EchoTik-TikTok视频搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.3

Overview

The skill can perform TikTok video analytics, but it also handles account login, API keys, payments, persistent data storage, and automatic feedback reporting in ways that need human review before installation.

Install only if you are comfortable giving this skill a LinkFox API key and using it for paid EchoTik queries. Review any account signup, SMS-code, API-key, billing, payment QR, and feedback-reporting behavior before allowing it, avoid setting custom LINKFOX_* endpoint environment variables, and keep the generated linkfox output directory out of shared or committed project files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

other

Error

• Location: SKILL.md:228

Finding

Automatic Disclosure of User Conversation Content Through the Feedback API

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/echotik_list_video.py:36

Finding

Credential Exfiltration Through Unrestricted Environment-Configurable API Endpoints

Content

View full analysis

str: """Gateway base address: LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key not configured. Please complete authorization first:\n" "1. Visit https://skill.linkfox.com/linkfoxskills/guide.htm to obtain your Key\n" "2. Set the environment variable: export LINKFOX_AGENT_API_KEY=your-key-here", file=sys.stderr, ) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } ``` Onboarding similarly allows all credential-bearing service bases to be replaced: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_b ...[truncated 3877 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/echotik_list_video.py:248

Finding

Arbitrary User-Writable File Placement Through SESSION_ID Path Traversal

Content

View full analysis

str: """Prefer SESSION_ID; otherwise generate a stable process-local identifier.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """Return (linkfox_root, session_dir); session_dir is created.""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script repeats the same pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name. The code does not reject: - Absolute paths. - `..` traversal segments. - Platform-specific path separators. - Drive or UNC paths on Windows. - Excessively long or otherwise malformed identifiers. With `os.path.join`, an absolute final component can discard preceding path components. Relative traversal components can escape the intended date and `linkfox` directories after ...[truncated 1615 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:164

Finding

Unpinned Runtime Dependency Installation Instructions

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The suggested commands install whichever package versions the configured Python package index currently serves. There is no lock file, version constraint, package hash, or documented trusted index. Package installation may execute build backend code and package installation hooks with the privileges of the invoking user. Even when the package names are legitimate and widely used, unpinned installation makes builds non-reproducible and exposes users to compromised future releases, dependency-chain compromise, or unexpected incompatible updates. No evidence was found that the project intentionally references a typosquatted package or malicious package source. The risk arises from unsafe, mutable installation guidance rather than a confirmed malicious dependency. ### Attack Path 1. A user invokes an onboarding command on a system where `requests`, `qrcode`, or `Pillow` is unavailable. 2. The script instructs the user to run an unpinned `pip install` command. 3. The package manager resolves current package and transitive dependency versions from its configured index. 4. If the index, package release, dependency chain, or local package-manager configur ...[truncated 646 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (25)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request sent via urlopen includes multiple environment-derived headers and, more importantly, the destination base URL is also taken from LINKFOX_TOOL_GATEWAY without validation. In an agent/runtime context, environment variables are often externally influenced by orchestration or plugins, so this creates a real risk of SSRF-style redirection and credential leakage of the API key and session metadata to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/echotik_list_video.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The POST target URL is derived from environment-controlled base URLs, and this function sends sensitive material such as SMS login data, access tokens, refresh tokens, and API-token operations to those endpoints. In a skill/runtime environment where env vars can be influenced, this creates a server-side exfiltration path to attacker-controlled infrastructure and undermines trust boundaries.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway request URL is built from environment-controlled base configuration and then used with an Authorization header carrying the API key. If an attacker can influence the environment, the skill will transmit the API key and business requests to an arbitrary host, enabling credential theft and misuse of the linked account.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is TikTok video analytics, but the referenced behavior extends into authentication, API key generation, account/team inspection, subscription purchase flows, payment QR generation, and payment status polling. That mismatch can mislead users and reviewers about the real privilege boundary, enabling collection of account data or initiation of billing-related actions under the guise of analytics.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger logic explicitly says the skill should fire even when the user does not mention TikTok or EchoTik, as long as the request loosely resembles performance analysis. This overbroad activation can cause the skill to run in unrelated contexts, leading to unnecessary external queries, unintended data disclosure, or surprise charges from a paid tool.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

}

text

## Display Rules

1. **Present data in tables**: Show video description (truncated if long), views, likes, comments, shares, video sales, video GMV, publish date, and creator ID
2. **Link to original**: When `officialUrl` is available, provide it so users can view the video on TikTok

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements account onboarding, SMS login, API-key retrieval, package listing, purchasing, and payment QR generation, which are unrelated to the declared TikTok video analytics purpose. Such scope expansion is dangerous because it introduces credential handling and financial operations into a skill that users would reasonably expect to only perform analytics, increasing the chance of deceptive data collection and unauthorized account actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Payment and subscription-purchase capabilities are embedded in a skill whose stated function is TikTok video search and analytics. This mismatch raises the risk of unauthorized charges, phishing-style redirection into purchase flows, and abuse of user trust because the capability is not justified by the declared purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code performs SMS-based authentication, user-info retrieval, and API token generation, all beyond the stated analytics role. Handling login codes and returning API keys materially increases the blast radius of compromise and enables account takeover or credential harvesting under the guise of a benign analytics feature.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities that involve environment access, file writes, and network use, but it does not define an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may permit broader actions than users or reviewers expect, increasing the chance of unintended data access or exfiltration if the skill or its references are changed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill mandates writing full tool responses to a persistent session-scoped project directory by default. Persisting complete API outputs can retain user-supplied identifiers, account-related metadata, or commercially sensitive analytics beyond the immediate task, increasing exposure to later unauthorized access, accidental commits, or cross-task leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 107)May include surrounding context.

}

text

## curl 示例

### 基础视频列表（按播放量降序）

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents a second endpoint for submitting feedback to an external service that is unrelated to the skill’s core TikTok video search/analytics function. Adding an out-of-scope network action expands the skill’s effective capabilities and can enable unanticipated data exfiltration of user prompts, results, or operational metadata if an agent starts calling it automatically.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The onboarding document expands the skill from TikTok video analytics into account recovery, scripted registration, and billing workflows that are not part of the declared purpose. This unnecessary privilege and capability expansion increases attack surface, can lead to collection of sensitive data, and creates opportunities for misuse of the agent to handle credentials and payments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions direct the agent to handle phone numbers, OTP-based login, API key acquisition, and plan ordering, none of which are justified by a TikTok analytics skill. Combining sensitive identity data, authentication flows, and purchasing actions in one skill materially raises the risk of privacy violations, unauthorized account actions, and social-engineering abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document tells the operator to request a user's phone number and use it in a scripted registration/login flow, but provides no explicit consent language, privacy notice, retention limits, or verification safeguards. That creates a clear risk of mishandling personal data and facilitating account access operations without adequate user protection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation silently falls back to other paths including the temp directory. Because this script stores full API responses that may contain sensitive business data, the discrepancy can cause data to be written to less trusted or more broadly accessible locations than operators expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module advertises itself as an onboarding/account-environment CLI, directly contradicting the manifest’s TikTok analytics intent. This inconsistency is a meaningful security signal because mismatched declared vs. actual behavior is common in deceptive or over-privileged skills and makes dangerous operations harder for reviewers and users to anticipate.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This function transmits user-supplied and credential-related data to external services, including phone numbers, SMS codes, tokens, and account metadata. External transmission is expected for networked functionality, but in this skill it is more dangerous because the transmissions support unrelated authentication and token issuance workflows and can be redirected by environment-controlled endpoints.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code restricts SMS login to +86 and 11-digit domestic phone numbers, and the user-facing help and messages are entirely in Chinese. This enforces a specific language and locale behavior without offering user choice or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code obtains or generates an API token and returns it in plaintext JSON without any built-in warning, masking, or storage guidance. In agent ecosystems, stdout is often logged or forwarded, so emitting secrets directly can cause accidental credential leakage and downstream account abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The trigger specification embeds both Chinese and English phrasing, but the skill does not state how language choice should follow the user's preference. This can create a locale-handling policy issue if the skill assumes or forces one language context without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code file contains user-facing natural-language strings in Chinese for the description and output policy, but does not indicate any language selection or opt-in. Under the language/locale policy rule, forcing a specific language without user choice is a policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline comment says responses under the threshold are '直接全量输出，不落文件'. In main(), the code always resolves an output path and writes the serialized response to disk before deciding whether to print the full JSON or only a summary. This directly contradicts the stated behavior.

Content

No source excerpt is available for this finding.