ClawHub
Back to skill

Security audit

TikTok官方-店铺ERP授权

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent TikTok Shop authorization purpose, but it should be reviewed because it handles sensitive auth data while allowing credentialed calls to a configurable endpoint and saving auth-related responses locally.

Install only if you trust LinkFox and your runtime environment. Keep LINKFOX_TOOL_GATEWAY and TIKTOK_SHOP_API_BASE_URL unset or pinned to the trusted LinkFox gateway, protect the LinkFox API key, and treat the generated local linkfox response files as sensitive because they may include authorization links, shop identifiers, or diagnostic auth data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 48, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
)

    try:
        with urlopen(req, timeout=60) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
84% confidence
Finding
with urlopen(req, timeout=60) as response:

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
)

    try:
        with urlopen(req, timeout=60) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
with urlopen(req, timeout=60) as response:

Tainted flow: 'req' from os.environ.get (line 52, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
)

    try:
        with urlopen(req, timeout=60) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
92% confidence
Finding
with urlopen(req, timeout=60) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and operationally relies on network access, file writing, and likely environment-backed execution paths, but does not declare permissions or boundaries for those capabilities. This creates a transparency and governance gap: an agent may invoke scripts that access external services or persist sensitive OAuth/token data without an explicit permission model, increasing the chance of unintended data exposure or unsafe execution in downstream runtimes.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The helper unconditionally serializes and writes full API responses plus session metadata to local files under a predictable directory tree. In the context of a TikTok Shop ERP authorization/token-management skill, responses may contain OAuth codes, access tokens, refresh tokens, shop identifiers, or other sensitive account data, so persisting them to disk expands exposure far beyond the stated operational need and creates a durable secret-at-rest risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code writes complete response bodies to disk automatically and only prints a console message after the fact; there is no prior warning, consent, or control over whether sensitive data is stored. Given this skill handles TikTok Shop ERP OAuth and token lifecycle operations, silent persistence materially increases the chance of credential leakage, accidental collection of secrets, and later compromise by other local users, processes, backups, or support tooling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.