may invoke capabilities the user or platform did not expect. In this context, the hidden capabilities are especially relevant because the skill also handles authentication, billing, and persistent storage behaviors.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is presented as a product-search/analytics tool, but the referenced behavior includes phone login, SMS verification, API-key retrieval, account/team queries, subscription plan listing, payment order creation, QR rendering, and order-status polling. That is a major scope expansion into authentication and payments, which can cause users or the agent to disclose credentials, initiate billing flows, or access account data without clear expectation or consent.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The documentation includes a separate feedback submission API that is outside the core TikTok product-search function of this skill. In an agent setting, unrelated endpoints increase the chance that the agent is induced to transmit user content, task details, or behavioral telemetry to a third-party service without a clear user request or necessity, creating a data exfiltration and scope-creep risk.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script persistently stores full API responses, cache entries, and session metadata on local disk, which goes beyond a transient product-search function. Because the returned data may contain business-sensitive analytics, identifiers, or user query context, this creates avoidable local data retention and disclosure risk, especially on shared workspaces or improperly permissioned directories.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This script implements SMS login, API-key retrieval, subscription discovery, order creation, payment QR generation, and order-status querying, which are unrelated to the skill's declared TikTok product-analysis behavior. That mismatch is dangerous because it introduces hidden credential-handling and payment capabilities users and reviewers would not reasonably expect from an analytics skill. Context increases risk substantially since over-scoped skills are a common vehicle for credential collection and unauthorized monetization.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
The code can create purchase orders and generate payment QR codes, enabling monetization and transaction flows not justified by the stated TikTok data-query purpose. Such hidden commerce functionality can be abused for unauthorized charges, phishing-like payment prompting, or deceptive upsell behavior within a skill expected only to perform analysis. The contextual mismatch makes this significantly more suspicious and harmful.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This block performs SMS-based authentication and retrieves or generates API tokens, granting broader account access than necessary for a TikTok product analytics skill. Even if intended for setup convenience, embedding account bootstrap and token issuance into the skill increases the chance of credential mishandling, overcollection, and abuse. The danger is amplified because these capabilities are not aligned with the declared purpose.

Vague Triggers

High
Confidence
93% confidence
Finding
The trigger is intentionally broad enough to activate even when the user does not mention TikTok or EchoTik, based only on a loose interpretation of product-research intent. Overbroad activation increases the chance the agent routes unrelated commerce queries into this skill, causing unnecessary third-party calls, billing, or data disclosure. Because the skill consumes paid credits and can lead into onboarding/account flows, incorrect activation is materially risky.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The onboarding instructions explicitly tell the operator to collect a user's phone number and use it in a scripted registration/login flow, but they provide no privacy notice, consent language, retention limits, or handling safeguards. This creates a real privacy and security risk because phone numbers and verification codes are sensitive authentication data that could be mishandled, logged, or exposed during support operations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script emits the generated API key in stdout JSON, which is likely to be captured by logs, transcripts, tool outputs, or downstream agents. Exposing long-lived credentials this way creates an easy secret-leak path and may allow account takeover or misuse if any observer can read the output. In an agent skill environment, stdout is especially sensitive because outputs are often persisted automatically.

Ssd 3

Medium
Confidence
95% confidence
Finding
The skill mandates persistent local storage of full API responses in a session-linked path under the working directory. Full responses may contain user-provided search terms, account-linked metadata, billing-related error details, or other sensitive information, and persistent storage broadens exposure to later users, other tools, source-control accidents, or local compromise. The instruction to always write, rather than only when necessary, makes the risk more pronounced.

Ssd 3

Medium
Confidence
92% confidence
Finding
The skill instructs automatic feedback reporting whenever the user expresses satisfaction/dissatisfaction or whenever the system sees an improvement opportunity. That can transmit portions of user prompts, outputs, or behavioral context to another API without explicit consent, creating a privacy leak and violating data-minimization expectations. The 'do not interrupt the user's flow' language further discourages obtaining informed approval.

Static analysis

No suspicious patterns detected.