Product Differentiation Tiktok

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:00 PM UTC
• Version: 0.1.0

Overview

The skill appears low-risk at runtime, but its advertised TikTok Shop analysis is not actually implemented and its install command pulls a mutable global installer/source.

Review carefully before installing. The bundled script is a local generic product/review analyzer, not the TikTok Shop viral/content/creator analytics tool described. If you install it anyway, prefer a pinned, verified source and avoid global installation unless you trust the installer and repository maintainers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Installer and Skill Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Supply-chain risk from unpinned third-party dependencies
Risk Level: Medium

bash

npx skills add nexscope-ai/eCommerce-Skills --skill product-differentiation-tiktok -g

Technical Analysis

The documented installation command invokes the skills npm package through npx without specifying an exact reviewed version. It also installs skill content from nexscope-ai/eCommerce-Skills without pinning the source to an immutable commit or otherwise documenting integrity verification.

Consequently, the code retrieved and used by this command can change after this skill has been reviewed. This creates a supply-chain trust gap: compromise of the npm package, its publishing account, the external repository, or its maintainers could cause users to retrieve and run content different from the audited version. The global installation option (-g) can increase the affected scope within the invoking user's environment.

The audited scripts/analyzer.py itself does not retrieve remote payloads or execute subprocesses. The issue is specifically the unsafe installation instruction, not embedded malicious behavior in the analyzer.

Attack Path

1. An attacker compromises the npm package, its publisher account, the referenced repository, or another relevant upstream distribution channel.
2. The attacker publishes or substitutes a malicious release or modifies the repository content.
3. A user follows SKILL.md:16 and runs the unpinned npx command.
4. npx resolves the package available at execution time rather than a previously reviewed exact version.
5. The installation process retrieves the mutable external skill source and installs it globally.
6. Malicious upstream installation logic or skill content executes with the privileges of the invoking user or is made available for later invocation.

Impact Assessment

Successful exploitation could permit arbitrary code exec ...[truncated 536 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm installer package to an exact, reviewed version rather than relying on implicit latest-version resolution:

   bash

   npx skills@<reviewed-exact-version> ...
   

2. Pin the external skill source to a verified immutable commit or release identifier supported by the installer.
3. Publish and verify cryptographic integrity information for downloaded artifacts, such as SHA-256 hashes or signed release attestations.
4. Avoid global installation unless it is operationally necessary. Prefer an isolated, least-privileged environment or project-local installation.
5. Document the expected package version, repository commit, artifact hash, and verification procedure.
6. Re-audit dependency updates before changing any pinned version or source commit.
7. Use trusted registries and repository protections such as multi-factor authentication, protected releases, signed commits or tags, and restricted publishing permissions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description emphasizes TikTok Shop intelligence and social/content analytics, but the supplied code only performs a conventional product comparison and review-keyword analysis workflow. It analyzes structured product fields and review text to extract pain points and selling points, then suggests positioning and differentiation strategies. There is no code for ingesting TikTok Shop data, scraping or analyzing videos/posts, computing engagement metrics, assessing virality, examining affiliate behavior, or generating creator collaboration insights. The primary purpose is therefore materially different from the declared TikTok-focused functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a TikTok Shop differentiation tool that analyzes viral product trends, competitor affiliate strategies, content performance, creator collaboration insights, and TikTok-specific metrics. This file's documented features and implemented logic only cover generic product comparison, review keyword extraction, pricing/rating comparison, and positioning recommendations, with no TikTok entities, content metrics, trend signals, affiliate analysis, or viral-performance logic.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The installation command uses npx skills without pinning an exact version, which can cause users to execute whatever package/version is currently resolved from the registry at install time. This creates a supply-chain risk: a compromised upstream package, typosquat, or unexpected breaking update could run arbitrary code on the user's machine during installation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest implies the skill can analyze TikTok Shop trends and competitor/content signals without an API key, which still requires some form of TikTok data sourcing. The analyze pipeline only consumes caller-provided product and review objects and never fetches or processes TikTok Shop/content data, so the claimed end-user capability is not actually implemented here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code includes a built-in locale switch that changes the report language, and the default is English unless a specific flag is supplied. Because the file does not force a single language unconditionally and does expose an explicit opt-in flag, this is only a weak policy concern rather than a clear violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.