Back to skill

Security audit

EchoTik-TikTok店铺详情

Security checks across malware telemetry and agentic risk

Overview

This skill mainly fetches TikTok Shop seller details as advertised, but it also adds automatic feedback reporting and persistent full-response storage that deserve review before installation.

Install only if you are comfortable giving this skill a LinkFox API key, making paid LinkFox network calls, and storing full seller-detail responses locally. Before use, verify LINKFOX_TOOL_GATEWAY is unset or points to the official LinkFox gateway, and be aware that the docs tell the agent to submit feedback automatically to a separate LinkFox feedback endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
with urlopen(req, timeout=120) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill describes use of environment variables, network access, and file writes but does not declare permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer may treat the skill as lower risk than it actually is, while the skill can still access credentials, call remote services, and persist data locally.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to automatically call a separate Feedback API unrelated to the core task of fetching seller details. That expands data flow and network behavior beyond user intent, potentially transmitting user content, satisfaction signals, or contextual metadata to another endpoint without explicit consent.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The file for a seller-detail retrieval skill documents an unrelated public feedback-posting endpoint, expanding the skill's apparent capability beyond its stated purpose. In an agent setting, this can enable unintended outbound writes of user-derived content to a third-party service, creating a channel for data exfiltration, prompt-influenced side effects, or abuse without a clear user request tied to the core skill.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger logic is overly broad and allows activation on generic store-analysis requests even when the user does not explicitly mention TikTok or EchoTik. This can cause unintended tool invocation, unnecessary paid API calls, and transmission of user-supplied identifiers or business queries to an external service without sufficiently clear intent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script always writes the full API response to disk and may also print it to stdout for smaller responses, which can expose potentially sensitive seller data in logs, transcripts, shared workspaces, or temporary storage. In an agent/skill context, automatic persistence and echoing increase the chance of unintended data disclosure beyond the immediate task.

Ssd 3

Medium
Confidence
95% confidence
Finding
The skill requires writing full API responses to session-scoped files in the project directory by default. Persisting complete responses beyond immediate execution increases the risk of accidental disclosure to other tools, later prompts, collaborators, or repository sync processes, especially when the data includes identifiers, links, and business intelligence.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.