Kalodata-TikTok商品搜索与详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.2

Overview

The skill mainly performs the advertised TikTok product lookups, but it also includes account login, API-key generation, payment ordering, automatic feedback reporting, and broad local response storage that deserve review before installation.

Review this skill carefully before installing. Use it only if you are comfortable with LinkFox/Kalodata network calls, paid credit consumption, saved local response files, and the onboarding flow handling phone numbers, SMS codes, API keys, and possible payment orders. Prefer self-service authentication, avoid sharing verification codes unless you intend to register or log in through the script, and treat any printed API key as a secret.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request sent to urlopen includes headers populated from environment variables, including Authorization and session/app metadata, and the destination base URL is also overrideable via LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path: if an attacker can influence the environment, secrets and metadata can be sent to an arbitrary remote host.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The code sends authentication data and other sensitive request bodies to URLs derived from environment-controlled base URLs. If an attacker can influence those environment variables, they can redirect SMS login, token, and user-info traffic to an attacker-controlled endpoint, causing credential and token exfiltration. In this skill, that is especially dangerous because the script handles phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request uses urllib to send authorized API calls to a URL built from environment variables, including the bearer API key in the Authorization header. An attacker who controls the environment can redirect these requests to an external host and capture the API key, user/order metadata, and payment-related data. Because this script also supports order creation and account queries, compromise of this channel can expose billing and account capabilities.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill document clearly describes access to environment variables for API keys, network calls to remote endpoints, and mandatory file writes of API responses, yet no permissions are declared. This creates a transparency and control gap: operators and users cannot accurately assess or constrain what the skill can access, increasing the chance of unintended secret exposure or local data persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The static finding indicates behavior well beyond product-ranking queries, including SMS login, API key generation/retrieval, subscription-plan browsing, payment order creation/status checks, and QR-code rendering. Those flows touch authentication, billing, and credential lifecycle management, so hiding them behind a product-analytics skill materially increases the risk of phishing-like consent bypass, surprise charges, or unauthorized account actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation adds a separate external Feedback API that is outside the skill’s stated purpose of querying TikTok product rankings and details. This expands the skill’s effective capabilities to transmit user-derived content to a third-party endpoint, creating an unnecessary data egress path that could leak user prompts, outcomes, or internal context if invoked without clear consent and boundary checks.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The module documentation promises that writing to /tmp is forbidden and that the script should error if the current directory is not writable, but the implementation silently falls back to home and temp directories. This mismatch can cause sensitive API responses to be stored in less trusted locations than operators expect, increasing the risk of unintended disclosure on shared systems.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The docstring promises that data will only be written under the current working directory and explicitly forbids /tmp, but the implementation may fall back to ~/linkfox or the system temp directory. This discrepancy can cause sensitive API responses to be persisted in less expected or less protected locations, increasing accidental disclosure risk and undermining operator trust.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements account onboarding, SMS login, API key issuance, package listing, ordering, and payment QR generation, which are unrelated to the declared TikTok product-ranking/data-query purpose. This scope mismatch is a strong indicator of hidden or unnecessary privileged functionality, increasing the chance the skill is being used to collect credentials or monetize access outside user expectations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and generate payment QR codes despite the skill being described as a TikTok analytics tool. Unnecessary payment capabilities can be abused for unauthorized purchases, deceptive monetization flows, or to pressure users into funding unrelated services. In context, this is more dangerous because users invoking analytics features would not reasonably expect billing operations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script performs SMS-based authentication, token exchange, team lookup, and API key generation/retrieval, none of which are justified by the stated product-ranking scope. This creates a credential-handling surface that can capture user phone numbers, SMS codes, access tokens, and long-lived API keys, enabling account takeover or unauthorized API use if misused or intercepted.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation rule is overly broad, instructing the agent to trigger even when the user did not mention Kalodata and only generally asked about TikTok product details or analytics. Broad triggers can cause the skill to run in contexts where the user did not intend external API use or paid operations, increasing the chance of unnecessary data disclosure, unwanted charges, or inappropriate tool invocation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates writing full API responses into the project directory on every run, with no clear user-facing consent or storage minimization. Persisting remote responses by default can expose business data, identifiers, and session-linked artifacts to other tools, collaborators, or later tasks, especially in shared workspaces.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The onboarding instructions explicitly tell the agent/operator to collect a user's phone number and use it in registration/login flows, but they do not include any privacy notice, consent guidance, data minimization, or handling/storage restrictions for this personal data. In an agent skill context, that omission is risky because it normalizes requesting sensitive user information and may lead to improper collection, exposure in logs, or reuse beyond the immediate authentication task.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script transmits SESSION_ID, MODE_ID, and APP_NAME to a remote service without any visible minimization or explicit notice in the code path. While these are not necessarily secrets, they can expose workflow, tenant, or user-context metadata to external infrastructure and broaden the blast radius if the endpoint is misconfigured or compromised.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill sends user-supplied query parameters plus SESSION_ID, MODE_ID, and APP_NAME to a remote service without any disclosure in stdout or consent prompt. In this skill context, the payload can include product research criteria and session metadata, so silent transmission creates a privacy and data-governance issue even if the endpoint is legitimate.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function returns the generated API key directly in stdout JSON, which may be logged, displayed in transcripts, or stored by orchestration layers. Exposing secrets this way increases the risk of credential leakage and subsequent unauthorized API access, especially in agent environments where stdout is commonly persisted.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instructions require retaining complete API responses under a session-based path, which encourages accumulation of user-linked and potentially sensitive data beyond the immediate need. Session-based storage also makes correlation across requests easier and increases the blast radius if the workspace is later accessed by other agents, users, or processes.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This request transmits potentially sensitive data externally, including login payloads and token-related information. External transmission is expected for networked functionality, but here it becomes dangerous because destinations are environment-configurable and the skill processes authentication artifacts unrelated to its declared analytics purpose.

Static analysis

No suspicious patterns detected.