Security audit

TikTok官方-视频号授权

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its TikTok authorization purpose, but it adds automatic external feedback reporting and sensitive token-handling workflows that should be reviewed before installation.

Install only if you are comfortable giving this skill access to your LinkFox API key and TikTok creator authorization workflows. Review or disable the automatic Feedback API behavior, avoid persisting responses unless needed, use a temporary non-repository directory, and delete saved response files after use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares no permissions while its instructions clearly rely on shell execution, network calls, environment access, and file read/write via local scripts and response persistence. This mismatch weakens review and containment because operators and downstream tooling cannot accurately assess the skill's true capabilities or apply least-privilege controls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill's description frames behavior as authorization and token management, but the body explicitly retrieves stored accessToken and refreshToken material and includes a generic response_io wrapper that can execute arbitrary selected scripts and persist outputs. That broader behavior increases the chance of covert credential access or misuse beyond the advertised OAuth helper role.

Context-Inappropriate Capability

Medium

Confidence: 77% confidence
Finding: The Feedback API instruction adds an unrelated outbound reporting path that is not necessary for TikTok authorization or token management. Extra exfiltration-capable network behavior increases attack surface and creates opportunities to send user context, account metadata, or failure details to another endpoint without clear need.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs persisting full API responses to disk and warns those responses may contain auth-sensitive data. Writing token-bearing responses to local files materially increases the risk of credential leakage through insecure temp directories, later reuse by other tools, accidental retention, or commit/exposure.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The trigger conditions are broad enough to activate on many requests involving TikTok authorization or token handling, which increases the chance the skill runs in unintended contexts. Because this skill can enumerate accounts and retrieve token material, over-triggering can expose sensitive operations where a narrower skill or explicit confirmation should have been used.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The reference documents endpoints that return full accessToken and refreshToken values in example responses. In an agent setting, this creates a realistic risk that an assistant will echo, log, or otherwise expose long-lived credentials to end users or downstream systems, enabling account takeover or unauthorized API use if mishandled.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The helper always persists full subprocess stdout to disk, even when that output may contain OAuth tokens, account identifiers, or other sensitive API response data. In this skill context, which explicitly manages TikTok authorization and token retrieval/refresh, disk persistence materially increases the risk of credential exposure through local file access, backups, logs, or later accidental disclosure.

Static analysis

No suspicious patterns detected.