FastMoss-TikTok商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.6

Overview

The skill mostly matches a paid TikTok product-search tool, but it also includes under-scoped account, credential, payment, feedback, and persistence behaviors that users should review before installing.

Install only if you are comfortable with a paid LinkFox/FastMoss integration that may ask for a phone number, handle SMS login, generate and print an API key, create payment orders on request, send feedback to LinkFox, and store full API responses locally. Review the endpoint environment variables and avoid persistent plaintext API-key storage on shared or managed machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The POST target is derived from environment-controlled base URLs and receives sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens. In an agent/skill environment, environment variables may be influenced by the host or deployment, so this creates an SSRF-style exfiltration path where credentials can be sent to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request uses a URL built from environment-controlled base configuration and attaches the API key in the Authorization header before calling urlopen. If the base URL is redirected to an attacker-controlled service, the skill will disclose the API key and potentially perform unintended network requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill uses environment variables, network access, and persistent file writes but does not declare these capabilities or constrain them. Hidden capabilities reduce transparency and can enable unintended data access, external transmission, or local data persistence beyond what a user expects from a product-search skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is TikTok product search, but the referenced behavior includes account login, SMS verification, API key generation, billing, order creation, and payment QR handling. This is a major scope expansion into authentication and payments, increasing the chance of credential exposure, unauthorized transactions, and user confusion about what the skill is actually doing.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatically sending feedback or mismatch reports to a separate Feedback API is outside the core product-search function and can transmit user content or interaction metadata to another service without clear consent. Secondary data flows like this create privacy and compliance risk, especially when triggered by dissatisfaction or inferred quality issues.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as a TikTok product-search capability, but the documentation also includes a separate public feedback submission endpoint with different purpose and base URL. This expands the skill's effective behavior surface and could enable unintended outbound data submission of user content or conversation details if an agent follows the docs naively, creating a privacy and scope-creep risk.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module docstring promises that writes are confined to the current directory and explicitly forbids /tmp, but the implementation falls back to ~/linkfox and the system temp directory when the preferred path is unavailable. This can cause data to be written outside the expected workspace boundary, increasing the risk of unintended persistence or exposure of potentially sensitive API responses and session metadata.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API key issuance, plan listing, order creation, and payment QR generation, which are materially outside the advertised TikTok product-search capability. That mismatch increases risk because the skill can collect credentials and initiate billing flows users would not expect from a search tool.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create paid orders and render payment QR codes even though billing is unrelated to the declared product-search function. In this context, hidden purchase capability is dangerous because it can drive unexpected financial transactions from a skill the user invoked for data lookup.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill performs SMS authentication, access-token handling, team discovery, and API token generation, all beyond the stated product-search purpose. In a skill execution environment, this unnecessarily expands access to user accounts and secrets, making credential collection and privilege expansion more dangerous than the manifest suggests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell the agent to collect and pass a user's phone number to a registration script, but they do not require explicit informed consent, a privacy notice, or limits on storage/logging of that personal data. In an agent setting, this creates unnecessary exposure of sensitive personal information and increases the risk of mishandling, retention, or disclosure through logs or downstream tooling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to persistently write an API key into shell startup files or environment configuration without warning that this stores credentials on disk in plaintext and may expose them to other local users, backups, shell history, or support tooling. While common operationally, doing so without disclosure or safer alternatives is a security weakness because it normalizes long-lived secret persistence.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends user-supplied search parameters along with session-related metadata to a remote service without an explicit warning at the point of transmission. In an agent skill context, this creates a privacy and data-governance risk because users may not expect prompts, identifiers, or operational metadata to leave the local environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The login command emits the freshly obtained API key in stdout JSON, which is commonly captured by agent logs, transcripts, orchestration layers, or other tools. That exposes a reusable secret beyond the immediate user session and can enable unauthorized API access if logs are later viewed or leaked.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill requires persistent logging of full API responses in the project directory and organizes them by session, which can retain sensitive or user-derived data longer than necessary and expose it to other tools or collaborators with filesystem access. Writing complete responses by default also increases the blast radius if the workspace is shared, synced, or later inspected.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Automatically reporting user reactions, dissatisfaction, or perceived mismatches can send user-provided content or inferred sentiment to an external system without informed consent. This is especially risky because the trigger criteria are broad and subjective, making over-collection and unnoticed transmission more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.