ClawHub
Back to skill

Security audit

TikTok官方-店铺物流仓库

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its TikTok Shop logistics purpose, but it includes a broad credentialed proxy that can call more than the warehouse-list workflow users may expect.

Install only if you trust LinkFox and need an ERP TikTok Shop logistics integration. Treat logistics_proxy.py as a powerful advanced path: use the named get_warehouse_list and get_authorized_shops scripts for normal work, avoid overriding the gateway URL unless you control it, and avoid exposing outputs that include local paths or shop/warehouse contact details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
85% confidence
Finding
with urlopen(req, timeout=120) as response:

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill claims to be limited to logistics warehouse listing and to exclude authorization, but it also exposes generic proxying and authorization-related shop discovery flows. This mismatch weakens trust boundaries: callers or orchestration layers may permit the skill under narrower assumptions, while in practice it can reach additional endpoints and retrieve broader shop/account metadata than expected.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The generic `run_logistics_proxy` entrypoint accepts attacker-controlled `path`, `method`, `queryString`, and `body` and forwards them directly to `developer_proxy_call`, effectively exposing a broad SSRF-like internal API client to any caller of the skill. Although it still requires `openId` and may auto-resolve `shop_cipher` for `logistics/` paths, the skill is advertised as a narrow warehouse-list skill, so this generic proxy materially expands reachable backend functionality beyond the intended scope and without user-facing disclosure or allowlisting.

Missing User Warnings

Low
Confidence
89% confidence
Finding
When the dependency is missing, the script emits absolute or near-absolute local filesystem paths from searchedRoots and the discovered SKILL.md path to stderr and optional JSON output. This can disclose workstation, home-directory, or workspace layout information to logs, calling systems, or downstream users, which is unnecessary for normal end-user operation and can aid reconnaissance in multi-tenant or hosted environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.