Back to skill

Security audit

EchoTik-商品视频查询

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real LinkFox TikTok product-video analytics skill, but it also handles login, API-key setup, saved local responses, and payment-order creation in ways users should review before installing.

Install only if you are comfortable giving this skill LinkFox account access, storing API responses in your workspace, and using its account and billing helper flows. Prefer self-service account setup when possible, avoid running it in workspaces with untrusted environment variables, review any plan or payment order before proceeding, and keep generated response files and API keys out of source control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
97% confidence
Finding
with urlopen(req, timeout=150) as response:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
96% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
96% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes capabilities to read environment variables, write files, and make network requests, but it does not declare permissions or present these capabilities as explicit security-relevant behaviors. This undermines least-privilege review and informed consent, especially because the skill also persists API responses locally and relies on environment-based credentials.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared purpose is product video analytics, but the broader behavior includes onboarding, phone verification, API-key retrieval/generation, package listing, payment order creation, QR rendering, and order-status queries. Mixing analytics with authentication and payment flows materially expands the attack surface and creates opportunities for unauthorized charges, credential misuse, or user confusion about what actions the skill may take.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This skill is declared as a TikTok product video analytics capability, but the file implements account onboarding, SMS login, API key retrieval, plan listing, order creation, and payment QR generation. That scope mismatch is dangerous because it collects credentials and initiates purchases unrelated to the user's expected analytics task, increasing the risk of covert account access and monetization abuse.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code can create orders, query billing state, and render payment QR codes, which are financial actions not justified by a video analytics skill. In a skill execution environment, such hidden commerce functionality can be abused to trick users into paying, subscribe them unexpectedly, or facilitate account monetization workflows outside the declared purpose.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The file performs SMS-based login, exchanges verification codes for access tokens, queries team membership, and generates API tokens even though the skill is supposed to analyze TikTok product video data. This creates an unnecessary credential acquisition path that expands the blast radius of compromise and normalizes collection of secrets unrelated to the stated task.

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger guidance is overly broad and instructs activation even when the user does not explicitly mention EchoTik or product-video terminology. Overbroad triggering increases the chance the skill will run in contexts the user did not intend, which is especially risky for a credit-consuming tool that can access network services and may persist retrieved data locally.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that full API responses are always written to a project-local path, but it does not clearly foreground this as a user-facing privacy and security warning. Users may reasonably expect an analytics lookup, not silent persistence of potentially sensitive, session-linked business data in the working directory.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs collecting a user's phone number and using it in authentication flows without any privacy notice, consent language, retention limits, or guidance on secure handling. In an agent context, this creates risk of unnecessary collection of personal data and unsafe transmission or logging of sensitive identifiers during support workflows.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill tells users to persist API keys in shell profiles and environment variables, including commands that append secrets to startup files, without warning about local exposure risks. This can leak credentials via shell history, shared machines, backups, dotfile sync, support logs, or other processes that can read environment variables or profile files.

Ssd 3

Medium
Confidence
94% confidence
Finding
Always saving complete API responses to local files violates data minimization and can expose session identifiers, business metrics, creator identifiers, URLs, and other retrieved data beyond what is necessary to answer the user. Storing these files in the current project directory also raises the risk of later accidental disclosure through source control, shared workspaces, or subsequent tools reading those artifacts.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
90% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.