ClawHub
Back to skill

Security audit

tiktok-research

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed TikTok research helper that sends user-directed public lookup requests to Crawlora and does not show hidden persistence, local data access, or destructive behavior.

Install this only if you are comfortable sending TikTok handles, video IDs, keywords, ad research targets, and your Crawlora API key to Crawlora. Avoid using it for confidential investigations or sensitive personal data, and do not set CRAWLORA_API_BASE unless you trust the destination.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation explicitly instructs use of an external API endpoint with an API key but does not warn users that prompts, identifiers, and research targets will be transmitted to a third-party service. In an agent skill context, this can cause unintentional disclosure of user-supplied data or sensitive investigation targets to Crawlora, especially if users assume the skill operates locally or directly against TikTok.

External Transmission

Medium
Category
Data Exfiltration
Content
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**25 endpoints across 1 platform group(s).**
Confidence
95% confidence
Finding
https://api.crawlora.net/

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
88% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

External Transmission

Medium
Category
Data Exfiltration
Content
set -euo pipefail

: "${CRAWLORA_API_KEY:?Set CRAWLORA_API_KEY first — get a free key at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills}"
base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}"

method="GET"
body=""
Confidence
84% confidence
Finding
https://api.crawlora.net/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:26