Boring TikTok Publisher

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 2:02 AM UTC
• Version: 1.0.1

Overview

This skill does what it says: it helps publish user-provided media to TikTok through Boring, with credential and upload handling disclosed.

Install only if you trust Boring with the TikTok account and media you plan to publish. Treat the MCP connector URL as a password, rotate it if exposed, use draft mode or SELF_ONLY for sensitive content, and confirm the account, media, caption, and privacy before publishing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20

Finding

Credential and User Content Exposure Through Unsafe Handling Defaults

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-22, 30, 52-55, and 109
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippets

markdown

- **MCP link is a credential**: Your MCP Server URL contains an embedded authentication token. Treat it like a password — do not share it publicly. Regenerate anytime in Settings.
- **Media uploads**: Video files and photos are uploaded to Boring's Google Cloud Storage to make them accessible for TikTok's API. TikTok requires media for all posts.
- **Data flow**: Your content and media are sent from Boring's server to TikTok's API on your behalf via your connected OAuth token.

markdown

4. **Add to Claude**: Paste the MCP link as a Connector — no install, no API key needed

markdown

Upload files to get public URLs:
- **Local files**: `boring_upload_file` with `file_path`
- **External URLs**: `boring_upload_from_url`
- **Google Drive**: Pass directly

markdown

- **Privacy**: Default is `PUBLIC_TO_EVERYONE`. Other options: `MUTUAL_FOLLOW_FRIENDS`, `FOLLOWER_OF_CREATOR`, `SELF_ONLY`

Technical Analysis

The MCP authentication token is embedded directly in the connector URL. Bearer credentials placed in URLs are more likely to be exposed through connector configuration displays, copied configuration data, browser history, diagnostic output, telemetry, screenshots, or logs. Any party obtaining the complete URL may be able to present the embedded token to the Boring MCP service until the credential expires or is revoked.

The workflow also uploads user media to third-party Google Cloud Storage and describes the resulting resources as public URLs. Although this data flow is disclosed and is relevant to TikTok publishing, publicly addressable media increases exposure if URLs are retained, logged, shared, indexed, or otherwise disclosed. The document does not specify URL expiration, ...[truncated 2397 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace URL-embedded authentication with an authorization header or a secure connector secret field that is redacted from displays, logs, telemetry, and diagnostic exports.
2. Use short-lived, narrowly scoped credentials and enforce server-side expiration, revocation, audience restriction, and rotation.
3. Ensure all interfaces automatically redact authentication tokens from URLs before displaying or recording them.
4. Replace unrestricted public media objects with signed, unguessable, short-lived URLs that are limited to the minimum duration required for TikTok ingestion.
5. Document media retention periods and automatically delete staged files after publication, failure, cancellation, or expiration.
6. Require explicit confirmation before uploading sensitive local files to third-party storage.
7. Require a final pre-publication confirmation showing the destination TikTok account, selected media, caption, draft status, and privacy level.
8. Default to SELF_ONLY or draft mode rather than PUBLIC_TO_EVERYONE, unless the user explicitly requests public publication.
9. Provide an immediate credential-revocation procedure and advise users to rotate the MCP token whenever accidental disclosure is suspected.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

- **Video limits**: Max 4GB, max 10 minutes
- **Photo carousel**: Up to 35 images (PNG auto-converts to JPEG)
- **Draft mode**: Sends to creator's inbox for manual publish
- **Token**: 24-hour access token with auto-refresh (refresh token lasts 1 year)
- **Permissions**: `video.upload`, `video.publish`

## Error Handling

Static analysis

No suspicious patterns detected.