Kalodata-TikTok直播搜索与详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:38 PM UTC
• Version: 1.0.2

Overview

The skill is mainly a disclosed paid TikTok livestream analytics integration, but it also includes under-scoped feedback, onboarding, credential, payment, and persistence behavior that deserves manual review before installation.

Install only if you are comfortable with a paid LinkFox/Kalodata integration that uses API keys, makes external network calls, stores full responses locally, and may guide users through phone-based login and payment. Review or disable automatic feedback reporting, avoid setting LINKFOX_* gateway variables to untrusted hosts, and keep generated response/cache files out of shared or committed workspaces.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The script allows the destination gateway to be overridden via the LINKFOX_TOOL_GATEWAY environment variable while also attaching the API key and session metadata as request headers. In an untrusted or multi-tenant execution environment, an attacker who can influence environment variables can redirect requests to an attacker-controlled host and exfiltrate credentials and contextual metadata.

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The script forwards environment-derived values such as LINKFOX_TOOL_GATEWAY and request headers including SESSION_ID, MODE_ID, and APP_NAME into an outbound HTTP request. Because the destination base URL is also controllable via environment variable, a compromised runtime can redirect requests and exfiltrate the API key and session metadata to an attacker-controlled server.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token requests to those endpoints via requests.post. If an attacker can influence environment variables like LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect authentication traffic to an arbitrary server and capture credentials or tokens.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The gateway request uses a URL derived from environment-controlled base settings and includes the API key in the Authorization header before calling urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related variables can force the tool to send that bearer credential and other order/account queries to an attacker-controlled endpoint, resulting in credential exfiltration and possible SSRF-style behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill uses environment variables, network access, and persistent file writes but does not declare permissions or clearly constrain those capabilities. That weakens transparency and reviewability, making it easier for hidden behaviors such as data exfiltration, credential use, or unintended disk persistence to occur without explicit operator awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a TikTok livestream analytics tool, but the referenced behavior includes account login via SMS, API key generation, user/package queries, order creation, QR code generation, and payment-status polling. Mixing analytics with authentication and payment flows is a serious scope expansion that can collect sensitive user data and trigger financial actions users did not intend when invoking a ranking/detail skill.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger logic is intentionally broad and activates even when the user does not explicitly name the tool, increasing the chance of accidental invocation. In a paid, networked skill with data persistence and possible onboarding/payment side effects, overbroad triggering raises the risk of unnecessary external calls, unwanted cost, and disclosure of user context to third-party services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation introduces a separate public Feedback API endpoint and instructs clients to send free-form `content`, but it does not warn that this text is transmitted to an external service. In an agent setting, user messages, task context, or operational details could be forwarded without informed consent, creating a privacy and data-handling risk even though this is not direct code execution or credential theft.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The onboarding flow explicitly instructs collecting a user's phone number and sending it to a local script to register for an API key, but it does not include any privacy notice, consent language, retention limits, or guidance on secure handling of the number. This creates unnecessary exposure of personal data and can lead to unauthorized collection, logging, or onward transmission of phone numbers.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill mandates writing full API responses to session-scoped files in the current project directory, creating persistent local copies of potentially sensitive user queries, identifiers, analytics data, and operational metadata. Storing this by default outside ephemeral memory increases exposure to later unauthorized access, accidental commit/sync, multi-task leakage within the workspace, and privacy violations beyond the immediate task.

Static analysis

No suspicious patterns detected.