Security audit

tiktok-android-720p

Security checks for vulnerabilities and agentic risk

Overview

This TikTok automation skill mostly matches its stated purpose, but its publish and input-handling behavior can delete phone videos or execute unintended commands on a connected Android device.

Install only after reviewing the code and preferably after removing the publish-mode camera cleanup, adding strict input validation for ADB shell commands, and replacing executable config.py/plaintext .env secret handling. Do not run publish mode on a personal phone or logged-in account containing media you care about unless the deletion behavior has been fixed and you have backups.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: tiktok_bot.py:445
Finding: Android Shell Command Injection Through the Video URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/bot/android/tiktok_navigation.py:64
Finding: Android Shell Command Injection Through Search Topics
Content: View full analysis
str: """Execute ADB shell command.""" try: result = subprocess.run( ["adb", "-s", self.device_id, "shell", command], capture_output=True, text=True, timeout=timeout ) return result.stdout.strip() ``` ### Technical Analysis Search topics originate from the command-line `--topics` argument and reach `search_query()` without a restrictive validation step. Replacing spaces with `%s` is an input-method formatting transformation, not shell escaping. It leaves shell metacharacters such as semicolons, quotes, command substitutions, redirection operators, and newlines available for interpretation. Because `_adb_shell()` sends the complete string to `adb shell`, Android's command interpreter can treat attacker-controlled portions of the topic as additional commands. ### Attack Path 1. The attacker invokes search mode or controls a topic supplied to it. 2. A crafted topic containing Android shell syntax is passed through `args.topics`. 3. `search_query()` only replaces spaces with `%s`. 4. The crafted topic is concatenated with `input text`. 5. `_adb_shell()` submits the complete command to `adb shell`. 6. Android's shell interprets the injected operators and executes the appended command. ### Impact As ...[truncated 472 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: setup.py:224
Finding: Arbitrary Host-Side Python Execution Through Generated Configuration
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: tiktok_bot.py:427
Finding: Publish Mode Deletes Unrelated Camera Videos
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: setup.py:255
Finding: AI API Keys Are Written to a Plaintext File Without Enforced Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Dependencies Are Installed Without Upper Bounds, Locking, or Integrity Hashes
Content: View full analysis
=0.7.0 anthropic>=0.18.0 openai>=1.12.0 ``` ### Technical Analysis Each dependency uses only a minimum-version constraint. A future installation can therefore resolve to versions that were not reviewed with this project, including releases with breaking behavior or newly introduced vulnerabilities. The requirements file also contains no integrity hashes or lock data. Package authenticity is delegated entirely to the configured Python package index and transport environment. No evidence was found that the listed package names are typosquatted or intentionally malicious. The confirmed issue is the lack of reproducible and integrity-checked dependency resolution, not a confirmed compromise of the named packages. ### Attack Path 1. A user runs `pip install -r requirements.txt`. 2. The resolver selects the newest versions satisfying the lower bounds. 3. A future vulnerable, compromised, or incompatible release is selected without a project review. 4. Package installation or import exposes the host process to the affected dependency behavior. A separate package-index compromise, malicious mirror, or dependency-account takeover would increase the likelihood of this path. ### Impact Assessment Potential impact depends on the behavior of a selected dependency release. Python dependencies execute in the bot's host process and can therefore access: - Files available to the invoking user. - Environment variables, including AI API keys. - Network resources available to the host. - The project runtime and connected ADB devices. This finding alone does not demonstrate current arbitrary code execution or a known malicious installed version. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (65)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The documented command rm -f /sdcard/DCIM/Camera/*.mp4 performs broad deletion of all MP4 files in a common camera directory on the device. In the context of an ADB automation skill operating on a real user's phone, this is dangerous because it can irreversibly remove unrelated personal videos, and the README presents it as part of the normal workflow without strong safeguards or scoping.
Content: Scanner excerpt · README.md (reported line 362)May include surrounding context.
md
### 发布流程 1. **清理相册** → `rm -f /sdcard/DCIM/Camera/*.mp4` 2. **下载/上传** → curl 或 adb push 3. **媒体扫描** → `MEDIA_SCANNER_SCAN_FILE` 广播 4. **选择视频** → 点击第一个帧

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This finding includes a materially dangerous, undeclared destructive behavior: publish mode reportedly deletes existing .mp4/.3gp files under /sdcard/DCIM/Camera. In the context of an Android automation skill, undocumented destructive file cleanup can cause irreversible loss of user media and is especially risky because the skill already normalizes shell/ADB access and automated actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This finding includes a materially dangerous, undeclared destructive behavior: publish mode reportedly deletes existing .mp4/.3gp files under /sdcard/DCIM/Camera. In the context of an Android automation skill, undocumented destructive file cleanup can cause irreversible loss of user media and is especially risky because the skill already normalizes shell/ADB access and automated actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding includes a materially dangerous, undeclared destructive behavior: publish mode reportedly deletes existing .mp4/.3gp files under /sdcard/DCIM/Camera. In the context of an Android automation skill, undocumented destructive file cleanup can cause irreversible loss of user media and is especially risky because the skill already normalizes shell/ADB access and automated actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding includes a materially dangerous, undeclared destructive behavior: publish mode reportedly deletes existing .mp4/.3gp files under /sdcard/DCIM/Camera. In the context of an Android automation skill, undocumented destructive file cleanup can cause irreversible loss of user media and is especially risky because the skill already normalizes shell/ADB access and automated actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding includes a materially dangerous, undeclared destructive behavior: publish mode reportedly deletes existing .mp4/.3gp files under /sdcard/DCIM/Camera. In the context of an Android automation skill, undocumented destructive file cleanup can cause irreversible loss of user media and is especially risky because the skill already normalizes shell/ADB access and automated actions.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.py (reported line 124)May include surrounding context.
python
# Ask for API key print(f"\n📝 Enter your {provider_name.upper()} API key") print("(This will be stored in .env file, not committed to git)") api_key = ask_text(f"API key")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.py (reported line 255)May include surrounding context.
python
# Ask for API key print(f"\n📝 Enter your {provider_name.upper()} API key") print("(This will be stored in .env file, not committed to git)") api_key = ask_text(f"API key")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.py (reported line 258)May include surrounding context.
python
# Save AI API key to .env if AI mode if comment_style == "ai" and ai_config: env_content = "" if os.path.exists(".env"): with open(".env", 'r') as f: env_content = f.read()

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.py (reported line 259)May include surrounding context.
python
# Save AI API key to .env if AI mode if comment_style == "ai" and ai_config: env_content = "" if os.path.exists(".env"): with open(".env", 'r') as f: env_content = f.read()

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.py (reported line 275)May include surrounding context.
python
# Save AI API key to .env if AI mode if comment_style == "ai" and ai_config: env_content = "" if os.path.exists(".env"): with open(".env", 'r') as f: env_content = f.read()

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: This line writes the user-supplied API key into a plaintext .env file, which can expose credentials to other local users, backups, shell tooling, or accidental inclusion in project artifacts if file hygiene is poor. In the context of a bot that integrates paid AI providers, compromise of the API key can lead to unauthorized API usage, billing abuse, and indirect access to prompts or generated content.
Content: Scanner excerpt · setup.py (reported line 272)May include surrounding context.
python
lines = [l for l in env_content.split('\n') if not l.startswith(f"{key_name}=")] lines.append(f"{key_name}={ai_config['api_key']}") with open(".env", 'w') as f: f.write('\n'.join(lines)) print(f"✓ Saved API key to .env")

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: publish_video claims to publish a caller-specified local file but ignores video_path and instead selects the first album item on the device. That mismatch can cause unintended or sensitive media to be posted, which is especially dangerous in a social-media automation skill where publication is externally visible and difficult to undo.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring states that video_path determines the video to publish, but the implementation never uses it. This deceptive interface can mislead upstream automation into believing a safe asset is being posted when the bot may actually publish unrelated gallery content, creating a serious integrity and privacy risk.
Content: No source excerpt is available for this finding.

os.system() or os exec-family call

High

Category: Dangerous Code Execution
Confidence: 85% confidence
Finding: The script executes python3 setup.py via os.system, which invokes an external file from the current working directory without validating its path or integrity. If a user runs this tool from an untrusted directory or the setup script is replaced, arbitrary local code will execute under the user's privileges.
Content: Scanner excerpt · tiktok_bot.py (reported line 51)May include surrounding context.
python
response = input("Run interactive setup now? [Y/n]: ").strip().lower() if response in ['', 'y', 'yes']: print("\nStarting setup wizard...\n") os.system("python3 setup.py") if not os.path.exists("config.py"): print("\n❌ Setup was not completed. Exiting.") sys.exit(1)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill claims TikTok interaction and publishing, but publish mode silently performs bulk deletion of device camera videos beforehand. That undisclosed destructive capability materially increases risk because operators may not realize the tool can erase unrelated user media on the connected phone.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Publish mode deletes all videos in the device camera folder without any confirmation prompt. Because this is a destructive operation on user-owned media, lack of explicit confirmation materially increases the chance of accidental irreversible loss.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using rm -f /sdcard/DCIM/Camera/*.mp4 through ADB is tool abuse because it applies a broad wildcard deletion to a sensitive user media directory. In context, a TikTok publishing workflow does not need blanket deletion of all camera videos, so this creates disproportionate destructive capability.
Content: Scanner excerpt · tiktok_bot.py (reported line 433)May include surrounding context.
python
print(f"\n🧹 Cleaning up all videos in DCIM/Camera...") # Delete all video files except .thumbnails folder subprocess.run( ["adb", "-s", device_id, "shell", "rm -f /sdcard/DCIM/Camera/*.mp4"], capture_output=True, timeout=10 )

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This repeats the same destructive pattern for .3gp files, enabling mass deletion of user recordings. The skill context makes it more dangerous because users may connect a personal phone expecting TikTok automation, not media wiping.
Content: Scanner excerpt · tiktok_bot.py (reported line 438)May include surrounding context.
python
timeout=10 ) subprocess.run( ["adb", "-s", device_id, "shell", "rm -f /sdcard/DCIM/Camera/*.3gp"], capture_output=True, timeout=10 )

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README documents destructive behavior in publish mode, including clearing album content and deleting media after posting, without prominent warnings about data loss scope. In a skill that automates ADB commands on a real device, insufficient disclosure can cause users to unintentionally erase local media or publish/delete the wrong files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L483-L488 的完整示例展示了 interact --videos 3 --like --favorite --comment --topics travel，并声称会先搜索 travel 再互动。可是在 L210-L213 与 L215-L221，README 明确说明互动模式从推荐页开始，且 --topics 仅适用于 search_mode，这构成了文档内部对代码/行为意图的直接矛盾。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents capabilities that imply shell, environment-variable, and file access but does not declare any tool scope or permission boundaries. In an agent setting, this creates an authorization gap: consumers cannot tell what tools the skill expects, and a host may expose broader capabilities than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The AI comment feature says Claude/GPT-4/OpenRouter may perform visual analysis of video content, but the document does not warn that screenshots, frames, or metadata could be transmitted to third-party AI providers. In this context, the skill handles potentially sensitive personal or copyrighted content, so lack of a privacy disclosure meaningfully increases user exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The publish workflow states that it will 'clean the album' and later 'clean up' without a prominent warning about deletion impact. In a mobile-device context, destructive media deletion can remove personal content unrelated to the automation task, making this a genuine safety/security issue even if the intent is operational convenience.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · run_complete_session.py (reported line 27)May include surrounding context.
python
device_id = os.environ.get("ANDROID_DEVICE_ID") if not device_id: # Auto-detect first connected device result = subprocess.run(["adb", "devices"], capture_output=True, text=True) devices = [line.split()[0] for line in result.stdout.split("\n")[1:] if line.strip() and "device" in line] if not devices: print("❌ No Android device found. Connect device and enable USB debugging.")

Static analysis

No suspicious patterns detected.