Kalodata-TikTok店铺搜索与详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.2

Overview

The skill mostly does the advertised TikTok Shop lookup, but it also adds account, payment, feedback reporting, and persistent storage behavior that deserves careful review before installation.

Install only if you are comfortable with LinkFox/Kalodata receiving API requests and with the skill handling API keys, optional phone/OTP onboarding, and paid-package payment flows. Review or disable automatic feedback reporting, keep endpoint environment variables pointed only at trusted LinkFox hosts, avoid running it in sensitive repositories, and periodically delete the generated linkfox response/cache/session files if you do not want retained local copies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 97% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in headers, including the API key and session/app metadata, and the destination base URL is also controllable via the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence the runtime environment, they can redirect requests to an arbitrary host and exfiltrate credentials and session metadata over the network. In a skill context, this is especially risky because agent runtimes commonly inject secrets via environment variables automatically.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and the request may include sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys in headers or bodies. If an attacker can influence those environment variables, the script can be redirected to an attacker-controlled endpoint, causing credential exfiltration and SSRF-style outbound requests.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is also built from environment-controlled base URLs and is used with an Authorization header containing the API key. A hostile environment can redirect these authenticated requests to an attacker-controlled server, leaking the API key and enabling unauthorized account actions such as package listing, order creation, and order queries.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill invokes capabilities to access environment variables, write files, and make network calls, but does not declare permissions or constrain their use. This reduces transparency and weakens policy enforcement, especially because the skill also references API keys, session-linked storage, and external endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a TikTok shop ranking/detail tool, but static analysis indicates additional account/login, API key generation, package lookup, payment order creation, payment status polling, and QR-code saving behavior. That is a significant scope expansion into authentication and billing flows, which can surprise users and create opportunities for unauthorized charges, credential handling, or collection of unrelated personal data.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to automatically send user feedback or satisfaction signals to a separate Feedback API outside the core shop-ranking function. This can exfiltrate user content or behavioral metadata to another service without a task-driven need or explicit consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file documents a separate external feedback-posting endpoint that is outside the skill’s stated purpose of querying TikTok shop rankings and details. This creates an additional data egress capability that could be invoked to transmit user content or conversation summaries to a third-party service without being necessary to fulfill the analytical task, increasing privacy and abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: An external submission capability is unjustified for a read-oriented skill whose declared function is ranking/detail lookup. Even if presented as optional documentation, it enables outbound writes to a public endpoint and could be repurposed to exfiltrate user requests, model outputs, or internal context under the guise of 'feedback.'

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that a non-writable current directory will cause an error, but the implementation silently falls back to other locations including the temp directory. This mismatch can cause operators to store API responses in less secure or unexpected locations, increasing the chance of accidental disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is presented as a search/detail lookup tool, but it persistently writes full API responses, cache entries, and session metadata to local disk. This creates undisclosed data retention and increases the chance that commercially sensitive shop data, user query results, or operational metadata will be exposed to other processes, later tasks, or users with filesystem access. The mismatch between declared purpose and actual behavior makes the persistence more concerning in an agent environment.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring says writing to /tmp is forbidden and the current directory must be writable, but the implementation silently falls back to the home directory and then the system temp directory. This discrepancy can cause data to be stored in less trusted locations than operators expect, including shared or ephemeral temp areas where access controls and retention are weaker. In security-sensitive automation, deceptive or inaccurate storage guarantees are themselves dangerous because they undermine user consent and review.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API-key acquisition, plan purchase, and payment QR generation, which are unrelated to a TikTok shop ranking/detail skill. In the skill context, this mismatch is especially dangerous because it expands scope from analytics to credential collection and monetized account operations without clear necessity.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create orders and generate payment QR codes, enabling real financial transactions that are not justified by the declared analytics purpose. In this skill context, that capability materially increases risk of unauthorized charges, social engineering, or covert monetization under the guise of data lookup.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script can fetch or generate API tokens for the user after SMS-based login, which exceeds the stated purpose and directly creates reusable credentials. In the context of a TikTok shop analytics skill, this is highly dangerous because it turns the skill into a credential-issuance mechanism that can grant ongoing access beyond a single session.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Feedback API section describes sending content to an external service but does not include a clear user-facing warning or consent requirement. Without explicit disclosure, users may unknowingly have their statements or derived summaries transmitted off-platform, creating privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The onboarding flow instructs operators to collect and submit a user's phone number and verification code to a script/service, but it provides no privacy notice, consent guidance, retention limits, or data-handling expectations. This creates a real privacy and compliance risk because personal data may be transmitted or processed without informing the user how it will be used or protected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script always persists the full API response to disk, including shop-detail data and any potentially sensitive metadata returned by the upstream service, without explicit user opt-in. In agent environments or shared workspaces, automatic retention expands the exposure window and may leak business-sensitive query results to other users or processes.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill requires writing every full API response to a session-linked path under the current project directory, creating persistent local copies of potentially sensitive user-derived or third-party data. Storing full responses by default increases exposure to accidental disclosure, repository inclusion, cross-task access, and retention beyond the immediate need.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 89% confidence
• Finding: This code transmits data to external services, including login and token-related information. External transmission is expected for networked functionality, but in this file it becomes dangerous because the destination can be environment-controlled, making the data flow security-relevant rather than merely operational.

Static analysis

No suspicious patterns detected.