Linkfox Tiktok选品与带货视频

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:51 PM UTC
• Version: 1.2.3

Overview

The skill’s TikTok product and shoppable-video purpose is coherent, but it needs Review because it handles credentials and billing while some helper behavior is broader or less contained than the documentation says.

Install only if you trust LinkFox with the configured API key and with any phone/SMS, OAuth, token, or payment actions you explicitly initiate. Review or restrict LINKFOX_TOOL_GATEWAY and related URL override environment variables, and be aware that full API responses may be written outside the workspace despite the docs. Treat no-watermark video downloads as rights-sensitive content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), args.params],
            capture_output=True,
            text=True,

• Confidence: 95% confidence
• Finding: The helper executes a Python script path supplied via `--script`, and `_resolve_script` only checks that the path exists locally. That makes this wrapper a generic local code-execution primitive: if an agent or user can influence `--script`, they can run arbitrary local Python files under the agent's privileges, which exceeds the stated TikTok-tool purpose and can lead to arbitrary command execution, data theft, or system modification.

Tainted flow: 'req' from os.environ.get (line 42, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request destination is derived from the LINKFOX_TOOL_GATEWAY environment variable and then used in urlopen without validating or pinning the host. In a hostile or misconfigured runtime, an attacker could redirect the Authorization-bearing request to an arbitrary server, causing API key exfiltration and SSRF-style outbound access.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The script forwards environment-derived values such as SESSION_ID, MODE_ID, APP_NAME, and a credential-bearing Authorization header to a remote endpoint. Because the base URL is also overridable via LINKFOX_TOOL_GATEWAY, an attacker who can influence the environment can redirect requests and exfiltrate credentials and metadata to an arbitrary server.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request sent via urlopen includes sensitive environment-derived values in both the destination selection path and outbound headers, notably the API key and session metadata. Because LINKFOX_TOOL_GATEWAY is environment-controlled and not validated, an attacker who can influence the runtime environment can redirect authenticated requests to an arbitrary host and exfiltrate credentials and request data.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request sent via urlopen includes environment-derived values in headers and, more importantly, the destination base URL is also controlled by the LINKFOX_TOOL_GATEWAY environment variable. In an agent/runtime context where environment variables may be influenced by untrusted configuration, this can exfiltrate API credentials and session metadata to an attacker-controlled endpoint, making the tainted network flow a real issue.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sends environment-derived values, including SESSION_ID, MODE_ID, APP_NAME, and an API key, to a network endpoint whose base URL is controllable via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration path: if an attacker can influence environment variables or skill configuration, secrets and metadata can be redirected to an attacker-controlled server.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target is derived from environment-controlled base URLs via _login_base()/_agent_user_base(), and the request carries highly sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables, the script can be redirected to attacker infrastructure, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway URL is built from environment-controlled values and then used in urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect authenticated API traffic to a malicious server and capture the API key and account/order data.

Tainted flow: 'req' from os.environ.get (line 42, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request destination is derived from the LINKFOX_TOOL_GATEWAY environment variable, so whoever controls the runtime environment can redirect this script to an arbitrary host while it automatically attaches the Authorization API key. That creates an SSRF-style credential exfiltration path: a malicious or compromised environment can force the tool to POST sensitive token-refresh data and credentials to an attacker-controlled endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and enables access to environment variables, file read/write, network calls, and shell-executed scripts, but does not declare permissions or clearly constrain those capabilities. This weakens policy enforcement and review because a host may grant broader access than users or operators expect, increasing the chance of secret exposure, filesystem misuse, or command execution through downstream scripts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The manifest describes a TikTok product-selection and shoppable-video toolkit, but the documented behavior also includes onboarding, SMS login, API key generation, subscription/payment flows, token retrieval/refresh, and generic response persistence. That mismatch is dangerous because reviewers and users may authorize the skill for analytics/video publishing while it also handles account lifecycle, billing, and credential material, expanding the attack surface far beyond the declared purpose.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document gives contradictory guidance about whether large-file init/bind endpoints can be sent through the proxy. In operational security terms, contradictory interface documentation is dangerous because an agent may choose the wrong path, bypass intended gateway restrictions, or mishandle uploads and credentials when retrying alternate routes. This is not direct code execution, but it can cause unsafe network behavior and policy bypass attempts.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module documentation explicitly says writing to /tmp is forbidden, but _linkfox_root() falls back to tempfile.gettempdir()/linkfox when other locations are not writable. This can cause sensitive API responses and session metadata to be persisted in a less controlled, potentially shared temporary location, contrary to operator expectations.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation promises output is always written under <cwd>/linkfox and explicitly says /tmp is forbidden, but the implementation falls back to ~/linkfox and the temp directory. This mismatch is security-relevant because users may rely on the stated storage boundary and unknowingly persist potentially sensitive API responses in less controlled locations.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The persistence logic can write session data outside the current workspace, including the home directory and temp directory, despite the skill being presented as producing local project-scoped output. This increases the chance of unintended retention, cross-session exposure, and leakage of downloaded API data in shared or less monitored filesystem locations.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that a non-writable current directory should cause an error, but _linkfox_root() silently falls back to the home directory and then the system temp directory. This mismatch can cause sensitive API responses to be persisted in locations the operator did not expect, increasing the chance of data exposure on shared systems or through weaker temp-directory controls.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The docstring explicitly promises outputs remain under the current working directory and forbids /tmp, but the implementation silently falls back to ~/linkfox and the system temp directory. This can cause sensitive API responses to be written to less controlled locations, increasing exposure to other local users, backup systems, or cleanup races, especially because the script always persists full responses.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: This skill advertises TikTok selection and shoppable video tooling, but the file implements account onboarding, SMS login, API key issuance, and subscription ordering for a separate platform. That scope expansion increases the attack surface and can surprise users into disclosing credentials or performing billing actions unrelated to the declared functionality.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The script supports package lookup, order creation, and payment QR generation, which are billing capabilities outside the stated TikTok tooling scope. Embedding purchase flows in a skill increases risk of unauthorized or socially engineered charges, especially when users may not expect financial actions from this tool.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code retrieves or generates a platform API token and returns it to the caller, which is broader than the claimed TikTok analytics/publishing behavior. Exposing token issuance inside a skill raises the risk of credential leakage, misuse by downstream components, and privilege expansion beyond what users expect.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The file explicitly advertises itself as a generic wrapper that can run any main script passed in by path, which is broader than the declared business function of TikTok selection and shoppable-video tooling. This scope expansion is dangerous because it turns a domain-specific skill into a general execution launcher, enabling abuse unrelated to the skill's intended API interactions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The `read` subcommand accepts an arbitrary file path and loads it as JSON, allowing the tool to inspect any locally readable JSON file rather than only response artifacts it created. In an agent setting, that broadens the skill into a local file-reading utility, which can expose secrets, configs, tokens, or unrelated application data if the path is attacker-influenced.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly instructs clients to upload video chunks directly to a returned `upload_url` outside the LinkFox gateway, but it does not warn users that data will leave the platform’s controlled proxy path or describe the trust, logging, retention, and validation implications of that direct transfer. In a media-upload workflow this can expose sensitive video content, metadata, or credentials in query parameters to an external endpoint without adequate user awareness or control, especially if callers assume all traffic remains within LinkFox-mediated protections.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to always persist the full API response to a local project path, keyed by session and timestamp, without requiring user consent or a clear user-facing notice. Even though the data is business-oriented, full responses can include sensitive commercial data, identifiers, or unexpected fields, and writing them by default increases the risk of unintended retention, later exposure to other tools/processes in the workspace, or accidental commit/sharing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly promotes saving and reusing TikTok creator video material, including no-watermark downloads, without any warning about copyright, creator consent, platform terms, or acceptable-use limits. In this context, the tool lowers friction for unauthorized copying and reuse of third-party content, which can facilitate infringement and policy violations even if it is not directly a code-execution flaw.

Static analysis

No suspicious patterns detected.