ClawHub
Back to skill

Security audit

Keyapi Tiktok Content Analysis

Security checks for vulnerabilities and agentic risk

Overview

This TikTok analytics skill is not clearly malicious, but it needs Review because it persists secrets and cached data locally while exposing broader MCP and server-routing authority than its stated purpose requires.

Install only if you are comfortable giving this skill a KeyAPI token, storing TikTok/API results on local disk, and using a generic KeyAPI MCP runner. Prefer setting KEYAPI_TOKEN only in the process environment, avoid the interactive prompt that writes .env, keep KEYAPI_SERVER_URL unset unless you fully trust the endpoint, and periodically remove .keyapi-cache and any .env file you do not intend to retain.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/run.js:59
Finding

Bearer Token Can Be Redirected to an Arbitrary Server

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run.js:242
Finding

Interactive API Token Is Persisted in Plaintext Without Explicit Permission Hardening

Content
View full analysis
.env" ); } const { createInterface } = await import("readline"); const rl = createInterface({ input: process.stdin, output: process.stderr }); return new Promise((resolve, reject) => { process.stderr.write("\nKEYAPI_TOKEN is required. Get yours at https://keyapi.ai/\n\n"); rl.question("Enter your token: ", (answer) => { rl.close(); const token = answer.trim(); if (!token) { reject(new Error("No token entered. Set KEYAPI_TOKEN and try again.")); return; } const envPath = join(ROOT, ".env"); writeFileSync(envPath, `KEYAPI_TOKEN=${token}\n`, "utf8"); log(`[token] Saved to ${envPath} — future runs will load it automatically`); process.env.KEYAPI_TOKEN = token; resolve(token); }); }); } ``` ### Technical Analysis When a user enters a token interactively, the script automatically writes it to `.env` in plaintext. The call does not specify a restrictive file mode, so the effective permissions depend on the process umask and existing file permissions. If `.env` already exists with broad permissions, overwriting its contents does not necessarily correct those permissions. The supplied project also has no visible `.gitignore` protecting `.env`, creating an additional risk of accidental source-control inclusion. Although local token persistence is described as an option in the help text, automatically persisting an interactively enter ...[truncated 1204 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:5
Finding

Dependency Installation Is Not Reproducibly Locked

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is presented as a TikTok analytics helper, but its instructions expose broader meta-capabilities: listing tools, inspecting arbitrary schemas, generic MCP invocation, local caching, pagination, and file output. This mismatch increases risk because a user or agent may trust the declared narrow purpose while the actual workflow enables more general API exploration and local side effects than advertised.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md
node scripts/run.js --list-tools

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md
node scripts/run.js --list-tools

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.js (reported line 45)May include surrounding context.

js
const __dirname = dirname(fileURLToPath(import.meta.url));
const ROOT = resolve(__dirname, "..");

// ── .env loader ───────────────────────────────────────────────────────────────

(function loadDotenv() {
  const envPath = join(ROOT, ".env");

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.js (reported line 106)May include surrounding context.

js
const __dirname = dirname(fileURLToPath(import.meta.url));
const ROOT = resolve(__dirname, "..");

// ── .env loader ───────────────────────────────────────────────────────────────

(function loadDotenv() {
  const envPath = join(ROOT, ".env");

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.js (reported line 240)May include surrounding context.

js
const __dirname = dirname(fileURLToPath(import.meta.url));
const ROOT = resolve(__dirname, "..");

// ── .env loader ───────────────────────────────────────────────────────────────

(function loadDotenv() {
  const envPath = join(ROOT, ".env");

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.js (reported line 247)May include surrounding context.

js
const __dirname = dirname(fileURLToPath(import.meta.url));
const ROOT = resolve(__dirname, "..");

// ── .env loader ───────────────────────────────────────────────────────────────

(function loadDotenv() {
  const envPath = join(ROOT, ".env");

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.js (reported line 48)May include surrounding context.

js
// ── .env loader ───────────────────────────────────────────────────────────────

(function loadDotenv() {
  const envPath = join(ROOT, ".env");
  if (!existsSync(envPath)) return;
  for (const line of readFileSync(envPath, "utf8").split("\n")) {
    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$/);

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.js (reported line 248)May include surrounding context.

js
// ── .env loader ───────────────────────────────────────────────────────────────

(function loadDotenv() {
  const envPath = join(ROOT, ".env");
  if (!existsSync(envPath)) return;
  for (const line of readFileSync(envPath, "utf8").split("\n")) {
    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$/);

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This line writes the bearer token to a plaintext .env file in the project root. In the context of a reusable skill, that creates a concrete secret-exposure risk because the token can be recovered by other local users/processes, included in backups, or accidentally committed to source control.

Content

Scanner excerpt · scripts/run.js (reported line 262)May include surrounding context.

js
reject(new Error("No token entered. Set KEYAPI_TOKEN and try again."));
        return;
      }
      const envPath = join(ROOT, ".env");
      writeFileSync(envPath, `KEYAPI_TOKEN=${token}\n`, "utf8");
      log(`[token] Saved to ${envPath} — future runs will load it automatically`);
      process.env.KEYAPI_TOKEN = token;

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill requires privileged capabilities via environment access (KEYAPI_TOKEN) and execution of node scripts/run.js, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and transparency, making it easier for the skill to invoke broader local execution or tool functionality than a reviewer or runtime might expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill mandates persistent local caching of retrieved TikTok content, comments, captions, analytics, live-stream details, and downloaded images under .keyapi-cache/ without warning about data retention or sensitivity. Writing third-party content and analytics to disk can create privacy, compliance, and data-leakage risks, especially on shared workstations, CI runners, or multi-tenant agent environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script is a generic MCP tool runner that can list schemas and invoke any server-exposed tool by name, not just tools needed for TikTok content analysis. In a skill context, that creates capability overreach: a user invoking this skill may unknowingly grant access to a much broader operation set than the manifest describes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The runner accepts an arbitrary --platform value and builds the server URL dynamically, even though the skill is described as TikTok content analysis. This scope expansion can expose users to unreviewed capabilities and data flows on other platforms, undermining least-privilege and making the skill behave more broadly than advertised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.