OpenQuok TikTok Slideshow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:44 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it claims, but it needs review because it handles API keys, uploads prompts/reference images to third-party providers, can create social posts, and recommends an unpinned installer from mutable sources.

Review before installing. Prefer pinning the installer and Git commit, keep config.json out of source control, use environment variables or a secret manager for provider keys, and avoid uploading sensitive real-person or proprietary reference images unless you accept the provider privacy implications. Confirm OpenQuok is set to private draft or your intended posting mode before running the post script.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Installation from Mutable External Sources

Content

View full analysis

Remediation

View remediation

add ... ``` 2. Replace the mutable `main` branch URL with an immutable release tag or, preferably, a full commit SHA. 3. Publish cryptographic checksums or signed release artifacts and verify them before installation. 4. Document the exact expected repository commit and installer version for each Skill release. 5. Avoid automatically accepting changes with `-y` when interactive verification is practical. 6. Review the resolved package and Skill contents before executing scripts, particularly after upgrading. 7. Consider distributing the Skill through a signed, versioned package registry release rather than directly from a mutable repository branch. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.js:52

Finding

Image Provider API Key Stored in Plaintext Workspace Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on end-to-end TikTok carousel creation and publishing. The supplied code is solely a local research-data management script for channel/competitor analysis. It manages channel-research.json, supports summary/add-account/gaps commands, and handles a legacy file format migration. This is a materially different primary purpose from media generation and publishing, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description presents a broader end-to-end TikTok slideshow workflow: research, lock character, generate frames, overlay text, and draft or schedule publishing through openquok. The supplied code chunk implements only one subset of that workflow: generating six raw slide images from prompts. It reads config and prompt files, loads an optional character profile and reference images, calls external image APIs, and writes image files to disk. There is no code for TikTok posting, openquok CLI invocation, scheduling, text overlay rendering, or research. While locked-character image generation is accurately represented, the overall description materially overstates the capabilities of this specific code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

Interactive installs: Project scope + **Copy**. Hermes: copy the **full** skill folder (URL install of `SKILL.md` alone omits `scripts/`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

wsing. Find 3–5 accounts in the niche: hooks, formats, sounds, gaps. Save with `scripts/competitor-research.js` → `channel-research.json`. Guide: [references/co

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md

wsing. Find 3–5 accounts in the niche: hooks, formats, sounds, gaps. Save with `scripts/competitor-research.js` → `channel-research.json`. Guide: [references/co

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

node scripts/generate-slides.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md

node scripts/generate-slides.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

node scripts/post-via-openquok.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

node scripts/post-via-openquok.js \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

Using npx skills without pinning an exact package version introduces supply-chain risk: a future or compromised package release could execute attacker-controlled code during installation. Because this is an install command presented to users, it expands trust to the latest registry state at execution time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The markdown explicitly links to a guide about warming up a TikTok account to reach a US audience, which imposes a specific regional targeting assumption in the workflow. The file does not offer the user a choice of locale/region or explain that the skill is limited to US-targeted campaigns only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script sends full prompts and, when configured, face/body reference images to external image-generation providers. In this skill context, those assets can include personally identifying biometric-style data or proprietary character assets, and the script provides no explicit user-facing consent, warning, or minimization before transmission.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The OpenAI edits call uploads prompt text plus attached reference images to a third-party service. Because this skill is specifically designed to 'lock' a character using face/body references, the transmission may include sensitive images or proprietary media, increasing privacy and data-governance risk if users are not clearly informed.

Content

Scanner excerpt · scripts/generate-slides.js (reported line 186)May include surrounding context.

js

const blob = new Blob([buf], { type: 'image/png' });
      form.append('image[]', blob, path.basename(ref));
    }
    const res = await fetch('https://api.openai.com/v1/images/edits', {
      method: 'POST',
      headers: { Authorization: `Bearer ${apiKey}` },
      body: form,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The OpenAI edits call uploads prompt text plus attached reference images to a third-party service. Because this skill is specifically designed to 'lock' a character using face/body references, the transmission may include sensitive images or proprietary media, increasing privacy and data-governance risk if users are not clearly informed.

Content

Scanner excerpt · scripts/generate-slides.js (reported line 186)May include surrounding context.

js

const blob = new Blob([buf], { type: 'image/png' });
      form.append('image[]', blob, path.basename(ref));
    }
    const res = await fetch('https://api.openai.com/v1/images/edits', {
      method: 'POST',
      headers: { Authorization: `Bearer ${apiKey}` },
      body: form,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This request sends generated prompt content to OpenAI for image generation. In this workflow, prompts may contain sensitive persona, campaign, or character information, so silent transmission to an external provider creates a real confidentiality/privacy concern even though the network call itself is expected functionality.

Content

Scanner excerpt · scripts/generate-slides.js (reported line 200)May include surrounding context.

js

return;
  }

  const res = await fetch('https://api.openai.com/v1/images/generations', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${apiKey}`,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This request sends generated prompt content to OpenAI for image generation. In this workflow, prompts may contain sensitive persona, campaign, or character information, so silent transmission to an external provider creates a real confidentiality/privacy concern even though the network call itself is expected functionality.

Content

Scanner excerpt · scripts/generate-slides.js (reported line 200)May include surrounding context.

js

return;
  }

  const res = await fetch('https://api.openai.com/v1/images/generations', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${apiKey}`,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The Stability AI call transmits prompts to a third-party provider for image generation. Although this is core functionality, in this skill's context the prompts may encode sensitive or proprietary character/campaign details, making undisclosed external transmission a legitimate security/privacy concern.

Content

Scanner excerpt · scripts/generate-slides.js (reported line 223)May include surrounding context.

js

// ─── Provider: Stability AI ─────────────────────────────────────────
async function generateStability(prompt, outPath) {
  const engineId = model || 'stable-diffusion-xl-1024-v1-0';
  const res = await fetch(`https://api.stability.ai/v1/generation/${engineId}/text-to-image`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${apiKey}`,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The Replicate integration transmits prompts to a third-party API and later retrieves generated content from returned URLs. In the context of this skill, that can expose sensitive campaign content or character design instructions to an external service without any in-script notice or policy enforcement.

Content

Scanner excerpt · scripts/generate-slides.js (reported line 249)May include surrounding context.

js

async function generateReplicate(prompt, outPath) {
  const replicateModel = model || 'black-forest-labs/flux-1.1-pro';

  const createRes = await fetch('https://api.replicate.com/v1/predictions', {
    method: 'POST',
    headers: {
      Authorization: `Token ${apiKey}`,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The Replicate integration transmits prompts to a third-party API and later retrieves generated content from returned URLs. In the context of this skill, that can expose sensitive campaign content or character design instructions to an external service without any in-script notice or policy enforcement.

Content

Scanner excerpt · scripts/generate-slides.js (reported line 249)May include surrounding context.

js

async function generateReplicate(prompt, outPath) {
  const replicateModel = model || 'black-forest-labs/flux-1.1-pro';

  const createRes = await fetch('https://api.replicate.com/v1/predictions', {
    method: 'POST',
    headers: {
      Authorization: `Token ${apiKey}`,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script persists a meta.json file containing the caption, integration ID, posting schedule, and uploaded media identifiers/paths without any consent prompt, warning, or retention control. In this skill’s context, that data can reveal account linkage, content plans, and media references, which may be exposed to other local users, backup systems, logs, or accidental commits if the slides directory is shared or reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script accesses an API key from config.imageGen.apiKey and uses it for outbound requests. Although this is expected for remote providers, there is no comment or user-facing disclosure here that the skill consumes provider credentials, which falls under sensitive credential access.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/post-via-openquok.js:55