Kalodata-TikTok达人搜索与详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 1.0.3

Overview

The skill mostly performs TikTok creator analytics, but it adds silent feedback reporting plus sensitive login, billing, credential, and local-storage behavior that needs review before installation.

Review this skill carefully before installing. Only use it if you trust LinkFox/Kalodata with creator queries, account onboarding data, payment actions, and local cached results. Avoid setting custom gateway/login URLs, do not paste SMS codes or API keys into shared terminals, prefer self-service key setup, disable or remove automatic feedback reporting, and clear local linkfox cache/output files when they may contain contact or business data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:171

Finding

Automatic Exfiltration of Conversation-Derived Feedback Without Explicit Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kalodata_creator_detail.py:37

Finding

API Credentials Can Be Redirected to an Arbitrary Environment-Controlled Gateway

Content

View full analysis

str: """Gateway base address: env LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def get_api_key(): key = ( os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") ) if not key: sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding gateway uses the same trust model: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) headers = {"Authorization": _api_key()} req = Request(url, method=method, data=body_bytes, ...[truncated 2097 chars]

Remediation

View remediation

other

Warning

• Location: scripts/kalodata_creator_detail.py:60

Finding

Creator Requests Transmit Unnecessary Agent Session and Message Identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kalodata_creator_detail.py:102

Finding

Complete Creator Profiles and Contact Details Are Duplicated in Persistent Files Without Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:475

Finding

Onboarding Exposes SMS Codes and Long-Lived API Keys Through Process Arguments, Standard Output, and Shell History

Content

View full analysis

dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: 手机号格式不正确: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: 验证码格式不正确: {code}", "phone": masked} # Authentication and token retrieval omitted. return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The complete result is printed to standard output: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print( f"{TAG} API key obtained successfully (source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` The OTP and phone are positional command-line arguments: ```python p = sub.add_parser("login", help="Log in with verification code and obtain API key") p.add_argument("phone") p.add_argument("code", help="SMS verification code") p.add_argument("--channel", default="skill", help="Channel; default is skill") ``` The accompanying instructions recommend plaintext persistence: ```text python scripts/onboarding.py login echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo ...[truncated 1841 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:162

Finding

Onboarding Recommends Installing Unpinned Runtime Dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The script recommends installing `qrcode`, `pillow`, and `requests` without version pins, integrity hashes, a lockfile, or a specified trusted package index. The package names appear legitimate and there is no evidence in the audited project that they are intentionally malicious. Nevertheless, installing unspecified current versions at runtime makes the environment non-reproducible and increases exposure to registry compromise, dependency takeover, or incompatible future releases. The installation guidance also does not require a virtual environment, so users may modify a shared or privileged Python environment. ### Attack Path 1. The user invokes an onboarding operation that requires a missing module. 2. The script instructs the user to run an unpinned `pip install` command. 3. The package manager resolves the latest available packages and transitive dependencies from its configured index. 4. A compromised, unexpectedly changed, or incompatible artifact is installed. 5. The dependency executes with the privileges of the user when imported or during installation. ### Impact Assessment The impact depends on the integrity of the resolved package artifacts and the privileges used for installation. In the worst case, a compromised dependency coul ...[truncated 288 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The request sends multiple environment-derived values, including the API key and session identifiers, to a URL whose base can be overridden via the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence the execution environment, they can redirect the request to an attacker-controlled host and exfiltrate credentials and request data. In a skill context, forwarding opaque environment state to the network is especially risky because these values often carry cross-tool authentication and session metadata.

Content

Scanner excerpt · scripts/kalodata_creator_detail.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination and multiple headers are influenced by environment variables, including LINKFOX_TOOL_GATEWAY and session/application metadata, and are sent to a remote endpoint via urlopen. In an agent/runtime environment where env vars may be attacker-controlled or inherited from untrusted context, this creates a real exfiltration/SSRF-style risk: API keys, query contents, and tracking metadata can be sent to an arbitrary host.

Content

Scanner excerpt · scripts/kalodata_creator_search.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The code allows base URLs for login and agent-user API calls to be overridden via environment variables and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and account metadata to those URLs. In a skill/onboarding context, this creates a realistic exfiltration path if the runtime environment is influenced by an attacker or misconfigured, effectively turning authentication and token bootstrap flows into credential forwarding.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway request path builds its destination from environment-controlled base URLs and then attaches the API key in the Authorization header before calling urlopen. If an attacker can influence environment configuration, they can redirect these calls to an arbitrary server and capture the API key or induce unintended authenticated actions against attacker-chosen infrastructure.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is severe: a skill presented as TikTok creator analytics reportedly also performs phone-based login, token/API key retrieval, account/team/package access, and order/payment operations. That is far beyond the stated purpose and could enable credential harvesting, account takeover, unauthorized purchases, or covert monetization under the guise of analytics.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is severe: a skill presented as TikTok creator analytics reportedly also performs phone-based login, token/API key retrieval, account/team/package access, and order/payment operations. That is far beyond the stated purpose and could enable credential harvesting, account takeover, unauthorized purchases, or covert monetization under the guise of analytics.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is severe: a skill presented as TikTok creator analytics reportedly also performs phone-based login, token/API key retrieval, account/team/package access, and order/payment operations. That is far beyond the stated purpose and could enable credential harvesting, account takeover, unauthorized purchases, or covert monetization under the guise of analytics.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is intentionally broad and instructs activation even when the user does not mention the underlying provider, which increases the chance of unsolicited tool use and data access. In an autonomous agent, broad triggers can cause over-collection, unnecessary paid API calls, and exposure of third-party data without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

Run kalodata_creator_search.py first, choose a row's creator_id, then pass that value as creatorId to kalodata_creator_detail.py.

text

## Display Rules

1. Present ranking results in a table with nickname, handle, followers, content views, sales volume, revenue, video/live revenue, and growth rate.
2. Present detail results as one grouped profile: identity, audience, revenue, video, live, products/shops, and contact.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements account onboarding, SMS login, API key issuance, plan listing, ordering, and payment QR generation, which are outside the declared TikTok creator analytics function of the skill. That mismatch materially increases risk because the skill can solicit user phone numbers, login codes, and payments under a context where users expect creator-search functionality, enabling credential collection and monetization flows unrelated to the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code can create orders and render payment QR codes even though the skill is described as providing TikTok creator ranking and detail lookup. In this context, hidden billing capability is dangerous because it can induce purchases or subscriptions unrelated to the user's expected analytics task, and the mismatch makes social engineering and unauthorized monetization more plausible.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares capabilities that involve environment access, file writes, and network use, but it does not constrain them with an explicit tool scope such as permissions or allowed-tools. In an agent setting, missing scoping increases the blast radius of prompt-triggered actions, especially because the skill also instructs persistent local writes and API-driven behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill states it may retrieve and display creator contact fields such as email and social contacts, but it provides no privacy notice or consent checkpoint. Even if the data is returned by the upstream source, surfacing personal contact information without warning or purpose limitation can create privacy, compliance, and misuse risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The API exposes creator contact fields such as email, WhatsApp, Facebook, TikTok, Zalo, and Line, but the documentation provides no privacy, purpose-limitation, or handling guidance. In an agent setting, this increases the risk of collecting, storing, or redisclosing personal contact data in ways that violate privacy expectations, policy, or compliance requirements.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 202)May include surrounding context.

}

text

## curl 示例

### 达人榜单

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document adds a separate public feedback submission API that is outside the skill's core creator search/detail function. This expands the skill's effective capability to transmit data to an external service, which can enable unintended exfiltration of user prompts, operational details, or other sensitive context if an agent follows the documentation without strict data minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The onboarding flow instructs the operator to collect and transmit a user's phone number to a script-driven registration process without any explicit privacy notice, consent guidance, retention limits, or warning that personal data is being sent to a third-party service. This creates a real privacy and data-handling risk because agents may solicit sensitive personal information in chat and pass it into tooling without informing the user how it will be used or protected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring presents the skill's usage and output behavior entirely in Chinese, indicating a fixed language expectation rather than offering a user-selectable locale. This can violate language/locale policy when the skill is used in broader contexts without explicit user opt-in to Chinese.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level documentation explicitly states that full responses are always written under the current working directory and that writing to /tmp is prohibited, with failure if the current directory is not writable. However, _linkfox_root actively falls back to ~/linkfox and then $TMPDIR/linkfox, directly contradicting the documented storage policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script persistently writes full creator-detail API responses, cache entries, and session metadata to local storage, including potentially sensitive creator contact information and commercial analytics. This creates a data retention and privacy exposure beyond a simple query tool, especially because files are stored across shared workspace, home, or temp locations and metadata indexes sessions over time. In this skill, the dataset explicitly includes联系方式 and related business details, which increases sensitivity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module documentation explicitly promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation silently falls back to ~/linkfox and then $TMPDIR/linkfox. This mismatch can cause sensitive creator data and API responses to be written to less trusted or shared locations contrary to operator expectations, increasing disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script forwards SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME to an external API without any consent gate, redaction, or clear disclosure at runtime. While this may be operationally convenient, these identifiers can reveal internal workflow, tenant, or user-correlation data to the remote service and expand privacy and metadata-exposure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file performs SMS-based login, token exchange, team selection, and API token generation despite the skill being presented as a TikTok creator analytics/search tool. This is dangerous because it collects sensitive authentication factors and provisions long-lived access in a context where users would not reasonably expect identity onboarding, increasing the risk of credential harvesting and privilege expansion.

Content

No source excerpt is available for this finding.