Security audit

EchoTik-TikTok视频排行

Security checks for vulnerabilities and agentic risk

Overview

The ranking feature is real, but the skill also handles account login, API-key creation, payments, local storage, and automatic feedback reporting in ways that deserve careful review.

Before installing, verify you are comfortable giving LinkFox API credentials, possible phone/SMS login details, billing/order actions, saved local response files, and automatic feedback reports. Use a clean environment with trusted endpoint variables only, avoid plaintext shell-profile secrets where possible, and do not use the payment flow unless you intentionally want to buy credits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:177
Finding: Automatic Disclosure of User Feedback and Intent to an External Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/echotik_list_video_rank.py:36
Finding: Credentials Can Be Redirected to Arbitrary Environment-Controlled Endpoints
Content: View full analysis
str: return ( os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com" ).rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") ``` The onboarding service destinations are similarly replaceable: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Access tokens are then attached to requests: ```python if access_token: h["authorization"] = access_token h["uid"] = ( _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ) ``` ### Technical Analysis The code permits complete replacement of the API, login, and account-service origins through environment variables. It does not validate the UR ...[truncated 1473 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:484
Finding: Generated API Key Is Exposed Through Standard Output and Plaintext Shell Configuration
Content: View full analysis
int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: return 0 return 1 ``` The onboarding guide recommends persisting the key in shell configuration: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis Standard output is frequently captured by Agent transcripts, command runners, CI logs, terminal scrollback, or diagnostic systems. Returning the entire API key through this channel unnecessarily broadens credential exposure. The recommended shell startup-file configuration stores the credential unencrypted and may expose it to local users, backup systems, plugins, support bundles, or accidental source-control inclusion. No file-permission hardening, secret-manager integration, or rotation advice is provided. ### Attack Path 1. The user completes SMS authentication. 2. The onboarding flow retrieves or generates an API key. 3. The complet ...[truncated 634 chars]
Remediation: View remediation

other

Warning

Location: scripts/echotik_list_video_rank.py:62
Finding: Unnecessary Agent Session and Message Metadata Is Sent with Ranking Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/echotik_list_video_rank.py:248
Finding: Unsanitized Session Identifier Permits Filesystem Path Traversal
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script uses the same unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is inserted directly into a filesystem path. The code does not reject absolute paths, path separators, `..` traversal components, or platform-specific path syntax. With `os.path.join`, an absolute final component can replace the intended prefix. Relative traversal components can escape the expected session directory. Subsequent code creates directories, writes `_meta.json`, appends index entries, stores response data, or writes QR image files. Exploitation ...[truncated 1039 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/echotik_list_video_rank.py:205
Finding: Undocumented Fallback Stores Session Data in Home or Temporary Directories
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/onboarding.py:163
Finding: Onboarding Recommends Installing Unpinned Runtime Dependencies
Content: View full analysis
dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return { "png_path": None, "ascii_qr": None, "error": err, } ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The onboarding script tells users to install mutable latest versions of `qrcode`, `pillow`, and `requests`. The project does not provide pinned versions, hashes, a lock file, or a trusted package-index requirement. The package names are legitimate and there is no evidence that this project intentionally installs malicious packages. The risk is supply-chain exposure caused by resolving unreviewed future releases and transitive dependencies at installation time. ### Attack Path 1. A required dependency is absent. 2. The script emits an installation command. 3. The user runs the command in the active Python environment. 4. `pip` resolves current packages and transitive dependencies from its configured index. 5. A compromised release, unsafe index, or dependency-resolution attack causes unreviewed code to be installed and executed. ### Impact Assessment Python package installation can execute build backends and package code with the privileges of the invoking user. A compromised dependency could therefore access user files, environment secrets, or network resources. No such compromise is present in the audited files; this finding concerns avoidable supply-chain risk. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (28)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/echotik_list_video_rank.py (reported line 78)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Description-Behavior Mismatch

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements LinkFox account onboarding, SMS authentication, API key retrieval, package purchasing, and payment QR generation, which is fundamentally unrelated to the declared TikTok video ranking skill. This mismatch is a strong indicator of hidden secondary behavior designed to collect credentials and drive account/payment actions outside the user's expected task.
Content: No source excerpt is available for this finding.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 92% confidence
Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, to those endpoints. If an attacker can influence environment variables in the skill runtime, this becomes credential exfiltration or SSRF to attacker-controlled infrastructure.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 92% confidence
Finding: The gateway request path uses an environment-derived base URL and attaches the Authorization header from LINKFOX_AGENT_API_KEY before calling urlopen. If the environment is tampered with, the skill will send API credentials and business requests to an attacker-chosen host, enabling secret leakage and unintended outbound access.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a TikTok ranking query skill, but the static finding indicates the implementation also performs account login, API key generation, account inspection, plan listing, order creation, payment initiation, QR-code generation, and payment-status queries. That is a major description-behavior mismatch which can surprise users, expand the attack surface into billing and credential flows, and enable collection or transmission of sensitive account and payment data unrelated to the advertised task.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
}

text
## Display Rules 1. **Present data in tables**: Show video description (truncated if long), views, likes, comments, shares, video sales, video GMV, publish date, and creator ID. 2. **Rank order**: Results are already ranked by the chosen `videoRankField`; preserve and surface the ranking order.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file introduces authentication recovery, account onboarding, and billing/payment procedures that are not necessary for a read-only TikTok video ranking skill. This expands the skill's operational scope into credential acquisition and payment handling, increasing the chance of sensitive data collection, social engineering, and unsafe side effects unrelated to the advertised functionality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented behavior includes script-driven registration, plan listing, order creation, and payment-method selection for a capability that should only retrieve ranking data. Embedding account creation and purchase flows in the skill creates an unjustified path for collecting personal information and steering users into financial transactions, which is dangerous in this context.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The module docstring openly states this file is a LinkFox onboarding CLI, directly contradicting the skill metadata describing TikTok video ranking. Such a purpose mismatch increases the likelihood that the skill is deceptive, with behavior users and reviewers would not expect from the manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill can create orders, generate payment QR codes, and query order states despite advertising a video ranking function. In this context, payment functionality is unjustified and dangerous because it can induce unauthorized purchases or social-engineering-driven payment collection under the guise of analytics.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code sends SMS verification codes, logs users in, obtains access/refresh tokens, fetches team membership, and generates API tokens for LinkFox accounts. For a TikTok ranking skill, this is unjustified credential harvesting and privileged token provisioning that could be abused to access or monetize unrelated user accounts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares capabilities that involve environment access, file writes, and network use, but it does not explicitly scope or limit those powers via a permissions or allowed-tools declaration. In practice this weakens reviewability and least-privilege controls, especially because the skill also instructs filesystem persistence and API calls, making it harder to constrain unexpected behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates saving full API responses to local disk on every run, tied to session structure, without a clear up-front user warning or consent regarding local retention. Even if the primary dataset is analytics, responses can still contain user-supplied query parameters, account metadata, or other contextual information that persists longer than necessary and may be exposed to other local processes or future tasks.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill requires unconditional persistence of complete API responses into session-linked files under the working directory. This is a data-minimization and storage-safety issue because it stores more information than needed for answering the user, creates durable artifacts correlated to sessions, and may leak data through backups, shared workspaces, or later unintended access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs automatic reporting to an external Feedback API whenever user dissatisfaction, praise, mismatch, or improvement opportunities are detected, but it does not clearly disclose that user interaction details may be transmitted off-system. This creates a privacy and transparency risk because conversational content or inferred sentiments could be shared without explicit consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 115)May include surrounding context.
}

text
## curl 示例 ### 指定日期的美国视频播放量排行

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file documents a separate public feedback API that is unrelated to the declared skill purpose of querying TikTok video rankings. In an agent-skill context, extra outbound-write capabilities expand the attack surface and can be abused to exfiltrate user content, generate unsolicited external traffic, or perform actions the user did not request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: All user-facing operational instructions are presented only in Chinese, including the directions to ask the user questions and relay setup steps. Under the policy, a skill should not impose a specific language or locale unless it offers a choice or clearly documents a justified locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions ask the user to provide a phone number and then process SMS-based login through a script, but they do not disclose why the data is needed, how it will be stored, or what privacy safeguards apply. In a skill that is expected to provide analytics data, collecting personal contact information without clear notice materially raises privacy and consent risks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module documentation promises that writing to /tmp is forbidden and that failure should occur if the current directory is not writable, but _linkfox_root() explicitly falls back to the home directory and then the temporary directory. In a skill that persists full API responses, this mismatch can cause sensitive output to be written to less-controlled locations than operators expect, undermining data-handling guarantees and incident review assumptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code sends the JSON params payload plus SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME headers to https://tool-gateway.linkfox.com via POST. While the module docstring explains output behavior, it does not disclose the outbound data transmission itself, and there is no confirmation prompt or user-facing notice near the network operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language interface, help text, and operational assumptions are all presented in Chinese, and the workflow is tied to Chinese phone numbers and payment methods (+86, WeChat, Alipay) without offering a language or locale choice. This can violate a language/locale policy when the skill forces a specific locale rather than documenting opt-in or region-specific scope.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The code generates or retrieves an API key and returns it in stdout JSON without any in-file safeguards, redaction, or user-warning flow. In shared agent runtimes, logs, transcripts, or downstream tooling may capture this credential, causing unintended disclosure and later account compromise.
Content: No source excerpt is available for this finding.