EchoTik-TikTok店铺搜索

• Outcome: Review
• Latest audit: Jul 23, 2026 · 1:41 PM UTC
• Version: 1.0.0

Overview

The skill appears to do the TikTok seller lookup it promises, but it needs Review because it stores full results locally and its actual storage and network behavior is broader than the documentation implies.

Install only if you are comfortable giving LinkFox/EchoTik API access for TikTok Shop seller lookups. Keep LINKFOX_TOOL_GATEWAY unset unless you intentionally trust that endpoint, expect full API results and query history to be written under linkfox directories, and confirm vague store-search requests before spending credits or sending feedback externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 89% confidence
• Finding: with urlopen(req, timeout=120) as response:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes use of environment variables, network access, and file writes, but there is no explicit permission declaration or narrowing of those capabilities. This creates a transparency and policy-enforcement gap: an agent may invoke networked actions and persist data locally without the user or platform having a clear capability contract.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script persistently stores full API responses, cache entries, and session metadata on local disk, which exceeds the narrow behavior implied by a seller-search skill. If responses contain sensitive business data, identifiers, or query history, this creates unnecessary data retention and increases exposure to other local users, later processes, or accidental disclosure.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The module documentation explicitly says writing to /tmp is forbidden and that failure to write the current directory should error, but the implementation silently falls back to home and temp directories. This mismatch can cause sensitive API responses and session metadata to be written into less trusted locations than operators expect, undermining security assumptions and potentially exposing data through shared or monitored temp areas.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger text explicitly says the skill should activate even when the user does not mention TikTok or EchoTik, as long as the request loosely relates to store/seller analysis. That broadens activation beyond clear user intent and can cause unintended network calls, cost-incurring actions, or data handling in contexts where the user did not ask for this specific external service.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The boundary guidance treats vague phrases like '找店铺' or '竞品店铺' as sufficient to apply the skill if the intent seems related to listing/filtering stores. In practice, these phrases are ambiguous and can match many non-TikTok or non-EchoTik scenarios, increasing the chance of misfire, unnecessary external queries, and unwanted spending.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill mandates always saving the full API response to a session-linked local path, regardless of whether all returned fields are needed for the user-facing task. Persistent storage of complete responses can retain sensitive or user-derived data longer than necessary, expose it to other tools or later sessions in the same workspace, and increase blast radius if the project directory is shared or synced.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.