TikTok-视频号商品

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 1.0.4

Overview

The product lookup feature is real, but the skill also includes account login, API-key generation, and payment order flows that require careful review before installation.

Install only if you are comfortable with a LinkFox skill that can do more than product lookup: it can help create or retrieve a LinkFox API key by SMS login, inspect paid plans, create payment orders, render payment QR codes, and save full API responses locally. Before using it, verify the environment variables for LinkFox endpoints point to trusted LinkFox domains, avoid sharing SMS codes unless you intentionally choose the onboarding path, and treat any printed API key or saved response file as sensitive.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive login data and tokens to them via requests.post. In a skill environment, env vars may be controlled by the host, wrapper, or deployment, so this creates SSRF-style exfiltration risk where SMS codes, access tokens, refresh tokens, and generated API keys could be posted to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway URL is derived from environment variables and used in urllib.request.urlopen with the Authorization header set from LINKFOX_AGENT_API_KEY. If an attacker can influence deployment environment variables, the CLI will send the API key and other request data to an arbitrary server, enabling credential theft and unauthorized downstream actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill advertises executable scripts with shell, file, environment, and network capabilities, but the manifest text does not declare or constrain those permissions. Undeclared capabilities reduce transparency and make it harder for a host agent or reviewer to enforce least privilege, increasing the chance that sensitive local data or network access is used unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is limited to TikTok product lookup, yet the analyzed behavior reportedly includes account login, API key generation, billing plan retrieval, payment order creation, QR-code payment flows, and order-status queries. That is a major scope expansion into identity and financial operations, which can expose users to unauthorized account actions or purchases if the skill is auto-invoked under the benign product-query description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements onboarding, SMS login, API-key acquisition, subscription browsing, and ordering, which materially exceed the manifest's stated purpose of querying TikTok product lists. Such scope expansion is dangerous because users invoking a product-query skill may unknowingly trigger account, token, or billing workflows unrelated to the advertised function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code includes package listing, order creation, and payment QR generation even though the skill is described as a TikTok product-query helper. Hidden billing capability increases the risk of unauthorized purchases, phishing-like payment collection, and user deception because payment flows are outside expected skill behavior.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The skill performs SMS-based authentication, token exchange, team selection, and API-token generation despite the metadata explicitly stating that authorization is not included. In context, this is especially dangerous because it can harvest phone numbers, OTPs, access tokens, refresh tokens, and mint long-lived API credentials under the guise of a harmless product-query skill.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger list contains many broad natural-language phrases, making accidental or overbroad activation more likely. When a skill has networked scripts and possible hidden account/payment behaviors, loose triggering increases the risk that unrelated user requests invoke sensitive functionality without clear intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The onboarding flow instructs the operator to collect a user's phone number and pass it to a local script for registration/login, but it provides no privacy notice, consent language, retention guidance, or warning about handling personal data. This creates a real privacy and compliance risk because sensitive personal information may be solicited and transmitted without clear disclosure or minimization controls.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The login flow returns a fresh API key in stdout JSON, which is commonly captured by logs, orchestration layers, transcripts, or calling agents. Exposing credentials through standard output significantly raises the chance of accidental disclosure and account compromise, especially in multi-tenant or agent-mediated environments.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The tool always persists full child-process stdout to disk and even advertises the saved file path, but it does not clearly warn that API responses may contain tokens, PII, shop data, or other sensitive business records. In this skill ecosystem, product/search APIs and adjacent auth-linked workflows make disk persistence more sensitive because downstream outputs may include account-linked or proprietary data that remains on disk longer than intended.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: External transmission is expected for a networked skill, but here the transmission includes sensitive auth material and targets a URL that may be environment-controlled. In this context the danger is not mere egress, but credential-bearing egress to potentially untrusted destinations.

Static analysis

No suspicious patterns detected.