Kalodata-TikTok店铺搜索与详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:16 AM UTC
• Version: 1.0.3

Overview

The skill’s core TikTok Shop lookup is coherent, but it adds under-scoped feedback, account, billing, credential, and persistence behavior that should be reviewed before installation.

Review this skill before installing. Use it only if you are comfortable with LinkFox receiving shop queries and with the skill handling account or billing recovery. Do not provide phone/SMS codes or create payment orders unless you deliberately want that flow. Avoid custom LINKFOX_* endpoint overrides, and prefer a secure secret store over writing API keys into shell profile files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:180

Finding

Silent transmission of user statements and inferred intent to a feedback service

Content

View full analysis

This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` { "skillName": "linkfox-kalodata-tiktok-shop", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } **Field rules:** - `content`: Include what the user said or intended, what actually happened, and why it is a problem or praise ``` ### Technical Analysis The Skill instructs the agent to automatically report feedback to a separate external endpoint. The reporting condition is open-ended because it includes anything the agent believes could be improved. The payload instructions explicitly request information about what the user said or intended. The phrase “Do not interrupt the user's flow” discourages disclosure or consent collection. Consequently, conversation-derived information may be sent outside the active shop-query operation without the user knowing which information will be transmitted. This behavior is not required to retrieve TikTok Shop rankings or details and exceeds the minimum network access needed for the declared functionality. ...[truncated 984 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kalodata_shop_search.py:37

Finding

Environment-controlled endpoints can receive API keys and authentication tokens

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` From `scripts/onboarding.py`: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return {"_error": str( ...[truncated 2937 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kalodata_shop_search.py:246

Finding

Unvalidated session identifier permits output path traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The resulting path is then used for output: ```python def resolve_data_path(slug: str, ts: float, ext: str = "json") -> str: _, session_dir = _ensure_session(ts) sub = os.path.join(session_dir, "data") os.makedirs(sub, exist_ok=True) out = os.path.join(sub, f"{slug}-{int(ts * 1_000_000)}.{ext}") _update_meta(session_dir, skill=slug, kind="data", file_rel=os.path.relpath(out, session_dir), ts=ts) return out ``` The onboarding client uses the same unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name even though it originates from the process environment. No val ...[truncated 1982 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/onboarding.md:11

Finding

Onboarding instructions persist API keys in plaintext shell profiles and command history

Content

View full analysis

"` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` - Variable name `LINKFOX_AGENT_API_KEY` or legacy `LINKFOXAGENT_API_KEY` ``` ### Technical Analysis The onboarding workflow returns an API key and instructs the user to interpolate it directly into a shell command. This creates several exposure points: - The command may be retained in shell history. - The key is permanently stored in plaintext startup files. - Command arguments may be observable by local process-monitoring tools. - Profile files may be copied into backups, diagnostics, dotfile repositories, or support bundles. - File permissions may permit other local accounts or processes to read the secret. - Repeated onboarding can leave obsolete keys in multiple profile entries. Persistent configuration is convenient but is not the minimum-privilege storage method for a paid API credential. ### Attack Path 1. The user completes SMS authentication and receives an API key. 2. The user copies the documented command with the key embedded in it. 3. The shell records the command or the key is otherwise exposed through process arguments. 4. The command writes the API key into a plaintext shell profile or user environment. 5. Malware, another local account, a backup process, a support tool, or an accidentally published dotfile repository obtains the key. 6. The attacker uses the key to make unauthorized LinkFox API requests. ### Impact Assessment A recovered key can enable operations permitted by the associated LinkFox API account, including paid tool calls and access to account-scoped API functionality. The ...[truncated 278 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request target and headers are influenced by environment variables: LINKFOX_TOOL_GATEWAY controls the destination URL and SESSION_ID/MESSAGE_ID/MODE_ID/APP_NAME are forwarded as headers. This allows exfiltration of user query data and internal identifiers to an attacker-controlled endpoint if the environment is manipulated, and the skill provides no allowlist or validation of the gateway host.

Content

Scanner excerpt · scripts/kalodata_shop_detail.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request sends multiple environment-derived values, including the API key and session metadata, to a URL whose base can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable, the skill will exfiltrate credentials and user/session identifiers to an arbitrary host, which is a real SSRF/credential-leak risk. In this skill context, the danger is increased because the tool is expected to access ranking data only, not to trust runtime-configured outbound destinations.

Content

Scanner excerpt · scripts/kalodata_shop_search.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The script builds destination URLs from environment-controlled base URLs and then POSTs sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and derived API tokens to those endpoints. If an attacker can influence environment variables in the runtime, they can redirect authentication and token traffic to an attacker-controlled server, causing credential exfiltration and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses an environment-derived base URL and sends the bearer API key in the Authorization header via urlopen. An attacker who can set the environment can redirect requests to an attacker-controlled endpoint and harvest the API key, enabling unauthorized use of the user's LinkFox account and paid resources.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a TikTok shop analytics tool, but static findings indicate additional account, billing, login, payment, and QR-code generation flows unrelated to the declared purpose. Hidden authentication and payment functionality is dangerous because it can collect phone numbers, manage API keys, expose account metadata, and initiate purchases outside the user's expected task scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a TikTok shop analytics tool, but static findings indicate additional account, billing, login, payment, and QR-code generation flows unrelated to the declared purpose. Hidden authentication and payment functionality is dangerous because it can collect phone numbers, manage API keys, expose account metadata, and initiate purchases outside the user's expected task scope.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition is extremely broad and activates even when the user does not explicitly mention the skill or Kalodata, covering generic TikTok shop ranking/detail requests. Over-broad triggering increases the chance this skill runs in contexts where its file/network/logging side effects are unnecessary or unexpected.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

Run kalodata_shop_search.py first, choose a row's shop_id, then pass that value as shopId to kalodata_shop_detail.py.

text

## Display Rules

1. Present ranking results in a table with rank, shop name, shop type, revenue, sales volume, product count, unit price, and growth rate.
2. Present detail results as one grouped profile: identity, scale, revenue channel split, and creator/video/live counts.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file performs account onboarding, SMS login, API key issuance, package listing, order creation, and payment handling, which is materially broader than the declared TikTok shop ranking/detail purpose. That mismatch increases the chance of unnecessary credential collection and monetization flows being triggered under the guise of a data-query skill, expanding the attack surface and violating least functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code can create orders and generate payment QR codes despite the skill being described as a TikTok shop analytics/search tool. Embedding payment capabilities in an unrelated skill creates a strong phishing and unauthorized-purchase risk, especially because users may not expect billing actions from this context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises capabilities that imply network access, environment variable access, and file writing, but it does not declare an explicit tool scope or permission boundary. That makes it harder for a host agent to enforce least privilege and increases the chance the skill can access more resources than users expect.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs persistent logging of full API responses into session-scoped files on disk. Even if the API is primarily analytics data, full responses can contain user-provided parameters, identifiers, account metadata, or unexpected sensitive fields, and storing them by default increases retention and local exposure risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs automatic use of a separate Feedback API that is unrelated to the user's requested TikTok shop lookup. This creates an unrequested secondary data flow that may transmit user interactions or model judgments externally without necessity or informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill mandates automatic reporting of user praise, dissatisfaction, and anything the agent thinks could be improved, without opt-in. This is a privacy and governance issue because it encourages exfiltration of user sentiment and conversation-derived metadata to an external service beyond the core task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 197)May include surrounding context.

}

text

## curl 示例

### 店铺榜单

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation adds a separate public feedback submission API that is unrelated to the skill's core data-retrieval function. In an agent setting, this creates an unexpected outbound data path that could cause user prompts, derived results, or metadata to be sent to a third party without clear user consent or strong scoping, increasing privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is for TikTok shop ranking/detail analytics, but the onboarding doc directs operators to collect a user's phone number and drive registration/login flows through a script. That expands the skill into account provisioning and credential-handling for an unrelated service, increasing privacy, social-engineering, and unauthorized-account-creation risk well beyond the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions explicitly tell the operator to ask for a user's phone number and use it for scripted registration, but provide no privacy notice, consent safeguards, or handling limits. Collecting personal data and verification codes in an ad hoc support flow increases the risk of privacy violations, account takeover concerns, and regulatory noncompliance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation includes billing workflows such as listing plans, creating payment orders, and querying order status, which are unrelated to a shop analytics skill. Embedding payment handling in this context broadens the agent's authority and creates risk of unintended purchases, phishing-like payment prompting, and abuse if the flow is triggered inappropriately.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring claims writing to /tmp is forbidden and that failure to write the current directory should raise an error, but the code actually falls back to home and temporary directories. This mismatch is security-relevant because operators and users may rely on the documented storage boundary while the implementation writes data to less controlled locations, increasing accidental disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill sends user-supplied parameters plus multiple environment-derived identifiers to a remote service without any runtime notice, consent gate, or minimization. In this skill context, users expect shop ranking/detail queries, but may not expect propagation of internal session and application metadata, making the data-sharing behavior more dangerous than the nominal feature suggests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script persistently stores full API responses, cache entries, session metadata, and index records on local disk, including shop-detail data and session identifiers. For a query-style skill this broad retention increases privacy and data exposure risk, especially because the implementation also writes to home or temp directories and silently caches results for 24 hours.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring presents the skill’s operational instructions entirely in Chinese, and later user-facing status messages also follow that language choice. This imposes a specific language/locale on users without offering a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persistently stores full API responses, cache entries, and session metadata on local disk even though the skill's stated function is simply search/detail lookup. These files can contain commercial data, identifiers, query history, and session linkage information, creating unnecessary data retention and a larger privacy/exposure surface if the workspace, home directory, or temp area is accessible to other users or later tools.

Content

No source excerpt is available for this finding.