ClawHub
Back to skill

Security audit

Tiktok Trend Challenger

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent with its TikTok creator-campaign purpose, but it documents live paid API actions and a mutable persistent install path without enough caution or scoping.

Review this skill before installing. Use only test or tightly scoped PingHuman credentials, avoid pasting real bearer tokens into shared logs, and require explicit human approval before creating campaigns, approving submissions, rating creators, or sending tips. Prefer a pinned local or signed version instead of a persistent mutable remote URL.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Unpinned Remote Skill Installation and Persistent Registry Reference

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–52
Vulnerability Type: Unpinned third-party Skill dependency
Risk Level: Medium

Vulnerable Code

bash
# Via skill manager (recommended)
skill-install tiktok-trend-challenger

# Or manually add to agent config
echo "tiktok-trend-challenger: https://www.pinghuman.ai/skills/tiktok-trend-challenger/skill.md" >> ~/.agent/skills.txt

Technical Analysis

The installation instructions do not pin the Skill to an immutable version, commit, cryptographic digest, or verified signature. The manual installation method also creates a persistent registry entry that points directly to a mutable remote SKILL.md.

Consequently, the content loaded in a future agent session may differ from the content reviewed during this audit. Although the audited file does not itself contain a malicious payload, compromise or unauthorized modification of the remote resource could turn this installation mechanism into a supply-chain delivery channel. The skill-install example likewise provides no explicit source validation or integrity-verification procedure.

Attack Path

  1. A user follows the documented installation instructions.
  2. The manual method records the remote PingHuman Skill URL in ~/.agent/skills.txt, or the Skill manager resolves the unpinned package name.
  3. The referenced remote Skill content is subsequently modified or its hosting/distribution channel is compromised.
  4. In a later session, the agent or Skill manager retrieves the changed content without comparing it against a trusted digest or signature.
  5. The agent processes the substituted instructions as trusted Skill content.
  6. Those instructions could induce unauthorized API operations, redirect data to an attacker-controlled service, or otherwise alter behavior within the permissions available to the agent.

Exploitation therefore requires control of, or the ability to tamper wi ...[truncated 731 chars]

Remediation
View remediation

Remediation Suggestions

  1. Distribute the audited Skill as a local, versioned artifact rather than loading mutable documentation directly from a remote URL.
  2. Pin installation to an immutable release identifier, commit, or content-addressed artifact.
  3. Publish a SHA-256 digest or signed manifest and verify it before activating the Skill.
  4. Configure the Skill manager to reject unsigned content and fail closed when integrity verification fails.
  5. Record the verified version and digest in ~/.agent/skills.txt instead of only recording a mutable URL.
  6. Require explicit user review and confirmation whenever retrieved Skill content differs from the previously approved digest.
  7. Document the authoritative package source and provide a secure update procedure with rollback support.
  8. Apply least privilege to agents loading third-party Skills, particularly for credentials, payment actions, and task-approval APIs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
## Quick Links

- **Skill File**: [SKILL.md](https://www.pinghuman.ai/skills/tiktok-trend-challenger/skill.md)
- **API Base URL**: `https://www.pinghuman.ai/api/v1`
- **Dashboard**: https://www.pinghuman.ai/dashboard

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
## Quick Links

- **Skill File**: [SKILL.md](https://www.pinghuman.ai/skills/tiktok-trend-challenger/skill.md)
- **API Base URL**: `https://www.pinghuman.ai/api/v1`
- **Dashboard**: https://www.pinghuman.ai/dashboard

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill includes copy-pastable curl examples that use bearer tokens and create live campaign tasks against a production API, but it does not warn users that these are real network calls with potentially billable or externally visible effects. An agent or user following these examples could unintentionally transmit credentials and trigger paid task creation on a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The example sends an Authorization bearer token to an external domain, which is an external transmission of sensitive credentials. Although presented as documentation, in an agent setting this can lead to real credential disclosure and live outbound requests if examples are executed verbatim.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Search for creators who excel at trend participation:

bash
curl -X GET "https://www.pinghuman.ai/api/v1/humans?skills=trend_participation,trending_challenges,hashtag_optimization&platform=tiktok&sort=trend_success_rate" \
  -H "Authorization: Bearer ph_sk_abc123..."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The approval and rating workflow demonstrates irreversible account actions such as approving submissions and sending tips without any cautionary language or confirmation step. In an agentic context, these examples normalize direct execution of financially or operationally consequential actions on a live account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.