ClawHub
Back to skill

Security audit

Keyapi Tiktok Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its TikTok analytics purpose, but it gives a generic KeyAPI MCP runner broader reach than the title suggests and can save an API token to a plaintext local file without an opt-in step.

Install only if you trust KeyAPI and are comfortable with a broad MCP helper. Prefer setting KEYAPI_TOKEN through your environment or a secret manager instead of typing it into the prompt, avoid KEYAPI_SERVER_URL overrides unless you control the server, keep use to the intended TikTok tools, and delete .env and .keyapi-cache when they are no longer needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding
The skill description scopes behavior to TikTok trend intelligence, but the documented workflow includes generic MCP enumeration (`--list-tools`), schema inspection, and effectively arbitrary tool invocation via `--tool <tool_name>`. That broad capability can let the skill reach beyond its declared purpose, increasing the risk of unintended data access, use of unrelated tools, and user surprise about what external actions may occur.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The script allows the caller to override `--platform` and constructs the MCP endpoint from that value, so the skill can operate against non-TikTok KeyAPI platforms despite the manifest describing TikTok-only intelligence. This creates a scope-expansion/deceptive-capability issue: users or higher-level agents may trust the skill as narrowly scoped when it can query broader data sources and endpoints.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The runner explicitly advertises that it can call any KeyAPI MCP tool and accepts an arbitrary `--tool` name, rather than restricting execution to TikTok trend-intelligence functions. In an agent-skill context, this is dangerous because the actual capability surface is much broader than the declared purpose, enabling unintended data access or actions via undisclosed server tools.

Context-Inappropriate Capability

Low
Confidence
90% confidence
Finding
When `KEYAPI_TOKEN` is missing, the script interactively prompts for it and persists it to a local `.env` file automatically. Persisting credentials beyond the current session increases the chance of accidental disclosure through local file exposure, repo inclusion, backups, or permissive filesystem access, and is not necessary for one-shot analytics execution.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill sends user-supplied queries and identifiers to `https://mcp.keyapi.ai`, but the description does not prominently warn users that their inputs will be transmitted to a third-party service. This can expose sensitive business queries, product ideas, or identifiers without informed user consent, especially in enterprise or regulated contexts.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs local caching of API responses into predictable filesystem paths, including keyword, product, ad, and trend data, without warning users that potentially sensitive research history will be stored on disk. Persistent local storage can expose intelligence data to other local users, backups, logs, or later unintended reuse beyond the expected session.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script writes a sensitive API token to `.env` immediately after interactive entry, without an explicit consent step or warning at the point of collection that it will be stored on disk. That is a real security/privacy issue because users may expect transient use, while the code silently creates a reusable local credential artifact that could later be exposed.

Credential Access

High
Category
Privilege Escalation
Content
reject(new Error("No token entered. Set KEYAPI_TOKEN and try again."));
        return;
      }
      const envPath = join(ROOT, ".env");
      writeFileSync(envPath, `KEYAPI_TOKEN=${token}\n`, "utf8");
      log(`[token] Saved to ${envPath} — future runs will load it automatically`);
      process.env.KEYAPI_TOKEN = token;
Confidence
95% confidence
Finding
This line writes the entered API token directly to a plaintext `.env` file in the project directory, creating a reusable credential artifact on disk. If the workspace is shared, backed up, exposed through logs/tooling, or accidentally committed, the token can be recovered and abused to access the KeyAPI account.

Static analysis

No suspicious patterns detected.