TikTok官方-店铺数据分析

• Outcome: Review
• Latest audit: Jul 30, 2026 · 12:22 PM UTC
• Version: 1.0.0

Overview

The skill is mainly for TikTok Shop video analytics, but it also exposes a broad generic ERP proxy that can reach wider analytics and authorization API paths, so it should be reviewed before use.

Install only if you are comfortable giving the skill access to LinkFox/TikTok Shop ERP API calls tied to your openId and API key. Prefer a narrowed version that removes analytics_proxy.py or restricts it to exact GET-only endpoints needed for video performance and shop_cipher lookup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while its documented scripts and behavior clearly require shell execution, network access, and likely environment access. This undermines least-privilege review and can cause operators or automated systems to trust and run a capability-bearing skill without understanding its real execution surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a narrow analytics helper for Get Video Performances, but it also exposes a generic proxy and authorization-related access paths, including retrieving authorized shops. That mismatch increases the chance of misuse, because users or policy systems may approve it for read-only analytics while it can reach broader APIs and enumerate tenant/shop data through the same gateway.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is described as a TikTok Shop video analytics skill, but this file documents an additional capability to enumerate all shops a seller has authorized. That broadens the skill’s effective scope beyond the declared purpose and can expose tenant/shop inventory metadata that may be used for unauthorized discovery, cross-shop targeting, or privacy-impacting data access flows if the agent can invoke it unexpectedly.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The generic `run_analytics_proxy` function accepts caller-supplied `path`, `method`, `queryString`, and `body` and forwards them to `developer_proxy_call` with ERP credentials. That creates a broad capability far beyond the skill’s declared read-only TikTok Shop video analytics purpose, enabling access to arbitrary ERP proxy endpoints and potentially state-changing operations if invoked through the skill.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This file exposes a general-purpose ERP developerProxy wrapper even though the skill metadata says it should only support analytics for shop video performance. In this context, overbroad proxying is especially dangerous because the authorization model and backend token handling are abstracted away, so consumers may unknowingly gain a much larger API surface than intended.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script accepts an arbitrary `api` value from user-supplied JSON and forwards it to a generic analytics dispatcher, while the skill metadata says this skill is only supposed to expose the video-performance endpoint. That mismatch creates a scope-expansion risk: a caller may invoke undocumented analytics APIs through this skill, bypassing the intended least-privilege boundary and potentially accessing broader shop analytics data than users or orchestrators expect.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The module docstring explicitly describes this as a "generic registered API caller," which contradicts the manifest's narrow claim that the skill handles only video-performance analytics. On its own this is documentation drift, but in security-sensitive agent tooling it materially increases the chance that integrators or LLM agents will invoke broader functionality than intended, reinforcing the unsafe generic dispatch behavior.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script is presented as an analytics-only proxy, but its own help text explicitly permits `authorization/` paths, indicating broader capability than the skill claims. In a security-sensitive agent setting, this kind of generic path proxy can enable unintended access to authorization-related API surfaces through the ERP developer proxy, defeating least-privilege expectations and increasing the chance of misuse or privilege expansion.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The inline usage text contradicts the declared analytics-only purpose by advertising `authorization/` path support. Even if this file is only a thin wrapper, documentation that invites use of authorization endpoints materially increases the risk that downstream components expose non-analytics functionality and that operators or agents invoke higher-risk APIs under the false assumption that the skill is limited to analytics.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The skill metadata says this skill is for TikTok Shop analytics/video performance only, but this script exposes a separate authorized-shop lookup capability. That creates a scope mismatch: callers who are allowed to invoke analytics may also enumerate account/shop relationships, which can leak tenant or authorization metadata and expand the attack surface beyond the declared purpose.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The module is labeled as analytics, but the actual operation is authorized-shop lookup, which is misleading and can cause reviewers, operators, or policy engines to misclassify the data access being performed. Mislabeling reduces transparency and can allow sensitive account-discovery behavior to hide inside a seemingly harmless analytics skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.