EchoTik-TikTok视频搜索

• Outcome: Review
• Latest audit: Jul 23, 2026 · 2:21 PM UTC
• Version: 1.0.0

Overview

The core TikTok analytics function is coherent, but the skill also directs silent feedback reporting, remote onboarding installation, and broader local persistence than it discloses.

Install only if you are comfortable with LinkFox receiving API requests and possible feedback reports, and with full analytics responses being saved locally. Review or disable the feedback behavior, constrain LINKFOX_TOOL_GATEWAY to the intended LinkFox host, and check where saved response and cache files will be written before using it in shared or synced workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: with urlopen(req, timeout=120) as response:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs use of environment variables, outbound network access, and local file writes, yet no explicit permission declaration is present. This creates a capability-transparency gap: an agent or reviewer may not realize the skill can access credentials, contact external services, and persist data, increasing the chance of unintended data exposure or unsafe execution.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file for a TikTok video search/analytics skill documents a separate feedback submission endpoint that is outside the stated scope of the skill. This creates a scope-expansion risk: an agent implementing the skill may transmit user content to an unrelated external service, enabling unexpected data exfiltration or behavior not covered by the user’s request.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module documentation explicitly promises storage only under the current working directory and forbids /tmp, but the implementation falls back to ~/linkfox and the system temp directory. That discrepancy can cause sensitive API responses to be written to less controlled locations than users expect, increasing leakage risk in shared or ephemeral environments.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger logic is intentionally broad enough to activate even when the user does not explicitly mention EchoTik or TikTok, as long as the request resembles TikTok video analysis. Over-broad activation can cause the wrong skill to run, leading to unnecessary external API calls, cost-incurring actions, or disclosure of user intent/data to a third party without sufficiently clear user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mandates saving full API responses to disk in the working directory and ties storage to a session identifier, but it does not clearly require user consent or warn that potentially sensitive business analytics data will be persisted locally. Local persistence increases the risk of accidental retention, leakage to other tools/processes, inclusion in backups, or exposure in shared project directories.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs sending structured feedback content to an external endpoint and references authorization use elsewhere, but provides no user-facing disclosure that data may leave the system. In an agent context, this can cause silent transmission of user intent, conversation details, or operational metadata to a third party without consent or clear necessity.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script always persists the full API response to disk, regardless of size, and does so by default without explicit user confirmation at execution time. Because this skill handles analytics data and may include sensitive business information, unconditional local persistence increases the risk of unintended disclosure through workspace sync, backups, or other local users/processes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.