Security audit

TikTok官方-带货视频API

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits TikTok video publishing workflows, but it includes automatic external feedback reporting, broad credential-bearing network configuration, and a generic local script runner that warrant Review before installation.

Install only if you are comfortable granting this skill access to LinkFox and TikTok creator credentials, authenticated creator/video operations, and local response files. Before use, avoid setting TIKTOK_VIDEO_API_BASE_URL except to a trusted HTTPS LinkFox gateway, require explicit confirmation before publishing a video or sending feedback, keep response_io.py output outside repositories, delete saved responses promptly, and verify the auth dependency source/version before installing it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:220
Finding: Silent Automatic Disclosure of User Feedback to an External Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/_tiktok_video_common.py:15
Finding: Configurable Gateway Can Exfiltrate LinkFox and TikTok Credentials
Content: View full analysis
dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` ```python def developer_proxy_call( tts_access_token: str, path: str, method: str, region: Optional[str] = None, query_string: Optional[str] = None, body: Optional[str] = None, content_type: str = "application/json", ) -> dict: assert_path_allowed(path) proxy: dict[str, Any] = { "path": path.lstrip("/"), "method": method, "ttsAccessToken": tts_access_token, } if region: proxy["region"] = str(region) if query_string: proxy["queryString"] = query_string if body is not None: proxy["body"] = body proxy["contentType"] = content_type return call_api(DEVELOPER_PROXY_ENDPOINT, proxy) ``` The duplicate implementation in `video_proxy.py` has the same behavior: ```python API_BASE_URL = os.environ.get( "TIKTOK_VIDEO_API_BASE_URL", "https://tool-gateway.linkfox.com" ) API_ENDPOINT = f"{API_BASE_URL.rstrip('/')}/tiktokVideo/devel ...[truncated 1852 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/response_io.py:69
Finding: Response Helper Executes Arbitrary Local Python Files
Content: View full analysis
Path: p = Path(script_arg).expanduser() if not p.is_absolute(): # Resolve relative to the current working directory the agent invoked from. p = (Path.cwd() / p).resolve() else: p = p.resolve() if not p.is_file(): _err(f"--script path not found: {p}") return p ``` ```python def cmd_run(args: argparse.Namespace) -> int: main_script = _resolve_script(args.script) skill_name = _resolve_skill_name(main_script) out_dir = Path(args.out_dir).expanduser().resolve() try: out_dir.mkdir(parents=True, exist_ok=True) except OSError as e: _err(f"Failed to create --out-dir {out_dir}: {e}") ``` ```python child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" proc = subprocess.run( [sys.executable, str(main_script), args.params], capture_output=True, text=True, encoding="utf-8", errors="replace", env=child_env, timeout=args.timeout, ) ``` ### Technical Analysis The helper is documented as a wrapper for Skill entry scripts, but `_resolve_script` accepts any existing local file. It does not require the file to be under the current Skill directory and does not enforce an allowlist of approved entry points. The selected file is executed with the current Python interpreter. The subprocess inherits the complete parent environment, including `LINKFOXAGENT_API_KEY`, endpoint overrides, and any other credentials present in environment variables. This behavior exceeds the minimum privilege required to persist responses from known Skill scripts. ### Attack Path 1. An attacker creates or identifies a malicious Python file accessible to the Agent. 2. Prompt manipulation or unsafe user input causes the Agent to invoke: ...[truncated 842 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/response_io.py:202
Finding: Sensitive API Responses Are Persisted Without Confidentiality or Retention Controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/check_auth_dependency.py:113
Finding: External Authentication Skill Is Recommended Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tainted flow: 'req' from os.environ.get (line 69, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/video_proxy.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared skill purpose is TikTok video operations, but the documented large-response utility can execute arbitrary specified scripts, persist outputs to disk, and parse/read saved files in multiple formats. That creates a capability expansion beyond the stated business function, which can be abused to run unintended local programs or exfiltrate sensitive response data through generic file-processing flows.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
python scripts/video_api.py '{"api": "<api_name>", "openId": "..."}'

text
## Display Rules 1. **只呈现数据**：展示接口返回字段，不做主观建议。 2. **令牌安全**：不输出完整 `ttsAccessToken`。

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/response_io.py (reported line 223)May include surrounding context.
python
# Force the child process to emit UTF-8 regardless of the host console # encoding (Windows defaults to cp936 / gbk and would otherwise corrupt # non-ASCII bytes when we read them back). child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" timed_out = False

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no explicit tool/permission scope even though its instructions invoke shell, filesystem, network, and environment-capable scripts. In an agent setting, missing scope boundaries increases the chance that the runtime grants broader capabilities than users expect, enabling unintended command execution, local file access, or outbound data transmission if the skill is triggered or modified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description lists a very large mix of phrases and then broadens activation further with '也应触发', including generic concepts like '预检结果', 'precheck', and '查视频是否发布成功'. This makes it unclear where the skill should not activate and lacks negative examples or tighter scope constraints, increasing the chance of accidental invocation for adjacent TikTok-related requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to automatically submit feedback whenever certain conditions occur, without requiring user notice or consent and while explicitly avoiding interruption of the main flow. Because feedback may contain user interaction details, this creates a covert outbound data-sharing channel and can leak PII, business context, or sensitive operational metadata.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document states open/{version}/file/init and open/{version}/file/bind do not go through LinkFox because open/ is not in the whitelist, but the same file's endpoint inventory lists large_file_upload_init and large_file_upload_bind with concrete open/... paths and says the whitelist allows only affiliate_creator, video, and creator. This is an active internal contradiction about whether these named APIs are part of the skill's reachable behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents an API that performs irreversible external posting to a third-party platform but does not prominently require explicit user confirmation immediately before execution. In agent-driven environments, that raises the risk of accidental or unauthorized publication of content under a user's authorized creator account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation uses normative language encouraging AI-generated-content labeling selection rather than leaving the decision to the user's actual content and compliance obligations. This can bias an agent into making policy-significant declarations on behalf of the user, which may create mislabeling, compliance, or account-trust issues on the external platform.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 1103)May include surrounding context.
md
--- ## curl Examples ### developerProxy（直接调用网关）

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown instructs users to PUT video binary data directly to an external file gateway URL, including use of the full returned URL with query parameters. Because the behavior transmits user content off-platform and bypasses the noted proxy, the description should explicitly warn users about the external network transfer and handling of upload URLs/tokens.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/large-file-upload.md (reported line 106)May include surrounding context.
PUT 示例（单片 / 末片）

bash
curl --location --request PUT '{upload_url}' \ --header 'Content-Type: video/mp4' \ --header 'Content-Range: bytes 0-9999999/50000000' \ --header 'Content-Length: 10000000' \

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/_tiktok_video_common.py (reported line 36)May include surrounding context.
python
print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr) sys.exit(DEPENDENCY_EXIT_CODE) try: result = subprocess.run( [sys.executable, str(checker)], capture_output=True, text=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code accesses the sensitive environment variable LINKFOXAGENT_API_KEY and then sends it in the Authorization header of an HTTP request. While there is an error message when the key is missing, there is no comment, docstring, or user-facing disclosure in this file warning that credentials will be read from the environment and transmitted to a remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: call_api POSTs JSON payloads to remote endpoints, and callers pass values such as openId, ttsAccessToken, request paths, query strings, regions, and optional bodies. The file contains no user-facing warning, confirmation, or explanatory comment that these inputs may be sent to tool-gateway.linkfox.com or another configured base URL.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: For non-GET methods, the code builds an arbitrary request body from params and transmits it via developer_proxy_call. This is a network operation that may send user-provided or system-derived data, but the file contains no confirmation, visible disclosure, or explanatory comment warning about that behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code resolves account tokens and uses the resulting access token in a network call to developerProxy, which is a safety-relevant credential and data-transmission operation. While the module docstring states the file runs a TikTok Video API, there is no user-facing print/log/confirmation or inline warning here about credential use or outbound transmission.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 60% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · scripts/response_io.py (reported line 175)May include surrounding context.
python
"""Cap the sample's value fields when it has many keys. `shape.*.item_keys` is the single source of truth for the full key list (always complete, no truncation). The sample only ever shows up to SAMPLE_KEY_CAP fields with their concrete values, since the agent only needs a feel for value shapes — for the full menu of available fields, they read `shape`.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/response_io.py (reported line 228)May include surrounding context.
python
timed_out = False try: proc = subprocess.run( [sys.executable, str(main_script), args.params], capture_output=True, text=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The helper launches whatever script path is supplied through --script, which is a subprocess execution capability. Although this is central to the tool's purpose, the file provides no runtime confirmation or explicit caution that invoking run will execute another program, which is a safety-relevant action for a generic helper.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The helper always writes captured stdout to disk, including full API responses, but provides no data-classification guardrails, redaction, retention control, or user-facing warning about sensitive content. In this skill context, API responses may include access tokens, creator profile data, product data, or upload/publish metadata, so persisting raw responses increases the chance of local secret exposure and unintended data retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code packages user-supplied parameters including ttsAccessToken and optional request body into a JSON request and sends them to a remote gateway via urlopen. Although the module docstring documents required parameters, there is no runtime confirmation, warning, or user-facing notice that sensitive token and payload data will be forwarded to an external service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a skill for TikTok video upload and related creator/video/product-selection operations via /tiktokVideo/developerProxy, explicitly excluding authorization. This file additionally documents a separate skill-api.linkfox.com feedback submission API, which is unrelated to TikTok creator/video operations and not justified by the stated business purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill content forces a specific language for all instructions and operational guidance, and no opt-in or alternative language is offered. Under the stated policy, language constraints should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tainted flow: 'req' from os.environ.get (line 69, credential/environment) → urllib.request.urlopen (network output)

Tp4

Direct Prompt Extraction

Env Variable Harvesting

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Natural-Language Policy Violations

External Transmission

Missing User Warnings

External Transmission

PUT 示例（单片 / 末片）

subprocess module call

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Unbounded Output

subprocess module call

Missing User Warnings

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Natural-Language Policy Violations

Static analysis