Security audit

TikTok官方-店铺商品

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent for TikTok Shop product management, but it needs Review because it can change or delete live storefront data and includes a broad developer-proxy escape hatch.

Install only if you want an agent to operate a live TikTok Shop ERP catalog through LinkFox. Prefer the named scripts over product_proxy.py, require explicit user approval before create/edit/delete/activate/deactivate/price/inventory changes, fetch current product data before edits, and do not set custom gateway environment variables unless the endpoint is trusted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: method="POST", ) try: with urlopen(req, timeout=120) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Confidence: 87% confidence
Finding: with urlopen(req, timeout=120) as response:

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes Python scripts, a network proxy endpoint, and shell-style commands, but the metadata does not declare equivalent permissions or safety boundaries. This creates a trust gap: an orchestrator or reviewer may treat the skill as low-risk while it can perform networked state-changing operations against shop data.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This file documents an authorization-adjacent API inside a product skill that explicitly claims it does not include authorization. Even if the endpoint only lists already-authorized shops, it exposes shop identifiers and ciphers and can enable skill misuse, prompt-routing confusion, or unauthorized expansion of capability beyond the declared scope.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The inline documentation states behavior that directly contradicts the manifest's statement that the skill does not include authorization. Such inconsistencies are security-relevant because agents may follow the more detailed inline instructions, causing them to invoke auth-related endpoints, retrieve shop ciphers, and bypass intended separation of duties between skills.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: `run_product_proxy` accepts arbitrary `path` and `method` and forwards them to `developer_proxy_call` with only a weak prefix check for `product/` to decide whether to inject `shop_cipher`. This bypasses the curated `PRODUCT_ENDPOINTS` allowlist and lets callers reach other ERP developerProxy routes under the product skill’s authority, expanding scope and potentially enabling unintended read/write operations against APIs not covered by this skill’s contract.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill exposes destructive operations such as delete/recover, activate/deactivate, price updates, and inventory changes, but the description lacks an explicit warning that these actions can alter live storefront state. In an agent setting, absent guardrails can lead to accidental or unauthorized business-impacting changes, especially because the API is designed for direct ERP mutation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This is a true safety vulnerability in the skill documentation because it exposes a full-replacement edit API whose omitted fields can overwrite existing product state, yet the skill-level wrapper does not prominently force a read-before-write workflow or explicit user confirmation. In an agent setting, ambiguous or partial user instructions could cause unintended data loss, listing corruption, or silent operational changes across a merchant catalog.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This is a true vulnerability because the documentation states that any existing SKU IDs omitted from the request will be deleted, but that destructive behavior is not surfaced as a strong operational warning for skill users. In an agent workflow, partial SKU updates are common, so a model or user could easily send an incomplete array and unintentionally delete variants, inventory mappings, pricing, and associated product options.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This is a true vulnerability because the docs describe that omitting listing platforms can deactivate and hide products on omitted platforms, which is a business-destructive side effect not highlighted as a major warning. Given this skill is for ERP product management, agents are likely to automate cross-platform edits, making accidental delisting from TikTok Shop or Tokopedia materially more dangerous in context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This is a true safety/documentation vulnerability because the skill exposes a partial-edit endpoint whose omitted SKU IDs cause permanent SKU deletion, but the skill-facing wrapper does not prominently warn operators before use. In an agent setting, sparse or generated request bodies are common; without an explicit guardrail, an agent can unintentionally send a partial SKU list and delete live variants, causing product loss, inventory disruption, and business impact.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This is a true vulnerability because the documentation states that `listing_platforms` controls visibility and omission of an active platform can deactivate and hide the product there, yet the skill-facing description does not present this as a high-risk operation. In an automation context, an agent may treat this as a routine partial update and accidentally unlist products from TikTok Shop or Tokopedia, causing immediate sales interruption.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents uploading arbitrary non-image product files to an external TikTok Shop service but does not clearly warn that those files may contain sensitive business, certification, or personal data. This can lead users or downstream agents to transmit confidential documents without informed consent or data-minimization controls, increasing risk of unintended data exposure to a third party.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.