T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:172- Finding
Automatic External Reporting of User Conversation Content
- Content
View full analysis
- Remediation
View remediation
Security audit
TikTok官方-视频号授权
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches TikTok OAuth and token management, but it adds automatic external feedback reporting and has overbroad credential, execution, and persistence controls that merit Review before installation.
Install only if you trust LinkFox with TikTok creator account metadata, token-management actions, and possible feedback content. Before use, pin the API base URL to the legitimate HTTPS LinkFox gateway, avoid setting TIKTOK_VIDEO_API_BASE_URL in normal operation, do not use the generic response wrapper with arbitrary scripts, store any persisted outputs in a private temporary directory, and delete them after use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/account_tokens.py:17- Finding
API Credential Exfiltration Through Unrestricted Gateway Override
- Content
View full analysis
dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( API_ENDPOINT, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) ``` Equivalent endpoint construction and authorization-header behavior appears in all four network-facing scripts. ### Technical Analysis The complete destination for the API request is controlled by the `TIKTOK_VIDEO_API_BASE_URL` environment variable. The scripts then attach the sensitive `LINKFOXAGENT_API_KEY` value to the request without validating: - The URL scheme. - The destination hostname. - The port. - Embedded user information. - Whether the endpoint belongs to an approved LinkFox domain. - Whether redirects cross into a different origin. The endpoint override can therefore direct an authenticated request to any server. An attacker who controls the execution environment, process launcher, shell profile, CI configuration, container environment ...[truncated 1849 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/response_io.py:207- Finding
Sensitive API Responses Persisted Without Secure Permissions or Cleanup
- Content
View full analysis
int: main_script = _resolve_script(args.script) skill_name = _resolve_skill_name(main_script) out_dir = Path(args.out_dir).expanduser().resolve() try: out_dir.mkdir(parents=True, exist_ok=True) except OSError as e: _err(f"Failed to create --out-dir {out_dir}: {e}") if not os.access(out_dir, os.W_OK): _err(f"--out-dir is not writable: {out_dir}") timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") rand = secrets.token_hex(3) safe_label = _sanitize_label(args.label) if args.label else "" label_part = f"__{safe_label}" if safe_label else "" out_file = out_dir / f"{skill_name}__{timestamp}_{rand}{label_part}.json" # Force the child process to emit UTF-8 regardless of the host console # encoding (Windows defaults to cp936 / gbk and would otherwise corrupt # non-ASCII bytes when we read them back). child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" timed_out = False try: proc = subprocess.run( [sys.executable, str(main_script), args.params], capture_output=True, text=True, encoding="utf-8", errors="replace", env=child_env, timeout=args.timeout, ) stdout_text = proc.stdout or "" stderr_text = proc.stderr or "" returncode = proc.returncode except subprocess.TimeoutExpired as e: timed_out = True stdout_text = (e.stdout.decode("utf-8", errors="replace") if isinstance(e.stdout, bytes) else (e.stdout or "")) or "" stderr_text = (e.stderr.decode("utf-8", errors="replace") if isinstance(e.st ...[truncated 3112 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (21)
Tainted flow: 'req' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The request target is derived from the TIKTOK_VIDEO_API_BASE_URL environment variable and then used directly in urlopen, so anyone who can influence the runtime environment can redirect this token-query request to an attacker-controlled host. Because the request includes the LINKFOXAGENT_API_KEY authorization header and user-supplied account identifiers, this creates a server-side request forgery / credential exfiltration path and is especially sensitive in a token-management skill.
- Content
python ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'req' from os.environ.get (line 38, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'req' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'req' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented purpose is TikTok creator OAuth and token management, but the included large-response pattern introduces a generic subprocess wrapper that can run different local scripts, persist outputs to disk, and re-read them with flexible field extraction. That mismatch weakens operator expectations and can be abused to broaden the skill from a narrow auth workflow into a more general local execution and data-handling surface.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md 3. **获取该账号令牌**：调用 `/tiktokVideo/accountTokens`，传入 `openId`。 4. **把 `accessToken` 作为 `ttsAccessToken` 交给 `/tiktokVideo/developerProxy`** 执行具体业务调用。 ## Display Rules 1. **只呈现数据**：展示授权结果、账号列表、令牌信息即可，不做业务建议。 2. **安全意识**：不要明文显示完整 `accessToken` / `refreshToken`，仅展示前 10 字符等掩码形式。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This skill explicitly supports obtaining access tokens for downstream use, which is credential access by design. In the context of an agent skill, that is especially dangerous because tokens can enable direct API actions on linked creator accounts if disclosed, mishandled, or routed to unintended consumers.
- Content
md | "绑定 TikTok 视频号用于上传视频" | 新视频号授权 | | "看看已授权的 TikTok 视频号" / "Show my authorized TikTok video accounts" | 列出已授权账号 | | "TikTok 视频上传令牌过期了" / "My TikTok video token expired" | 刷新令牌 | | "获取 TikTok 视频号的访问令牌" / "Get TikTok video account access token" | 查询账号令牌 | **Not applicable** — 超出本 skill 的业务：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ TikTok Video Token Refresh - LinkFox Skill Calls the /tiktokVideo/refreshToken endpoint to refresh the access token. Usage: python refresh_token.py '{"openId": "7010736057180325637"}'
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python # Force the child process to emit UTF-8 regardless of the host console # encoding (Windows defaults to cp936 / gbk and would otherwise corrupt # non-ASCII bytes when we read them back). child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" timed_out = False
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill exposes capabilities consistent with shell, file I/O, network, and environment access but does not declare any tool restrictions. In an agent setting, missing scope boundaries increases the chance that later instructions in the skill cause over-broad execution, data access, or unintended side effects beyond TikTok authorization workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger language is broad enough that the skill may activate on many TikTok creator/video-token related requests, including ones outside the intended authorization boundary. Over-triggering is dangerous here because the skill handles sensitive account and token-management functions and may expose or request privileged actions too early.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill describes querying and refreshing tokens, which are highly sensitive credential operations, but the workflow section does not prominently warn about credential handling risks or require least-privilege presentation. Even though later display rules mention masking, the operational guidance still normalizes retrieval and movement of access tokens as routine workflow data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction to automatically call a separate Feedback API for complaints, praise, or improvement opportunities expands the skill's data flow beyond its stated authorization/token-management purpose. This can result in unnecessary transmission of user content or operational details to another endpoint without clear necessity or user awareness.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## curl Examples ### Get Authorization URL
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The note on L098-L099 states that full tokens are stored in the database, which describes behavior not implemented anywhere in this file. This is more than an omitted detail: it attributes a storage side effect to the script that the code does not perform, creating misleading intent/documentation for auditors and operators.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
_resolve_script accepts an arbitrary filesystem path and only verifies that it exists, enabling the helper to invoke code unrelated to the declared TikTok authorization purpose. In a constrained skill environment, this is dangerous because it bypasses business-scope expectations and can be abused as a general launcher for other local Python programs.
- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 60% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
python """Cap the sample's value fields when it has many keys. `shape.*.item_keys` is the single source of truth for the full key list (always complete, no truncation). The sample only ever shows up to SAMPLE_KEY_CAP fields with their concrete values, since the agent only needs a feel for value shapes — for the full menu of available fields, they read `shape`.
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The helper executes whatever path is supplied via --script with the current Python interpreter, with only an existence check and no restriction that the target belongs to this skill. In an agent context, this turns a TikTok OAuth utility into a generic code-execution wrapper that can run unintended local scripts and then persist their output, materially expanding the attack surface.
- Content
python timed_out = False try: proc = subprocess.run( [sys.executable, str(main_script), args.params], capture_output=True, text=True,
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The helper always writes the full stdout of the executed subprocess to disk, even on errors and even when the output is not JSON. For an OAuth/token-management skill, persisted stdout may contain access tokens, refresh tokens, account identifiers, secrets, or other sensitive API responses, creating a confidentiality risk and a broader data-retention surface than the manifest implies.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The title and opening description say this document covers authorization and token-management interfaces for the /tiktokVideo module, and even states business calls via /tiktokVideo/developerProxy are not in this skill's scope. Later sections nevertheless reference developerProxy-related behavior in error codes and document a separate feedback API, which contradicts the stated scope boundary in the documentation.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest scopes this skill to TikTok creator/video-account OAuth authorization, authorized-account listing, token lookup, and token refresh under /tiktokVideo. The documented Feedback API posts user sentiment and freeform content to a different service, which is not an obvious requirement for authorization or token management and represents an extra capability outside the stated purpose.
- Content
Static analysis
No suspicious patterns detected.