ClawHub
Back to skill

Security audit

Tiktok Trend Slayer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed TikTok analytics helper that uses user-provided API credentials to fetch data and save local reports, with no evidence of hidden persistence, destructive behavior, or credential theft.

Install only if you are comfortable providing EchoTik and optional TikTok Shop API credentials to this skill. Review generated reports because API responses may include business-relevant creator/product data saved locally, and use the skill for explicit TikTok Shop analytics tasks rather than generic recommendation requests.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The description is partially accurate about the data sources and broad analytics theme: the code does fetch EchoTik influencer data, optionally queries a TikTok Shop product endpoint, supports multiple regions/categories, and outputs reports. However, the declared purpose overstates the behavior in important ways. The script only collects and formats API responses into JSON/Markdown files with simple filtering/table summaries. There is no logic for collaboration planning, ranking/prioritizing products, generating strategic recommendations, or producing video hook strategies. In addition, the TikTok Shop product call is explicitly marked as a placeholder with an endpoint that 'may differ,' which weakens the claim of a fully implemented TikTok Shop Partner API toolkit. So the description does not accurately represent the actual implemented capabilities.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_docs.md (reported line 69)May include surrounding context.

Authentication

TikTok Shop API uses OAuth 2.0. First obtain an access token:

bash
curl -X POST "https://auth.tiktokshop.com/api/v2/oauth/token" \

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_docs.md (reported line 146)May include surrounding context.

md
### Notes

- Access tokens expire. Refresh periodically.
- API rate limits apply. Respect rate limits.
- Product data availability varies by region and seller permissions.
- Without `TIKTOK_SHOP_API_KEY`, the script skips product fetching gracefully.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises shell-based execution and external API access but does not declare an explicit tool scope such as allowed-tools or permissions. That makes the runtime trust boundary unclear and can lead to broader-than-necessary command execution capability if the host platform defaults to permissive behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes sending creator and product-related data to third-party APIs but does not present a clear user-facing disclosure or consent step. This creates a privacy and data-governance risk, especially if prompts, identifiers, account context, or business-sensitive targeting inputs are included in outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Broad trigger phrases like common planning or recommendation requests can cause the skill to activate in situations the user did not intend, potentially causing external API calls and data processing. In an agent environment, overbroad invocation increases the chance of unreviewed network access, surprise actions, or unintended handling of user/business context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_docs.md (reported line 72)May include surrounding context.

TikTok Shop API uses OAuth 2.0. First obtain an access token:

bash
curl -X POST "https://auth.tiktokshop.com/api/v2/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "app_key": "YOUR_APP_KEY",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger description includes general phrases like "partnership proposal" and "create a collab plan" without defining what context qualifies for this workflow versus other planning or marketing tasks. Because no exclusion conditions or negative examples are given, the workflow could be invoked for loosely related everyday requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Phrases such as "product recommendations," "what to sell," and "create a product list" are broad and could apply to many unrelated recommendation tasks. The file does not define constraints, required context, or non-trigger examples to keep invocation limited to TikTok Shop product-selection analysis.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger line includes broad phrases like "video strategy," "content plan," and "content calendar," which are common requests outside this specific TikTok hook-strategy workflow. Without explicit constraints or negative examples, the skill may activate for unrelated content-planning tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comments instruct the user to "Use English content" and "Use English for cell content" as the default behavior, which is a locale/language constraint. Because the guidance does not present language choice as user-driven opt-in, it can violate policy against forcing a specific language without consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script sends authenticated HTTP requests to EchoTik using the ECHOTIK_AUTH_HEADER and to TikTok Shop using the TIKTOK_SHOP_API_KEY, but it does not present an explicit disclosure that credentials will be used in outbound network calls. The environment section documents required variables, yet it does not clearly warn users that running the script contacts third-party services and transmits authentication headers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This curl invocation sends a bearer token to the TikTok Shop API, which is a safety-relevant network operation involving credentials. The script includes neither a runtime disclosure nor a warning comment/docstring explaining that execution will contact a third-party API with supplied credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_docs.md (reported line 65)May include surrounding context.

md
# Based on TikTok Shop Partner API docs: /api/v2/products/search
  local response
  response=$(curl -sf --max-time 15 \
    -X GET "https://api.tiktokshop.com/v2/products/search?category_id=${cat_id}&region=${region}&page_size=${PAGE_SIZE}" \
    -H "Authorization: Bearer ${TIKTOK_SHOP_API_KEY}" \
    -H "Content-Type: application/json" 2>/dev/null) || {
    printf " FAILED\n"; return 1;

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tiktok_slayer.sh (reported line 198)May include surrounding context.

sh
# Based on TikTok Shop Partner API docs: /api/v2/products/search
  local response
  response=$(curl -sf --max-time 15 \
    -X GET "https://api.tiktokshop.com/v2/products/search?category_id=${cat_id}&region=${region}&page_size=${PAGE_SIZE}" \
    -H "Authorization: Bearer ${TIKTOK_SHOP_API_KEY}" \
    -H "Content-Type: application/json" 2>/dev/null) || {
    printf " FAILED\n"; return 1;

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The output format table states "PDF ... use English content," which is a natural-language locale restriction. The file does not indicate that this is optional, user-selectable, or required for a documented regional/compliance reason, so it conflicts with the language/locale policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script saves API responses and derived reports into files under the output directory, but the user-facing startup messages and usage text do not explicitly warn that external data will be persisted locally. Although the writes are core to the script's purpose, there is no disclosure near execution that data will be stored in timestamped report files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.