Security audit

TikTok Business

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for reading TikTok Business data through OOMOL, but its first-time setup tells users to run unverified remote installer scripts directly in a shell.

Install only if you are comfortable using OOMOL as the intermediary for TikTok Business data and you review or replace the installer flow with a safer, verified installation method. Do not paste the curl-to-bash or PowerShell iex commands blindly; prefer an official signed package, pinned release, or locally reviewed installer.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:69
Finding: Unverified Remote Installer Scripts Executed Directly by Shell
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk: if the server, CDN, DNS, TLS trust chain, or script content is compromised, arbitrary code will run immediately on the host without inspection.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description uses the blanket phrase "for ANY TikTok Business request," which is extremely broad and lacks constraints or exclusions. This can overlap with many ordinary requests involving TikTok Business and may cause unintended invocation because the file does not provide negative examples or narrower trigger scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest on L03 frames the skill as read-only data access, and the safety section says untagged actions are reads. However, L19 instructs the agent to fall back to setup actions when commands fail, and the setup section later includes oo auth login, which performs an authentication/account operation rather than searching or reading TikTok Business data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.