ClawHub
Back to skill

Security audit

tiktok-downloader

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it sends a TikTok link to a named third-party downloader service and returns media links, without requesting credentials or persistent access.

Install only if you are comfortable sending each TikTok URL to tk.seekubo.com and downloading files from returned CDN links. Avoid submitting private, sensitive, or non-public links, and use the downloaded media only where you have the right to do so.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to send a user-supplied TikTok URL to a third-party service (tk.seekubo.com) but does not clearly disclose that the URL, associated metadata, and requester IP/user context may be shared with that external provider. This creates a privacy and data-governance risk, especially if users assume the processing is local or first-party, and the risk is increased because the skill emphasizes that the service is free/public while omitting a data-sharing warning.

Static analysis

No suspicious patterns detected.