EchoTik-TikTok视频排行

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:28 AM UTC
• Version: 1.0.2

Overview

The ranking feature is real, but the skill also includes sensitive account login, API-key, billing, payment, feedback, and persistent-storage behavior that needs human review before installation.

Review this skill before installing. Use it only if you are comfortable with LinkFox receiving ranking queries and possible feedback content, with the agent helping collect phone/SMS login information and creating payment orders when authorization or balance problems occur. Prefer self-service account setup through LinkFox, avoid setting custom LINKFOX_* API URL variables unless you trust the endpoint, and treat generated API keys and saved response/cache files as sensitive.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive onboarding data, including phone numbers, SMS codes, bearer tokens, and potentially API-token operations, to those endpoints via requests.post. In a skill environment, environment variables may be controlled by deployment or a malicious wrapper, so this creates a realistic exfiltration and SSRF-style channel for credentials and account actions.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway helper constructs urllib requests to a URL derived from environment-controlled base configuration and attaches the API key in the Authorization header. If the base URL is redirected to attacker infrastructure, the skill will transmit the API key and order/account data to an unintended host, enabling credential theft and unauthorized account actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly relies on environment variables, network access, and persistent file writes, yet no permissions are declared. This creates a transparency and governance gap: operators and users cannot accurately assess what the skill can access or modify, increasing the chance of unintended data exposure or misuse of local/project files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The described purpose is limited to querying TikTok video rankings, but the skill also references account onboarding, authentication, API key retrieval/generation, plan/package listing, payment order creation, QR rendering, and payment-status checks. That is a major expansion of capability into identity, billing, and payment flows unrelated to the user-facing data query purpose, creating risk of unauthorized transactions, collection of sensitive account data, or deceptive workflow escalation.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to automatically send user praise, dissatisfaction, and improvement-related information to a separate Feedback API without a clear necessity for the ranking task. This can exfiltrate user sentiments, prompts, and interaction context to an unrelated endpoint without meaningful consent or minimization.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented Feedback API adds a second outbound capability unrelated to the declared purpose of querying TikTok video rankings. That expands the skill’s data-exfiltration surface and could enable transmission of user content or conversation summaries to an external service without clear necessity, consent, or strong scope boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Collecting and transmitting feedback to an external endpoint is not justified by the skill’s stated function of retrieving ranking data. Because the suggested payload includes free-form content describing what the user said or intended, it creates a realistic risk of leaking user prompts, behavioral data, or sensitive business context to a third party.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file embeds authentication recovery, account registration, and billing/payment workflows that are not intrinsic to a read-oriented TikTok video ranking skill. Expanding the skill's documented behavior to include credential acquisition and payment handling increases attack surface and creates opportunities for social engineering, unauthorized account actions, and operator misuse.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The instructions direct the operator to collect a user's phone number, send login codes, create or access accounts, list plans, and place payment orders, none of which are justified by a ranking lookup capability. In context, these extra capabilities are especially dangerous because they normalize sensitive identity and financial operations under a low-risk analytics skill.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module documentation promises that data will be written only under the current working directory and explicitly forbids /tmp, but the implementation falls back to the home directory and then the system temp directory. This mismatch can cause sensitive API responses to be persisted in less expected or less controlled locations, undermining user trust and potentially exposing data to broader local access.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements SMS login, API-key retrieval, plan discovery, ordering, and payment QR generation, which is materially unrelated to the declared TikTok video ranking skill. That mismatch is dangerous because it introduces hidden credential collection and commerce behavior under a benign-looking manifest, increasing the chance of unauthorized account access or deceptive monetization.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill contains full account-authentication and commerce flows, including SMS verification, API key generation, package purchase, and payment QR creation, none of which are justified by a video-ranking use case. In this context, the hidden capability is especially dangerous because it can be used to harvest credentials, mint tokens, and induce purchases while masquerading as a data-query skill.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module docstring openly describes a self-contained LinkFox onboarding CLI rather than a TikTok video ranking utility, directly contradicting the manifest. This discrepancy is a strong indicator of deceptive packaging: users and reviewers may invoke the skill expecting analytics while the code performs sensitive account and payment operations instead.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The trigger criteria are intentionally broad enough to activate even when the user does not explicitly ask for EchoTik or rankings, as long as the request vaguely involves dated TikTok video lists or rankings. Over-broad activation increases the chance the agent invokes a paid, networked, data-writing skill in contexts where the user did not intend it, potentially causing unnecessary charges, data disclosure, or workflow hijacking.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The Feedback API section instructs sending externally hosted feedback but does not warn that user-provided text may leave the system and be transmitted to a third-party service. This lack of disclosure increases the chance of silent privacy violations, especially because the content field is described broadly enough to include user statements and interaction details.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs the operator to request and use the user's phone number and one-time code for registration/login without any privacy notice, consent language, retention limits, or handling safeguards. This can lead to unnecessary collection of personal data and credentials, exposing users to privacy harm and account compromise if mishandled.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file tells users to persist an API key in shell profile files, which stores a sensitive credential on disk and may expose it to other local users, backups, shell history, or accidental disclosure. Although common operationally, omitting warnings and safer alternatives makes credential leakage more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script always persists the full API response locally, including potentially sensitive business metrics or account-scoped data, but the user-facing behavior does not present this as a prominent privacy/security warning at runtime. In a skill context, users may assume stdout-only handling for small or inline responses, so silent retention increases the risk of unintended local disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Caching API responses under a local .cache directory for up to 24 hours retains potentially sensitive data longer than users may expect and without clear disclosure. On shared systems or developer workspaces, this increases the chance that prior responses remain accessible after the immediate task is complete.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The login flow returns a freshly obtained API key in stdout JSON, which is commonly captured by host logs, transcripts, orchestrators, or other tools in an agent environment. Exposing long-lived credentials through standard output materially increases the chance of accidental leakage and downstream misuse.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill mandates persistent storage of full API responses under the project directory with session-based aggregation and encourages later extraction from those files. Even if the current dataset seems business-focused, full responses can contain user-provided parameters, account metadata, billing/cost indicators, or other sensitive context, and storing them persistently in a shared workspace increases leakage and retention risk.

Static analysis

No suspicious patterns detected.