EchoTik-TikTok视频搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:42 PM UTC
• Version: 1.0.2

Overview

This TikTok analytics skill has a real analytics function, but it also includes automatic feedback reporting, account/payment onboarding, and local storage behavior that need review before installation.

Install only if you are comfortable with LinkFox API calls, local saving of full analytics responses, and possible auth/billing flows that ask for a phone number, SMS code, API key setup, and payment selection. Require explicit confirmation before paid calls, payment/order actions, or feedback submission, and review local linkfox cache/session folders if results may be commercially sensitive.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require access to environment variables, file writing, and network APIs. This mismatch weakens user and platform oversight because the skill can read secrets, write artifacts to disk, and contact remote services without transparent capability disclosure. In this context, the risk is elevated by the requirement to persist responses locally and use API keys from the environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a TikTok video analytics tool, but the static finding indicates it also supports account login, API key generation, account/package lookup, order creation, payment QR generation, and payment status queries. These commerce and authentication capabilities are materially outside the declared purpose, creating a hidden expansion from analytics into credential handling and financial operations that users would not reasonably expect. That makes misuse, consent bypass, and accidental payment or account actions much more dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to automatically send user feedback, praise, dissatisfaction, and general improvement observations to an external Feedback API without requiring an explicit opt-in at the moment of collection. This creates an out-of-band data exfiltration path beyond the stated analytics purpose and may transmit user content or behavioral signals to another service. The danger increases because the trigger includes broad subjective conditions like 'anything you believe could be improved,' which can sweep in more user data than necessary.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file documents a separate external Feedback API that is unrelated to the skill’s declared purpose of TikTok video search and analytics. This expands the skill’s effective capability surface and creates a path for user-derived content to be sent to another endpoint, which can enable unintended data exfiltration or side effects if an agent uses the documentation literally.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The onboarding document introduces authentication recovery, phone-based account registration, and billing workflows that are materially outside the declared purpose of a TikTok video analytics skill. This scope expansion is dangerous because it gives the skill instructions to collect credentials/phone numbers and initiate account/payment actions, increasing the chance of unauthorized data handling, social engineering, or unintended transactions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file explicitly directs the agent to collect a phone number, send verification codes, log in, list plans, and create payment orders. Those are sensitive account-management and financial operations unrelated to analytics, and if followed by an agent they could enable misuse of user identity data or trigger purchases without sufficient safeguards.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and then the system temp directory. This mismatch can cause sensitive API responses to be stored in locations with weaker isolation or unexpected retention, violating user expectations and potentially exposing TikTok analytics data and metadata to other local users or processes.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API key issuance, plan listing, ordering, and payment QR generation, which is materially unrelated to the declared TikTok video analytics function of the skill. Such scope drift is dangerous because it introduces credential handling and purchase capabilities that expand the attack surface and can mislead users into exposing phone numbers, verification codes, and payment actions under an unrelated skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create orders, render payment QR codes, and query payment state despite the skill being presented as a TikTok video analytics tool. Payment functionality in a mismatched skill context is dangerous because it can trigger unauthorized or socially engineered purchases and gives the skill financial-action capability that users would not reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill performs SMS-based login, token exchange, user/team enumeration, and API token retrieval/generation, all beyond the stated analytics purpose. In this context, collecting phone numbers and verification codes is particularly sensitive because users invoking a data analytics skill are not expecting identity onboarding and secret issuance workflows.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger conditions are intentionally broad enough to activate even when the user does not mention TikTok or EchoTik, as long as the request loosely resembles video search or analytics. Over-broad activation can cause the agent to invoke a paid, networked, data-writing skill unexpectedly, leading to unnecessary external data transfer, surprise charges, and disclosure of user intent to third-party services. This context makes it more dangerous because the skill consumes credits and writes outputs to disk.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Defaulting to the US marketplace when the user does not specify a region silently makes a substantive choice on the user's behalf. In a paid external-query workflow, this can produce irrelevant or misleading results, trigger unintended data transfers to a particular regional dataset, and consume credits without informed consent. The risk is amplified because the skill itself states that region is mandatory at the API level, so silent substitution masks an important missing input rather than surfacing it.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The Feedback API example encourages transmission of free-form content that may contain user requests, outcomes, or other conversational details to an external service without any warning, consent flow, or minimization guidance. In an agent context, this is dangerous because operators may inadvertently send sensitive or personal user content off-platform under the guise of routine skill usage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell the agent to ask for and use a user's phone number and one-time code for registration/login, but provide no privacy notice, retention limits, consent language, or handling restrictions for that sensitive personal data. This creates risk of unnecessary collection of personal information and credential-like data through an analysis skill not expected to process them.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script caches full API responses and persistently writes complete response bodies to disk by default, including in hidden cache paths and session directories, without user consent controls, retention limits beyond cache TTL, or permission hardening. In this skill context, returned TikTok analytics may include commercially sensitive data, and storing it broadly on disk increases the chance of unintended disclosure from shared workspaces, backups, temp directories, or later processes.

Static analysis

No suspicious patterns detected.