Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate TikTok KeyAPI integration, but its setup stores an API token persistently in plaintext shell profiles.
Review before installing. Use this only if you are comfortable sending TikTok queries, uploaded images or request bodies, and retrieved results to KeyAPI. Avoid the documented --token form, consider setting KEYAPI_TOKEN only for the current shell or using a secure credential store, and rotate the token if it was saved in a shared or backed-up shell profile. Be careful with follower/following, audience-region, comments, and download workflows because they can expose sensitive social graph or content data.
scripts/configure-keyapi-auth.mjs:128Bearer Token Exposed Through Visible Input, Command-Line Arguments, and Plaintext Shell-Profile Storage
Referenced artifact was not completely inspected
2. Check auth with `node scripts/configure-keyapi-auth.mjs --status` when script execution is available and setup state is unknown; treat `authStatus: "availabl
Referenced artifact was not completely inspected
2. Check auth with `node scripts/configure-keyapi-auth.mjs --status` when script execution is available and setup state is unknown; treat `authStatus: "availabl
Referenced artifact was not completely inspected
2. Check auth with `node scripts/configure-keyapi-auth.mjs --status` when script execution is available and setup state is unknown; treat `authStatus: "availabl
Referenced artifact was not completely inspected
2. Check auth with `node scripts/configure-keyapi-auth.mjs --status` when script execution is available and setup state is unknown; treat `authStatus: "availabl
Referenced artifact was not completely inspected
2. Check auth with `node scripts/configure-keyapi-auth.mjs --status` when script execution is available and setup state is unknown; treat `authStatus: "availabl
Referenced artifact was not completely inspected
9. Resolve current docs with `node scripts/search-keyapi-docs.mjs --query "<semantic entity action>" --resolve` when the helper script is available; otherwise o
Referenced artifact was not completely inspected
9. Resolve current docs with `node scripts/search-keyapi-docs.mjs --query "<semantic entity action>" --resolve` when the helper script is available; otherwise o
Referenced artifact was not completely inspected
9. Resolve current docs with `node scripts/search-keyapi-docs.mjs --query "<semantic entity action>" --resolve` when the helper script is available; otherwise o
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
12. Prefer `node scripts/keyapi-api.mjs` for live REST calls when script execution is available. Use the host's HTTP client only when scripts are unavailable or
Referenced artifact was not completely inspected
a different current working directory, resolve `scripts/...` relative to this `SKILL.md`. For large JSON bodies, especially base64 image payloads, prefer `--bo
L168 states that API calls are live by default, may return payload previews to stdout, and can write full results to an output file, but it does not explicitly warn that these actions may expose retrieved data in terminal logs or saved files. Because this is a markdown skill description and it documents behaviors that can affect user data handling and system state, a more explicit warning is warranted.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
$headers = @{ Authorization = "Bearer $env:KEYAPI_TOKEN" }
$uri = "https://api.keyapi.ai/v1/tiktok/..."
Invoke-RestMethod -Method Get -Uri $uri -Headers $headers
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
$headers = @{ Authorization = "Bearer $env:KEYAPI_TOKEN" }
$uri = "https://api.keyapi.ai/v1/tiktok/..."
Invoke-RestMethod -Method Get -Uri $uri -Headers $headers
The module explicitly supports retrieval of follower/following lists and audience region data, which can expose privacy-sensitive relationship and demographic information without any user-facing safeguards, consent checks, or warning language. In an influencer analytics context this may be intended business functionality, but the absence of minimization and disclosure controls increases the risk of profiling, stalking, or misuse of account-graph data.
The script persistently stores the API token in plaintext inside shell profile files, making the secret accessible to local users, backups, dotfile sync services, shell-history workflows, and accidental sharing of profile contents. This is dangerous because compromise of the token enables unauthorized API use and potentially account abuse until the token is rotated.
Detected: suspicious.env_credential_access, suspicious.secret_argv_exposure