Kalodata-TikTok视频搜索与详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.3

Overview

The skill mostly performs the advertised TikTok video analytics workflow, but it also includes high-impact account, billing, telemetry, and credential-handling behavior that needs review before installation.

Review this skill before installing. It will call external LinkFox/Kalodata services using an API key, may ask for a phone number and SMS code to create or retrieve a key, can create payment orders for credits, stores full results locally, and includes automatic feedback reporting. Only use it in an environment where LinkFox endpoint variables are trusted, avoid sharing OTPs or API keys in logs, and disable or remove automatic feedback behavior if conversation privacy matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kalodata_video_search.py:36

Finding

Redirectable API Endpoints Can Exfiltrate Credentials and Authentication Data

Content

View full analysis

str: """Gateway base address: LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") ``` The onboarding client uses the same pattern for more sensitive authentication operations: ```python def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() ``` ### Technical Analysis The destination hosts are selected from environment variables without enforcing HTTPS, validating the hostname, restricting ports, or applying an allowlist. Sensitive values are subsequently sent to the selected destinations. The video clients send the LinkFox API key in the `Authorization` header. T ...[truncated 1552 chars]

Remediation

View remediation

other

Error

• Location: SKILL.md:172

Finding

Automatic Feedback Reporting Can Disclose Conversation-Derived Information Without Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kalodata_video_search.py:62

Finding

Analytics Requests Transmit Unnecessary Agent Session and Message Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:478

Finding

Generated API Keys Are Exposed Through Standard Output and Plaintext Shell Configuration

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key", file=sys.stderr) return 0 ``` The onboarding documentation recommends plaintext persistence: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The login command returns the complete generated API key as JSON on standard output. In Agent, CI, terminal recording, or subprocess environments, stdout is commonly logged or inserted into a conversation transcript. This causes the secret to cross a broader trust boundary than necessary. The recommended setup commands also store the key as plaintext in shell startup files. Such files may be readable by backup systems, support tooling, local administrators, compromised editor extensions, or other processes running as the same user. ### Attack Path 1. The user supplies a phone number and OTP to the onboarding command. 2. The workflow retrieves or generates an API key. 3. `_cmd_login` serializes the complete result, including `api_key`, to stdout. 4. The calling Agent, terminal recorder, CI service, or logging system captures the output. 5 ...[truncated 615 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kalodata_video_search.py:248

Finding

Unsanitized SESSION_ID Allows Writes Outside the Intended Output Directory

Content

View full analysis

str: """Prefer SESSION_ID; otherwise generate an identifier.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The resulting path is used for response writes: ```python with open(out_path, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding implementation similarly uses the value directly: ```python sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name but is not validated. Python’s path joining permits `..` components, path separators, and absolute paths. A crafted value can therefore escape the intended `//` hierarchy. The scripts subsequently create directories and write response, metadata, index, or QR files using paths derived from this value. The achievable loca ...[truncated 1254 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Onboarding Recommends Installing Unpinned Runtime Dependencies

Content

View full analysis

None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The error messages instruct users to install packages by name without specifying reviewed versions, integrity hashes, a lockfile, or an approved package-index source. Package resolution therefore depends on the active Python and pip configuration at installation time. No evidence shows that the named packages are malicious. The risk arises from unconstrained dependency resolution, including compromised package indexes, dependency confusion in configured mirrors, malicious replacement releases, or future incompatible versions. ### Attack Path 1. A user invokes onboarding in an environment where `requests`, `qrcode`, or `pillow` is unavailable. 2. The script directs the user to run the unpinned `pip install` command. 3. The environment resolves packages from its configured index or mirror. 4. A compromised index, malicious mirror, or future compromised release supplies attacker-controlled code. 5. Package installation or later import executes that code with the user’s privileges. ### Impact Assessment A malicious dependency can execute arbitrary Python code under the account running the Skill. This can expose API keys, phone and OTP data, local files, and Agent workspace contents. Exploitability depends on a compromised or unsafe package source or package release; the repository itself does not contain evidence that t ...[truncated 46 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request URL and several outbound headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY and SESSION_ID/MESSAGE_ID/MODE_ID/APP_NAME. In an agent/runtime context where environment can be attacker-controlled or indirectly influenced, this enables SSRF-style outbound requests to arbitrary hosts and exfiltration of the API key via the Authorization header to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/kalodata_video_detail.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The request sends several environment-derived values, including the API key and session/message identifiers, to a network endpoint whose base URL can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable, the script can be redirected to an attacker-controlled host and exfiltrate credentials and tracking metadata.

Content

Scanner excerpt · scripts/kalodata_video_search.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The script builds destination base URLs from environment variables and then sends login data, access tokens, refresh tokens, user identifiers, and API-token management requests to those endpoints via requests.post. In environments where an attacker or untrusted wrapper can control env vars, this becomes an exfiltration/SSRF-style sink that can redirect highly sensitive authentication traffic to attacker infrastructure.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway request path uses urlopen on a Request whose URL is derived from environment-controlled base URLs and includes the Authorization header populated from LINKFOX_AGENT_API_KEY. If env configuration is attacker-influenced, the script can be coerced into sending bearer credentials and order/account operations to an arbitrary host, exposing secrets and enabling unauthorized request replay.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch is more serious because the finding says the skill can trigger account/login, API-key generation, user/team info retrieval, pricing lookup, payment order creation, QR code generation, and payment-status queries—none of which are disclosed by the skill's stated TikTok video analytics purpose. Hidden authentication and payment-related flows materially expand the attack surface and could induce credential handling, account actions, or billing operations outside user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more serious because the finding says the skill can trigger account/login, API-key generation, user/team info retrieval, pricing lookup, payment order creation, QR code generation, and payment-status queries—none of which are disclosed by the skill's stated TikTok video analytics purpose. Hidden authentication and payment-related flows materially expand the attack surface and could induce credential handling, account actions, or billing operations outside user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is more serious because the finding says the skill can trigger account/login, API-key generation, user/team info retrieval, pricing lookup, payment order creation, QR code generation, and payment-status queries—none of which are disclosed by the skill's stated TikTok video analytics purpose. Hidden authentication and payment-related flows materially expand the attack surface and could induce credential handling, account actions, or billing operations outside user expectations.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

Run kalodata_video_search.py first, choose a row's video_id, then pass that value as videoId to kalodata_video_detail.py.

text

## Display Rules

1. Present ranking results in a table with title, video ID, views, engagement, revenue, ad indicators, and creator handle.
2. Present detail results as one grouped profile: identity, engagement, monetization, ads, creator, duration, and linked products.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements SMS login, API key issuance, package listing, order creation, and payment workflows, which are materially broader than the skill's declared TikTok video analytics purpose. That scope mismatch is dangerous because it introduces credential collection and billing capabilities users would not reasonably expect from an analytics skill, increasing phishing, abuse, and accidental-purchase risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code can create orders and generate payment QR codes even though the skill is described as a TikTok analytics/search tool. Embedding purchase capability in an unrelated skill increases the chance of deceptive billing flows, social engineering, or unauthorized charges under the guise of data lookup.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though it clearly relies on environment variables, filesystem writes, and network/API access. Missing scope declarations weaken least-privilege controls and make it harder for a host system or reviewer to constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text is broad enough to trigger on generic TikTok video-data requests even when the user did not intend to use Kalodata or this particular workflow. Over-broad triggering increases the chance of unnecessary external calls, cost-incurring actions, and unintended disclosure of user queries or identifiers to third-party services.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs persistent storage of full API responses into session-scoped files in the project directory. Even if the API is primarily analytics-oriented, responses and request context can contain identifiers, account metadata, commercial data, or user-provided inputs that remain accessible to later processes, collaborators, or other tools beyond the immediate task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 196)May include surrounding context.

}

text

## curl 示例

### 视频榜单

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation adds a separate feedback submission API that is outside the skill's stated purpose of TikTok video ranking/detail retrieval. This creates scope expansion: an agent following the skill docs could transmit user-derived content to a third-party endpoint unrelated to the requested analytics task, enabling unintended data exfiltration or covert secondary actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The feedback section instructs posting free-form content to an external endpoint but provides no warning, consent requirement, or minimization guidance for user data. In an agent context, this can cause user prompts, personal data, or business-sensitive context to be forwarded off-platform without the user's awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The onboarding instructions explicitly tell the operator to collect and process a user's phone number and SMS verification code through a script-based registration flow, but they do not require consent language, data-minimization, or warnings about handling sensitive personal data. In a support/onboarding context this increases privacy and account-abuse risk, because operators may solicit credentials or personal identifiers without clear safeguards, retention limits, or verification that the workflow is legitimate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file's documented contract says it must not write to /tmp and should fail if the current directory is not writable, but the implementation silently falls back to the home directory and then the system temp directory. In agent environments, this can cause sensitive API responses to be persisted in less controlled locations than expected, increasing the risk of data leakage, cross-task exposure, or accidental retention.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persistently stores full API responses and session metadata on disk by default, even though the skill is described as a search/detail tool rather than a data-retention mechanism. Those responses may contain sensitive business analytics, identifiers, or user-query-derived data that remain accessible to other local processes or future sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring claims output is restricted to the current working directory and explicitly forbids /tmp, but the implementation falls back to the home directory and temporary directory when preferred locations are unavailable. This mismatch can place sensitive outputs in less expected or less controlled locations, undermining operator assumptions and security reviews.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME from the environment on every API request without any visible consent or minimization step. In this skill context, those identifiers are not obviously required for video lookup itself, so transmitting them increases metadata exposure and correlation risk beyond the user's apparent request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing natural-language strings entirely in Chinese and enforces a fixed "+86" area code and 11-digit domestic phone format. Under the language/locale policy rule, forcing a specific language/locale without user opt-in is a policy concern unless clearly documented as region-specific and justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs SMS-based account login and API key retrieval/generation, which is unrelated to simple TikTok video search/detail functionality. This expands the trust boundary to credential handling and token issuance, making the skill a collection point for authentication secrets and increasing the impact of misuse or redirection attacks.

Content

No source excerpt is available for this finding.