Kalodata-TikTok达人搜索与详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.2

Overview

The skill performs its advertised creator lookup, but it also includes automatic feedback reporting, broad local response persistence, credential onboarding, and payment/order flows that users should review before installing.

Install only if you are comfortable with a LinkFox/Kalodata skill that uses an API key, spends credits per lookup, stores full creator results locally, can guide phone-based account setup, can create unpaid payment orders/QR codes when credits are insufficient, and can automatically submit feedback content to LinkFox. Review or disable the feedback and persistence behavior if handling sensitive creator contact data or private user prompts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request ultimately uses a gateway base URL taken from the LINKFOX_TOOL_GATEWAY environment variable and sends sensitive headers including the API key and session/app identifiers to that destination. In an agent environment, a user or upstream process that can influence environment variables can redirect traffic to an attacker-controlled host and exfiltrate credentials and context metadata.

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes environment-derived headers such as SESSION_ID, MODE_ID, APP_NAME, and an authorization key, and the destination base URL is also environment-configurable through LINKFOX_TOOL_GATEWAY. This creates a real exfiltration risk because a manipulated runtime environment can redirect sensitive metadata and credentials to an attacker-controlled endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises capabilities that include environment-variable access, network access, and file writes but does not declare permissions or obtain explicit user-facing consent for those operations. This reduces transparency and makes it easier for the skill to access secrets and persist data in ways the user may not expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to perform TikTok creator ranking/detail lookup, but the referenced behavior extends into account login, API key generation, package purchase, payment QR creation, and order-status polling. That is a major scope expansion into authentication and payments, which can expose users to credential handling, billing actions, and external data flows unrelated to the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatic reporting to a separate Feedback API is unrelated to the core function of creator ranking/detail retrieval and creates an extra exfiltration path for user interaction data. Because the trigger criteria include broad cases like praise, dissatisfaction, or anything improvable, the skill may transmit unnecessary user content without informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation adds a separate external feedback POST endpoint that is outside the skill’s stated creator-search/detail purpose. That creates an unexpected outbound data channel that could be used to transmit user content or conversation-derived data to a third party without clear necessity, consent, or scope limitation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: An external feedback posting capability is not justified by the skill’s described function of looking up TikTok creator rankings and details. Because it accepts freeform content, it could be repurposed to exfiltrate user prompts, retrieved profile data, or internal error details to an unrelated endpoint, increasing privacy and data-governance risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script always persists full API responses and session metadata to local storage, even though the skill is described as a lookup tool for TikTok creator rankings and details. Because those responses may include contact information, store associations, and analytics, this creates unnecessary data retention and expands the exposure window if the workstation, project directory, or logs are later accessed by other users or tools.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements SMS login, API-key acquisition, subscription listing, ordering, and payment QR generation, which materially exceed the declared TikTok creator analytics/search scope. In a skill context, this creates an unjustified credential and billing surface that can be triggered under the guise of unrelated creator lookup functionality.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Billing and payment capabilities are embedded in a skill whose manifest describes creator leaderboard/detail lookup, not commerce or account management. This mismatch is dangerous because users invoking analytics features would not reasonably expect the skill to place orders or generate payment artifacts, increasing the risk of deceptive or unauthorized purchases.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code logs in with SMS, inspects team membership, and retrieves or generates an API token, then returns that token to stdout. For a creator-search skill, provisioning bearer credentials is out of scope and dangerous because it converts the skill into an account bootstrap and secret-distribution channel.

Vague Triggers

High

• Confidence: 87% confidence
• Finding: The trigger condition is intentionally broad and tells the agent to activate this skill for almost any TikTok creator ranking/detail request, even when Kalodata is not mentioned. Over-broad activation increases the chance of unintended external API calls, unwanted charges, and unnecessary disclosure of user queries to a third-party service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill retrieves creator contact fields and presents them as part of normal detail output, but it does not include privacy guidance, access restrictions, or handling limits for personal/contact data. That increases the risk of exposing or misusing sensitive information, especially if the data is stored or redistributed automatically.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that full API responses are always written to disk in the project directory, but this persistence is not surfaced as a meaningful user warning despite including potentially sensitive business and contact data. Default local retention expands the exposure window beyond the immediate task and can leak data to other tools, users, or later sessions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API exposes creator contact fields such as email, WhatsApp, Facebook, Line, and other direct-contact identifiers without any handling warning, access restriction guidance, or privacy notice. In this skill context, those fields are personal contact data and their unrestricted surfacing can enable scraping, profiling, spam, or broader misuse of personal information.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding instructions explicitly ask for a user's phone number and route it through a script-based registration flow, but they do not tell the user how that personal data will be used, stored, transmitted, or protected. In a skill context, this creates a privacy and consent risk because the agent may solicit sensitive contact information without clear notice or minimization.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script forwards SESSION_ID, MODE_ID, and APP_NAME headers to a remote API without any runtime disclosure or minimization. In this skill context, those values may carry workflow, project, or user-session metadata that is unnecessary for the business function and increases privacy and correlation risk if the remote service or routing is compromised.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script writes the complete API response to disk automatically without explicit confirmation at execution time. In this skill’s context, the response may contain creator contact details and commercial performance data, so silent persistence materially increases confidentiality risk and may violate user expectations about a simple search/detail lookup.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The request includes environment-derived session metadata headers without any user-facing disclosure at runtime. While some telemetry may be operationally useful, sending ambient identifiers unnecessarily expands data sharing and can leak contextual information about the user session, application mode, or environment to the remote service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI emits a newly obtained API key directly in stdout JSON, which can be captured by logs, transcripts, shell history, orchestration layers, or downstream tools. In an agent environment this is particularly risky because stdout is often persisted or exposed beyond the immediate user session.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Persistent logging of full API responses into session-scoped local files creates a clear data-retention vulnerability, particularly because the responses may include creator contact fields and other sensitive analytics. Storing this by default in the working project directory increases the likelihood of accidental disclosure, unauthorized reuse, or inclusion in backups/version control.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The feedback instructions encourage broad reporting of user interaction details to an external API, including subjective reactions and anything that could be improved. This creates an unnecessary telemetry channel that may capture user content or behavior beyond what is needed to fulfill the task.

Static analysis

No suspicious patterns detected.