Security audit

TikTok官方-店铺售后

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed TikTok Shop integration, but it exposes broader authenticated shop and return/refund proxy access than its narrow reject-reason description suggests.

Review this skill before installing if you only want a narrow reject-reason lookup. It can use an authenticated TikTok Shop ERP context to list authorized shops and proxy broader authorization/return_refund API calls, so install it only where that broader access is acceptable and the gateway environment is trusted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: method="POST", ) try: with urlopen(req, timeout=120) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Confidence: 85% confidence
Finding: with urlopen(req, timeout=120) as response:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill advertises itself as limited to fetching TikTok reject reasons, but the content reveals broader capabilities: authorized shop enumeration, a generic registered API caller, and a generic proxy over whitelisted authorization/ and return_refund/ paths. This mismatch is dangerous because users, reviewers, or orchestrators may grant trust or invoke the skill under a narrower security assumption, while the implementation can reach additional sensitive ERP endpoints and potentially expand into unintended read or write operations.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata says the capability is limited to reject-reason retrieval, but the reference also documents an additional `get_authorized_shops` API under `authorization/202309/shops`. This scope mismatch can enable unintended data access or capability expansion by downstream agents or users who rely on the reference rather than the manifest, weakening least-privilege boundaries.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation explicitly states the skill 'does not include authorization,' yet the API index includes an authorization endpoint. Contradictory security-relevant documentation can cause agents to invoke sensitive authorization-related functionality under false assumptions, creating confused-deputy behavior and expanding accessible account/shop metadata beyond the declared business purpose.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This file documents and maps an authorization-related API that lists all shops a seller has authorized, despite the skill being declared as limited to Return/Refund reject-reason retrieval and explicitly excluding authorization features. That scope mismatch can enable unintended data access paths and confuse downstream agents or operators into invoking a broader-permission API than users expect, exposing seller/shop metadata and shop cipher values.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The inline mapping explicitly says the authorization API is part of '本 skill', directly contradicting the manifest's statement that the skill does not include authorization. In an agent setting, such contradictory instructions are dangerous because tooling may trust local API mappings over higher-level metadata, causing the skill to perform unauthorized scope expansion and access seller authorization/shop data.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The generic `run_return_refund_proxy` function forwards caller-supplied `path` and `method` directly to `developer_proxy_call`, which allows access to arbitrary ERP developerProxy endpoints instead of only the declared Get Reject Reasons capability. Because it also reuses the authenticated `openId` context and may auto-resolve `shop_cipher` for `return_refund/*` paths, a caller can broaden this skill into an unintended general-purpose TikTok Shop return/refund proxy, enabling unauthorized reads and potentially write operations if upstream permits them.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Allowing arbitrary `method` and `path` in a skill whose metadata says it only retrieves reject reasons is a capability mismatch that creates an authorization boundary bypass at the skill layer. An attacker or misbehaving agent can invoke unrelated ERP APIs, including state-changing operations, under the shop's authenticated context, which is especially risky because the code performs no functional scoping beyond checking that `openId` exists.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The docstring describes a seemingly limited generic proxy with optional `shop_cipher`, but the implementation automatically treats any `return_refund/` path as needing shop context and resolves `shop_cipher` from authorized shops. This implicit credential-context expansion makes the skill more dangerous in context, because a caller does not need to supply the shop cipher to reach broader return/refund APIs, lowering friction for misuse beyond the advertised read-only reject-reasons function.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script exposes an authorized-shop lookup capability even though the skill metadata says the skill only handles reject-reason retrieval and does not include authorization-related behavior. This scope mismatch is dangerous because it can create an undocumented data-access path, enabling enumeration of shops tied to an openId and bypassing user or platform expectations about what the skill is allowed to do.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module is labeled as return_refund functionality, but its actual operation is authorized-shop discovery, which obscures the real behavior of the code. Mislabeling reduces review effectiveness and can hide sensitive data-access features inside an apparently unrelated skill, increasing the chance that risky functionality is deployed without proper scrutiny.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script advertises a path whitelist that includes `authorization/`, which conflicts with the skill metadata stating that authorization is out of scope. In a generic proxy design, documented acceptance of authorization-related paths can enable unintended access to broader TikTok Shop ERP endpoints if the downstream runner honors or loosely validates the path.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The file presents itself as a generic path/method proxy for return_refund APIs rather than a narrowly scoped wrapper for the documented reject-reasons read operation. That mismatch increases the attack surface because callers may be able to invoke additional read or write endpoints by supplying arbitrary `path` and `method` values, bypassing the principle of least privilege intended by the skill manifest.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: On dependency failure, the script emits a full list of searched roots derived from environment variables, the current workspace, and the user's home directory. This can disclose local filesystem layout and usernames to logs or callers, which is unnecessary for normal users and can aid reconnaissance in shared or remotely observable environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.