EchoTik-TikTok商品搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 1.0.10

Overview

This skill performs TikTok Shop product lookups, but it also handles credentials, payments, local storage, and silent feedback reporting in ways users should review before installing.

Install only if you are comfortable giving this skill a LinkFox API key and using LinkFox account, billing, and feedback flows from inside the agent. Prefer creating or pasting credentials through a dedicated secret manager, avoid printing API keys into logs, do not use endpoint override environment variables except in a controlled test environment, and review/delete the local linkfox response cache if product research data is sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

other

Warning

• Location: SKILL.md:211

Finding

Silent Transmission of User Feedback to a Separate External Service

Content

View full analysis

This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` { "skillName": "linkfox-xxx-xxx", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } ``` The documented field rules additionally direct the caller to include what the user said or intended and what happened. ### Technical Analysis The Skill instructs the agent to infer feedback under broad conditions and send it to a separate LinkFox feedback endpoint. The trigger includes the subjective condition “Anything you believe could be improved,” rather than requiring explicit feedback from the user. This transmission is not required to perform TikTok product search, filtering, or analysis. The instruction to avoid interrupting the user's flow means the data may be transmitted without notification or explicit consent. Depending on how the agent constructs the `content` field, the payload may contain user statements, inferred intent, error details, or portions of product-research requests. This behavior exceeds the minimum network privileges ...[truncated 1131 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:484

Finding

API Key Exposed Through Standard Output and Plaintext Shell Profiles

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` The onboarding documentation recommends persistent plaintext storage through commands equivalent to: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login workflow obtains an API key and returns the complete secret in the result object. `_cmd_login` passes that object to `_emit`, which serializes the full value to standard output. In an agent-controlled environment, standard output may be copied into: - Agent conversation context - Command execution logs - Terminal scrollback - CI logs - Session recordings - Debugging or observability systems The documentation then encourages placing the key directly into persistent shell startup files. Such files are usually plaintext and may be readable by backup software, developer tools, support bundles, or other processes running under the same account. The API key is required for the Skill's functionality, but exposing it through output and recommending weak persistent storage are not necessary. ### Attack Path 1. The user ru ...[truncated 1171 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/echotik_list_product.py:36

Finding

Unrestricted Endpoint Overrides Can Redirect Credential-Bearing Requests

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH ``` The API key and session metadata are attached to the resulting URL: ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script similarly permits endpoint overrides: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive tokens are sent to the selected endpoints: ```python resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "t ...[truncated 2568 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/echotik_list_product.py:250

Finding

Unsanitized Session Identifier Allows Output Directory Traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) ``` From `scripts/onboarding.py`: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a filesystem path component without validation. Python's `os.path.join` does not guarantee containment when an untrusted component contains traversal sequences or is absolute: - A value containing `..` can traverse above the intended date and LinkFox directories. - An absolute value can cause earlier path components to be discarded. - Platform-specific separators can produce equivalent behavior. The selected directory is subsequently used for response files, metadata, index entries, and payment QR images. The product-search code also uses fixed metadata filenames such as `_meta.json`, increasing the risk of modifying an existing file when the attacker can select a writ ...[truncated 1639 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Runtime Instructions Recommend Unpinned Third-Party Package Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (26)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The request headers and destination are partially derived from environment variables, including a gateway override and sensitive session metadata, and the code sends them directly over the network with no allowlist or validation. In an agent environment, a malicious or compromised runtime can set LINKFOX_TOOL_GATEWAY to an attacker-controlled host and exfiltrate the API key plus session identifiers, which is a real SSRF/credential-exfiltration risk.

Content

Scanner excerpt · scripts/echotik_list_product.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest presents a TikTok product-search skill, but the documented ecosystem behavior includes account login, API-key generation, subscription lookup, payment order creation, QR-code payment, and order-status checks. This is a major capability expansion into authentication and billing flows, which can lead to unauthorized account actions or financial transactions under the guise of a benign analytics tool.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger is intentionally broad enough to activate even when the user does not mention TikTok or EchoTik, as long as the request vaguely resembles product research. Overbroad activation increases the chance the skill captures unrelated queries and initiates external calls or data handling the user did not intend.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

}

text

## Display Rules

1. **Present data clearly**: Show query results in organized tables with key columns — product name, price, total sales, 30-day sales, GMV, rating, commission rate, and number of promoting influencers
2. **Currency awareness**: Include the currency field from the response when displaying prices and GMV

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring states that writing to /tmp is forbidden and that failure to write to the current directory should error out, but the implementation silently falls back to the home directory and then the system temp directory. This mismatch defeats operator expectations and can cause sensitive response data and session metadata to be written into less trusted locations, which is especially risky in multi-user or shared agent environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements LinkFox account onboarding, SMS login, API-key retrieval, subscription management, and payment flows, which are materially unrelated to the declared TikTok product-analysis purpose. In a skill context, this is dangerous because users invoking a data-analysis capability may be unexpectedly funneled into credential collection and account monetization workflows outside the advertised scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code can list purchasable plans, create orders, and render payment QR codes, enabling real-money transactions from within a skill that is described as product analytics. That mismatch increases the chance of deceptive or unauthorized monetization behavior and expands harm from simple data access into billing and financial-action risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill can retrieve or generate API tokens on behalf of the user, which exceeds the minimum capability needed for TikTok product analysis and creates a credential-issuance path inside an unrelated skill. This is dangerous because newly minted tokens may grant durable access beyond the current session and can be exposed, reused, or abused if mishandled.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool scope while its documented behavior requires environment access, file writes, and network calls. Without least-privilege constraints, an agent may invoke broader capabilities than the user expects, increasing the blast radius if the skill is misused or prompt-injected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction to translate user keywords into the local marketplace language without opt-in can alter user input before it reaches the external service. This can misrepresent user intent, leak transformed or inferred data to third parties, and produce results the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill mandates persistent storage of complete API responses in a session-linked project directory and can also print full responses to stdout. This increases the risk of sensitive data exposure through local retention, logs, transcripts, or downstream tooling that consumes stdout.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to auto-report feedback to a separate Feedback API whenever various conditions occur, even though that behavior is unrelated to product search. This creates an undisclosed side channel that can exfiltrate user sentiments, interaction details, or operational metadata to another service without clear consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The parameter description explicitly says 商品分类（请输入中文）, which forces a specific language for input. This is a natural-language locale constraint, and the file does not present it as optional, user-selectable, or justified as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 129)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/echotik/listProduct \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation embeds a separate feedback-submission API that is unrelated to the core TikTok product-search function. In an agent-skill context, this expands the skill's effective capability surface and can enable unsolicited outbound transmission of conversation-derived content to a third-party endpoint, especially if an orchestrator treats all documented APIs as callable parts of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The feedback API section does not warn that submitted content will be transmitted to an external service. If an agent uses user messages, task details, or generated summaries as feedback content, sensitive or private information could be sent off-platform without the user's awareness or informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The onboarding flow instructs the agent to ask for a user's phone number and process SMS-based login/registration, but it provides no explicit consent, minimization, retention, or privacy handling guidance for this sensitive personal data. In an agent setting, this creates a real risk of unnecessary collection, mishandling, or exposure of phone numbers and one-time codes, especially if logs, transcripts, or tool invocations are retained.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill persistently stores full API responses, cache entries, session indexes, and metadata to local disk even though its declared purpose is product search and analysis. These responses may include sensitive business data, identifiers, or user-derived query context, creating unnecessary data retention and increasing the blast radius if the workspace, home directory, or temp storage is later accessed by another process or user.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language validation and request payload restrict login to 11-digit domestic phone numbers and force areaCode "+86". This is a locale-specific constraint presented as the only mode of operation, with no opt-in, alternative locale handling, or documented regional justification in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI prints a newly obtained API key in stdout JSON, which commonly ends up in terminal scrollback, logs, orchestration traces, or downstream tool transcripts. In an agent or skill environment, stdout is often captured automatically, so this can leak a live credential to parties or systems that were never meant to receive it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is described as search/analysis, but it also persists full API responses to local project files by default. While this may be for caching or debugging, it broadens data handling behavior and can retain sensitive or proprietary query results beyond the user's immediate request.

Content

No source excerpt is available for this finding.