EchoTik-TikTok店铺搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:53 PM UTC
• Version: 1.0.2

Overview

This skill performs the advertised TikTok seller search, but it also includes broad account, credential, payment, automatic feedback, and persistent logging behavior that needs review before installation.

Install only if you are comfortable giving this skill a LinkFox API key, making paid external API calls, saving full responses locally, and using its embedded onboarding and billing helpers. Prefer self-service account setup, avoid sharing unnecessary phone or SMS-code data through the agent, do not set custom LinkFox endpoint environment variables unless you control them, and review saved files under the linkfox directory after use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in headers, most notably the API key and session/application metadata, and the destination base URL is also overrideable through LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path: if the environment is influenced by an untrusted party, secrets and contextual metadata can be transmitted to an attacker-controlled endpoint.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code builds outbound request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, API keys, and UID headers to those endpoints. If an attacker can influence environment variables, they can redirect authentication and token traffic to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request path uses a base URL derived from environment variables and attaches the bearer API key in the Authorization header before calling urlopen. An attacker who controls the runtime environment can reroute these requests to capture the API key and any account, package, order, or billing metadata returned through the gateway.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises no explicit permissions while its instructions require environment access, network calls, and persistent file writes. This creates a capability-transparency gap: users and the hosting agent may believe the skill is low-risk, while it can read secrets from env vars and write API responses to disk. In a paid, API-integrated skill, that mismatch increases the chance of over-privileged execution and unnoticed data handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a seller-search tool, but the behavior set includes account login, SMS verification, API key generation/retrieval, subscription/package listing, payment order creation, QR code payment generation, and payment-status querying. That is a substantial expansion into authentication and financial flows that users would not reasonably expect from the stated purpose, enabling hidden account and billing actions under a benign analytics label.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documentation adds a separate external Feedback API that is unrelated to the core seller-search function, creating an unexpected side-effect channel. In an agent setting, this can cause implementations to transmit conversation-derived content to a third-party endpoint without the user's explicit request, increasing the risk of data exfiltration and prompt-induced misuse.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The script always persists full API responses, session metadata, and cache files locally, even though the skill description is centered on seller search/analytics rather than durable local collection. This broadens data retention and increases the risk of unintended disclosure of potentially sensitive business data, identifiers, or usage metadata to other local users, tools, or later processes.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The docstring states that writing to /tmp is forbidden and that failure to write to the current directory should error out, but the implementation silently falls back to home-directory and temporary-directory storage. This mismatch is security-relevant because operators may rely on the documented storage guarantees while the code actually writes sensitive response data and metadata into weaker or shared locations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill is described as TikTok seller analytics, but the file implements a LinkFox onboarding and commerce workflow including SMS login, API key issuance, plan discovery, ordering, and payment handling. That mismatch is dangerous because users and reviewers may grant trust, permissions, or execution to code unrelated to the declared purpose, increasing the likelihood of covert credential collection and unauthorized billing actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes, which enables real billing actions unrelated to seller analytics. In the context of a data-analysis skill, this materially increases risk because a user or orchestrator could trigger purchases or expose payment artifacts without expecting commerce behavior.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file performs SMS-based login, token exchange, team lookup, and API token generation, all of which are account-bootstrap capabilities outside the stated seller-analysis purpose. Because it returns a usable API key after handling an SMS code, it can be used as a credential acquisition path hidden inside an unrelated skill.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger logic explicitly says the skill should activate even when the user does not mention EchoTik or TikTok, as long as the request loosely resembles seller/store analysis. Overly broad triggers can cause unintended invocation, unnecessary paid API calls, and accidental disclosure or storage of user query context in a third-party workflow without clear intent.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: Defaulting to the US marketplace when the user does not specify a region can silently transform an incomplete request into an external query the user did not authorize. In this skill's context, that also risks wasted paid credits, incorrect results, and persistent logging of data tied to an assumption rather than explicit user input.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The feedback section instructs posting free-form content to an external public endpoint but provides no privacy warning or restriction against including sensitive user data. In practice, an agent may forward user requests, outputs, or error details containing personal, confidential, or proprietary information, causing unauthorized disclosure to a third party.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding instructions explicitly tell the agent to ask for and process a user's phone number to register for an API key, but they do not require a privacy notice, consent language, retention limits, or guidance on secure handling of that personal data. In an agent context, this creates a real privacy and compliance risk because users may disclose sensitive contact information without understanding why it is needed or how it will be used.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The login command emits the API key in stdout JSON, which is commonly captured by calling agents, logs, shells, notebooks, CI pipelines, and telemetry systems. That makes accidental credential disclosure likely, especially in multi-tool or hosted environments where stdout is persisted or visible to other components.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill mandates saving full API responses to session-organized files under the working directory and sometimes printing complete JSON to stdout. Persistent local logging of third-party responses can expose user-provided filters, session identifiers, links, account-related metadata, or other sensitive business data to other tools, users, or logs on the host system. The risk is higher because storage is always-on rather than optional.

Static analysis

No suspicious patterns detected.