TikTok官方-店铺履约

• Outcome: Review
• Latest audit: Jul 30, 2026 · 12:25 PM UTC
• Version: 1.0.0

Overview

This skill mostly fits a TikTok Shop fulfillment use case, but it exposes broader seller-account API forwarding than its narrow split-attributes description promises.

Install only if you intend this skill to access TikTok Shop seller fulfillment data through LinkFox. Prefer a version that removes or gateway-restricts the generic proxy to the documented read-only split-attributes endpoint and, if needed, a clearly documented shop-cipher lookup. Treat shop_cipher and shop identifiers as sensitive operational data and avoid logging or sharing them unnecessarily.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is advertised as narrowly focused on Get Order Split Attributes, but the documentation exposes a generic proxy and authorization-domain access that can reach a broader set of TikTok Shop APIs. This kind of scope mismatch is dangerous because users and policy layers may grant trust based on the narrow description while the skill can perform materially broader actions against seller account data and operations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Documentation says the skill is for a specific split-attributes API, but it also declares a generic forwarding interface for wider Fulfillment and Authorization APIs. Even with a whitelist, this expands the operational surface beyond what users expect and can enable unintended access patterns or future drift into more sensitive operations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The manifest explicitly states authorization is not included, yet the skill exposes a public get_authorized_shops path in the authorization domain. This is dangerous because it undermines separation of duties between skills and may let a fulfillment-scoped skill enumerate or access shop authorization data that operators did not intend to expose through this interface.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The inline documentation tells users the skill does not include authorization, while another section allows authorization/ as an approved proxy path. Contradictory security-relevant documentation increases the chance of misuse, hidden privilege expansion, and faulty review decisions, especially where gateway tokens are retrieved automatically from backend storage.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file documents an authorization/shop-listing API inside a skill whose manifest explicitly says authorization is out of scope and should be handled by a different skill. That scope drift is dangerous because it can cause the agent to invoke unintended capabilities, enumerate authorized shops, and expose shop identifiers/cipher values in a fulfillment context where the user did not request authorization data.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The inline mapping labels the authorization API as part of '本 skill', directly contradicting the manifest's statement that authorization is not included. This inconsistency can mislead tooling or operators into treating an auth-related endpoint as approved for this skill, increasing the chance of unauthorized data access or confused-deputy behavior across skills.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The generic `run_fulfillment_proxy` function accepts arbitrary `path` and `method` values and forwards them to `/tiktokShop/developerProxy`, effectively exposing any ERP fulfillment endpoint reachable by the backend rather than limiting calls to the skill's declared purpose of Get Order Split Attributes. In this skill context, that mismatch is especially dangerous because users and downstream tooling may trust the manifest scope, while the code can access broader fulfillment operations using the caller's `openId` and auto-resolved `shop_cipher`.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code forwards `str(method).upper()` directly from user-controlled input, enabling arbitrary HTTP verbs against fulfillment endpoints. That broadens the attack surface from a read-only order-split lookup into potentially state-changing operations if such endpoints exist behind the same proxy, which is unjustified for a skill advertised as a single query capability.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The function is documented as a 'Generic proxy: path + method + openId (+ optional shop_cipher)' and then automatically resolves `shop_cipher` for any `fulfillment/` path, which materially expands access convenience and scope. While the docstring itself is not the core bug, the implementation hides a broader capability than the skill metadata suggests, increasing the likelihood of misuse and incorrect trust assumptions during review or orchestration.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The registry exposes an extra capability, `get_authorized_shops`, that is outside the skill’s declared fulfillment split-attributes scope. Even if the endpoint is legitimate, this creates unnecessary authority and enables shop enumeration, increasing data exposure and the chance the skill is used for unintended discovery of tenant/shop metadata.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Authorized-shop enumeration is not justified by a skill advertised as only performing order split-attribute queries, so it represents overbroad capability. In an agent setting, hidden or undocumented enumeration functions are risky because they can be invoked to map accessible shops and facilitate later misuse against broader commerce workflows.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script accepts an arbitrary "api" value from JSON input and forwards it to a generic fulfillment API runner, while the skill metadata says this skill should only handle the split-attributes endpoint. That mismatch expands the reachable API surface beyond what users, reviewers, and policy controls would expect, creating a confused-deputy risk where an attacker can invoke other registered fulfillment operations using the skill's existing authorization context.

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: The module docstring explicitly describes a "generic registered API caller," which conflicts with the manifest's representation of a narrowly scoped split-attributes skill. Even if this line is only documentation, such scope ambiguity is security-relevant because it signals and reinforces an over-broad design that can mislead auditors and integrators about what the skill is capable of doing.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This wrapper exposes a generic fulfillment proxy by accepting arbitrary JSON and forwarding it to run_fulfillment_proxy with user-controlled path and method, while the skill manifest claims a much narrower purpose: Get Order Split Attributes only. That mismatch can enable unintended access to broader fulfillment or adjacent endpoints, increasing the attack surface and making policy bypass or unauthorized operations more likely if downstream validation is incomplete.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The usage text explicitly whitelists both fulfillment/ and authorization/ paths even though the skill metadata states that authorization is not included and should be handled by a different skill. This inconsistency signals possible scope creep and may let callers route requests into auth-related APIs through a skill that users and reviewers would not expect to have that capability.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This script exposes authorized-shop retrieval functionality even though the skill description says authorization and shop selection belong to a different skill. That creates a scope mismatch that can let callers enumerate or access shop authorization context through an unexpected interface, weakening separation of duties and increasing the chance of unauthorized data access or policy bypass.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module docstring says it fetches shop_cipher for fulfillment APIs, which contradicts the manifest's claim that authorization and shop selection are handled elsewhere. In a security-sensitive integration, this kind of hidden capability is dangerous because operators, reviewers, or automated systems may trust the manifest and miss an endpoint that reveals authorization-related shop identifiers.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The documentation describes returning authorized shop metadata and shop cipher values without any caution about sensitivity, minimization, or redaction. In this skill context, that omission matters because shop cipher and authorization-linked identifiers can be mishandled in logs, prompts, or downstream steps, making cross-shop access workflows easier to abuse.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.