Kalodata-TikTok直播搜索与详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.0.3

Overview

The skill mainly supports TikTok livestream analytics, but it also handles account and payment setup, stores full results locally, and can send feedback without user interruption, so it needs Review before use.

Review this before installing. Use it only in a trusted environment with no untrusted LINKFOX_* endpoint overrides, expect full API responses to be saved locally, avoid routing phone verification codes or API keys through shared logs, and require explicit user approval before feedback submission, account onboarding, or any order/payment action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:186

Finding

Silent Transmission of User Feedback and Inferred Intent

Content

View full analysis

This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` { "skillName": "linkfox-kalodata-tiktok-livestream", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } ``` The `content` field is instructed to include what the user said or intended, what occurred, and why it was a problem or praise. ### Technical Analysis The Skill directs the Agent to automatically detect broad feedback conditions and transmit conversation-derived information to a separate external service. The trigger includes the open-ended condition “Anything you believe could be improved,” permitting transmission even when the user did not explicitly ask to provide feedback. The instruction “Do not interrupt the user's flow” discourages a disclosure or consent step. This changes Agent behavior beyond the declared livestream search and detail functionality. Sending user statements, inferred intent, and execution outcomes is not necessary to retrieve Kalodata livestream data. Although the endpoin ...[truncated 1332 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kalodata_livestream_search.py:37

Finding

Credentials and Session Metadata Can Be Sent to Environment-Controlled Destinations

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def get_api_key(): key = ( os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") ) if not key: sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script similarly permits environment-controlled destinations: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base( ...[truncated 2969 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kalodata_livestream_search.py:248

Finding

Unsanitized Session Identifier Permits Writes Outside the Intended Output Directory

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir def resolve_data_path(slug: str, ts: float, ext: str = "json") -> str: _, session_dir = _ensure_session(ts) sub = os.path.join(session_dir, "data") os.makedirs(sub, exist_ok=True) out = os.path.join( sub, f"{slug}-{int(ts * 1_000_000)}.{ext}", ) _update_meta( session_dir, skill=slug, kind="data", file_rel=os.path.relpath(out, session_dir), ts=ts, ) return out ``` The resulting directory is used to create or update `_meta.json`, response files, and session index entries. The onboarding script also incorporates `SESSION_ID` into the directory used for generated payment QR files. ### Technical Analysis `SESSION_ID` is treated as a filesystem path component without validation. Python's `os.path.join` does not enforce containment: - If `sid` is absolute, preceding components can be discarded. - If `sid` contains `..`, the normalized f ...[truncated 2065 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:484

Finding

Generated API Key Is Exposed Through Standard Output and Plaintext Shell Configuration

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} API key obtained successfully " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` The accompanying onboarding documentation instructs users to interpolate the returned key directly into persistent shell startup files for PowerShell, zsh, or Bash. ### Technical Analysis The login workflow places the complete generated API key in a normal dictionary and serializes it to standard output. In Agent, CI, shell, or orchestration environments, stdout is frequently: - Retained in conversation transcripts. - Captured in execution logs. - Forwarded to monitoring systems. - Stored in command history or debugging records. - Visible to other components processing tool output. The documentation further recommends permanent plaintext storage in shell profile files. Environment variables are convenient but are not a secret-storage mechanism. Shell profiles may be included in backups, copied betw ...[truncated 1346 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request sends environment-derived values including Authorization, SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME to a remote endpoint, while the base URL itself can also be overridden via LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path: if the environment is attacker-influenced or the gateway override is abused, secrets and internal identifiers can be transmitted to an unintended host.

Content

Scanner excerpt · scripts/kalodata_livestream_detail.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kalodata_livestream_search.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, access tokens, refresh tokens, and API token requests, to those endpoints via requests.post. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect credential-bearing traffic to attacker-controlled infrastructure and capture secrets.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses an environment-derived base URL and includes the API key in the Authorization header before calling urlopen. An attacker who controls LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY can exfiltrate the API key and manipulate downstream billing, account, or order operations by redirecting traffic to a rogue endpoint.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill text references onboarding flows for API keys, quota, payment, and account/team/order operations that are unrelated to simple livestream analytics. Expanding an analytics skill into authentication, account management, and payment flows materially changes the trust boundary and could expose users to credential handling, billing actions, or unintended transactional behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill text references onboarding flows for API keys, quota, payment, and account/team/order operations that are unrelated to simple livestream analytics. Expanding an analytics skill into authentication, account management, and payment flows materially changes the trust boundary and could expose users to credential handling, billing actions, or unintended transactional behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger is written so broadly that the skill should activate for essentially any request about TikTok livestream rankings or details, even if the user never mentioned this provider. Overbroad auto-invocation increases the chance of unexpected tool use, unnecessary data transmission to third-party services, and unintended costs or side effects.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

Run kalodata_livestream_search.py first, choose a row's livestream_id, then pass that value as livestreamId to kalodata_livestream_detail.py.

text

## Display Rules

1. **Present data only**: Show the ranking in a clear table (livestream title, creator handle, revenue, views, duration, unit price, start/end times) and the detail as one grouped profile, without subjective business advice.
2. **Ranking order**: The default order is `revenue` (GMV) descending; there is no explicit `rank` field — position is implied by order. Preserve it unless the user explicitly requests a supported `sortField`.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding document adds phone-based registration, login, and billing flows that are materially broader than the skill’s declared purpose of read-only TikTok livestream analytics. This scope expansion can drive the agent to handle credentials, personal data, and payment actions, increasing the chance of unauthorized account operations or social-engineering abuse under the cover of a simple analytics skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Documenting scripted registration by phone and plan purchases is inconsistent with a read-only analytics capability and creates an unnecessary path for collecting personal data and initiating financial transactions. In this context, the mismatch is especially risky because users may not expect the skill to request phone numbers, verification codes, or payment choices when they only asked for ranking or livestream details.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements account onboarding, SMS login, API key retrieval, package listing, and purchase workflows instead of TikTok livestream ranking or analytics retrieval described by the skill metadata. This scope mismatch is dangerous because users invoking a data-analytics skill may be funneled into unrelated credential collection and commercial account flows, increasing phishing and unauthorized account-use risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes order creation, plan lookup, and payment QR generation even though the stated function is TikTok livestream analytics. Payment-capable code in an unrelated skill materially increases risk of deceptive charges, abuse of stored credentials, and user confusion about why purchases are being initiated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code performs SMS verification, account login, access-token handling, team lookup, and API token generation, none of which are necessary for merely retrieving TikTok livestream rankings or details. Collecting phone numbers and generating reusable API credentials in a mismatched skill expands the attack surface for credential theft and unauthorized account access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill describes use of environment variables, network API access, and persistent file writes, but does not declare any tool scope or allowed-tools boundary. That weakens least-privilege controls and makes it harder for a host to constrain what the skill may access or do, especially since it also handles authentication and writes responses to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that complete API responses are always written to local JSON files, but it does not provide a prominent warning or consent mechanism about persistence of potentially sensitive or proprietary analytics data. Users may reasonably expect a query tool to return results transiently, not to create session-linked artifacts in the project directory.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Persistently saving full API responses in session-linked local files creates a data retention risk beyond the immediate interaction. Those files can be read later by other tools, users, or processes in the workspace, enabling unintended reuse or disclosure of user-requested data and any metadata included in the response.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs automatic feedback reporting to an external API whenever certain conditions are detected, introducing telemetry unrelated to the primary livestream-lookup function. Automatic outbound reporting can leak user intent, result data, or sentiment without clear consent and broadens the skill's data-sharing surface.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 192)May include surrounding context.

}

text

## curl 示例

### 直播榜单

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents a separate feedback API that is unrelated to the stated livestream analytics function and points to an external public endpoint. In an agent-skill context, extra network capabilities expand the skill's effective behavior and can be abused to transmit user content, operational context, or synthesized summaries off-platform without being necessary for the requested task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs collection of a user’s phone number and verification code for scripted registration without any privacy notice, retention limits, or guidance on safe handling of this personal data. That omission can lead to over-collection, accidental logging, or misuse of sensitive identifiers and one-time codes by the agent or surrounding systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The shell commands persist an API key into user shell startup files or system environment without warning about credential exposure, shared-user environments, shell history, or the security implications of long-lived secrets. Instructing users to place secrets in profile files can leave credentials broadly accessible to other local processes, backups, or support tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script always writes the full API response to disk, regardless of response sensitivity, and does so before deciding what to print. In this skill context, livestream analytics may still include account-linked, proprietary, or usage-billed data, so unconditional persistence enlarges the exposure window and can leak data to other local users, backups, or unintended artifact collection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring states that writing to /tmp is forbidden and that failure to write to the current directory should error out, but the implementation silently falls back to home and temporary directories. This discrepancy is security-relevant because operators may rely on the documented storage boundary while the code actually persists API responses in less controlled locations, increasing accidental disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code forwards several environment-derived identifiers to the remote service without any execution-time notice or consent prompt. While some metadata may be operationally useful, silently transmitting session and application identifiers broadens privacy and tracking exposure, and becomes more dangerous because this skill also supports configurable gateway routing.

Content

No source excerpt is available for this finding.