TikTok-视频号商品

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 1.0.4

Overview

This product-query skill includes disclosed product lookup code, but it also bundles credential onboarding, API-key issuance, billing/order creation, plaintext key setup, endpoint overrides, and automatic feedback reporting that need review before use.

Install only if you trust LinkFox with TikTok creator product data, account onboarding data, API keys, and billing interactions. Prefer using a dedicated auth/billing skill or first-party LinkFox site for login and payments, avoid endpoint override environment variables, do not store API keys in shell startup files, and review any feedback payload before allowing it to be sent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:115

Finding

Automatic External Feedback Reporting Without Explicit User Consent

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/onboarding.py:358

Finding

Bundled Authentication, Credential Issuance, and Payment Operations Exceed the Product-Query Scope

Content

View full analysis

dict: resp = _login_post("/user/v3/web/login", { "type": "sms", "method": "login", "systemId": "LinkFoxAgent", "data": {"areaCode": "+86", "authPhone": phone, "authCode": code, "sourceChannel": channel or "skill"}, }) if "_error" in resp: return {"error": f"login: {resp.get('_body') or resp['_error']}"} if not (resp.get("success") or resp.get("code") == "OK"): return {"error": f"login: {resp.get('message') or json.dumps(resp, ensure_ascii=False)}"} data = resp.get("data") or {} access_token, user_id = data.get("accessToken"), data.get("userId") if not access_token or not user_id: return {"error": f"login: 响应缺 accessToken/userId: {json.dumps(resp, ensure_ascii=False)}"} return { "access_token": access_token, "refresh_token": data.get("refreshToken", "") or "", "user_id": str(user_id), "nick_name": data.get("userName", ""), "is_new_user": bool(data.get("newUser") or data.get("isFirstRegister")), } def _login_by_token(access_token: str, refresh_token: str) -> dict: """新用户送积分。失败不阻断。""" resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkf ...[truncated 4142 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_tiktok_video_products_common.py:15

Finding

Environment-Controlled Destinations Can Receive API Keys and Account Tokens

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Sensitive onboarding endpoints are also environment-controlled: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ### Technical Analysis No validation enforces HTTPS, approved LinkFox hostnames, expected ports, or safe path structure for these overrides. Consequently, any process or launcher capable of setting the relevant environment variables can redirect requests containing: - `Authorization` API keys. - Phone numbers and SMS codes. - Access tokens. - Refresh tokens. - U ...[truncated 1395 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:478

Finding

Full API Keys Are Printed and Recommended for Plaintext Persistence

Content

View full analysis

dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: 手机号格式不正确: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: 验证码格式不正确: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}（不影响拿 key）", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token(lg["access_token"], lg["user_id"], info["group_id"]) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The command handler serializes the full result to standard output: ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The documentation recommends storing the key ...[truncated 1720 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:164

Finding

Unpinned Runtime Dependency Installation Guidance

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The installation instructions do not specify versions, hashes, a lockfile, or a trusted package index. Package resolution therefore depends on the user's current pip configuration and the latest compatible releases available at installation time. No evidence was found that the named packages are typosquatted or malicious. The confirmed weakness is the absence of reproducible, integrity-verified dependency management. ### Attack Path 1. The required module is missing. 2. The user follows the runtime installation instruction. 3. pip resolves an unpinned package from the configured package index or mirror. 4. A compromised index, dependency account, mirror, or future package release supplies unsafe code. 5. Package installation or later import executes that code in the user's environment. ### Impact Assessment A compromised Python dependency can execute with the privileges of the user running pip or the Skill. This could expose environment variables, including LinkFox API keys, modify local files, or affect subsequent Skill execution. The practical likelihood is lower when using the official Python Package Index and well-known packages, but the build remains non-reproducible and lacks integrity guarantees. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The requests target URL is derived from environment-controlled base URLs, so anyone who can influence the runtime environment can redirect SMS login, token exchange, and user-info traffic to an attacker-controlled endpoint. Because these requests carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this creates a realistic credential exfiltration and SSRF-style risk.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL used by urllib is also built from environment-controlled base configuration, allowing redirection of authenticated API calls to arbitrary hosts. Those calls include the agent API key in the Authorization header and support account, package, and order operations, so endpoint tampering can leak secrets and enable unauthorized actions against attacker-chosen services.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The manifest explicitly says the skill does not handle authorization, yet this code performs SMS verification, login, refresh-token handling, user/team discovery, and API-token generation. In this context, the auth functionality is especially dangerous because it covertly collects authentication factors and emits usable API keys, enabling account compromise and privilege expansion under the guise of a harmless product-query skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a specific TikTok API integration, but the detected behavior includes arbitrary local script execution via subprocess, writing outputs to arbitrary directories, and generic data extraction utilities. Arbitrary script execution is a high-risk primitive: it can be repurposed to run attacker-chosen code, access local data, and pivot into broader system compromise under the cover of an innocuous business workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a specific TikTok API integration, but the detected behavior includes arbitrary local script execution via subprocess, writing outputs to arbitrary directories, and generic data extraction utilities. Arbitrary script execution is a high-risk primitive: it can be repurposed to run attacker-chosen code, access local data, and pivot into broader system compromise under the cover of an innocuous business workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a specific TikTok API integration, but the detected behavior includes arbitrary local script execution via subprocess, writing outputs to arbitrary directories, and generic data extraction utilities. Arbitrary script execution is a high-risk primitive: it can be repurposed to run attacker-chosen code, access local data, and pivot into broader system compromise under the cover of an innocuous business workflow.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

首次请求不传 `page_token`；若响应含 `data.next_page_token`，将其作为下一次请求的 `page_token` 继续拉取。详见 `references/api.md`。

## Display Rules

1. **只呈现数据**：展示接口返回字段，不做主观选品建议。
2. **令牌安全**：不向用户索要或展示 raw token。

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata explicitly says it does not include authorization, yet this file instructs operators to use the skill’s own onboarding script to resolve auth failures and obtain API keys. That mismatch is dangerous because it can mislead users and downstream systems about the skill’s true privileges, causing unauthorized credential collection and trust-boundary violations.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements a full onboarding and monetization CLI—SMS login, API-key issuance, plan listing, order creation, and payment QR generation—which is unrelated to the declared TikTok product-query skill. The mismatch is dangerous because it expands the skill into credential handling and billing flows users and reviewers would not expect, increasing the chance of covert account takeover, secret harvesting, or unauthorized purchases.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Billing and payment-order creation are unjustified for a skill whose declared purpose is querying TikTok product lists. Embedding purchase flows in an unrelated skill creates a hidden capability to initiate financial transactions and render payment artifacts, which can be abused for unauthorized charges or social-engineering users into paying through attacker-influenced flows.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/response_io.py (reported line 223)May include surrounding context.

python

# Force the child process to emit UTF-8 regardless of the host console
    # encoding (Windows defaults to cp936 / gbk and would otherwise corrupt
    # non-ASCII bytes when we read them back).
    child_env = os.environ.copy()
    child_env["PYTHONIOENCODING"] = "utf-8"

    timed_out = False

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill declares no explicit tool or permission scope even though its documented and inferred behavior involves shell, filesystem, environment, and network capabilities. That creates an over-privileged execution surface: downstream agents may invoke powerful operations without a clear least-privilege boundary, increasing the chance of misuse or prompt-induced abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest-style description says the skill triggers when the user mentions phrases like “可带货商品”, “视频挂车选品”, and “查询达人可推广商品”. These phrases are fairly broad in normal e-commerce discussion and the file does not provide exclusion conditions or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file describes POST requests to an external gateway and instructs callers to supply both an API key and a creator access token, but it does not include any warning about sending credentials or request data to third-party services. Under the markdown-specific SQP-2 criteria, documentation should disclose behaviors that may affect user data or privacy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file adds account onboarding, login, API key setup, and billing/payment flows to a skill whose declared purpose is only querying TikTok product lists. This expands the skill’s effective capability into credential handling and purchases, creating unnecessary attack surface and increasing the chance an agent collects secrets or initiates financial actions outside user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the operator to collect a user’s phone number and use it for send-code and login flows, but there is no explicit privacy notice, consent language, retention policy, or warning about handling personal data. In an agent setting, this creates a real risk of over-collection of sensitive information and improper processing of account-recovery or registration data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_tiktok_video_products_common.py (reported line 36)May include surrounding context.

python

print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr)
        sys.exit(DEPENDENCY_EXIT_CODE)
    try:
        result = subprocess.run(
            [sys.executable, str(checker)],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The helper constructs and sends POST requests to external endpoints, including request parameters and an Authorization header derived from an environment variable. While the code handles errors, it provides no user-facing print/log/comment warning that data will be transmitted to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This function packages potentially sensitive user or account-related fields such as openId, request path, query string, and body, then sends them to the developer proxy endpoint. The operation is not accompanied by a confirmation prompt, user-visible notice, or explanatory comment warning about remote transmission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module advertises itself as a LinkFox onboarding CLI rather than a TikTok product-query helper, directly contradicting the published skill purpose. Such a mismatch is a strong indicator of deceptive packaging: reviewers may approve one capability while the deployed code performs a broader and more sensitive workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The login command prints the generated API key to stdout JSON, which is commonly captured by host logs, transcripts, agent tool histories, or downstream automation. Exposing long-lived credentials in normal command output materially increases the chance of secret leakage and unauthorized reuse.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/response_io.py (reported line 175)May include surrounding context.

python

"""Cap the sample's value fields when it has many keys.

    `shape.*.item_keys` is the single source of truth for the full key list
    (always complete, no truncation). The sample only ever shows up to
    SAMPLE_KEY_CAP fields with their concrete values, since the agent only
    needs a feel for value shapes — for the full menu of available fields,
    they read `shape`.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/response_io.py (reported line 228)May include surrounding context.

python

timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), args.params],
            capture_output=True,
            text=True,

Static analysis

No suspicious patterns detected.