Security audit

Tiktok Video Scripts

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese-language TikTok commerce script template skill with some advertising-compliance caveats but no executable code, credential use, persistence, or hidden system behavior.

Install only if you want Chinese-language TikTok/Douyin-style product-promotion templates. Before publishing, verify all product claims, prices, inventory limits, testimonials, before-after comparisons, professional credentials, and health or safety statements, and add required sponsorship or affiliate disclosures. Use privacy-conscious storage for raw footage, especially when it includes clients, faces, locations, children, unreleased products, or confidential business assets.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill is explicitly a library of persuasive commerce scripts and repeatedly includes testimonial-style claims, urgency cues, and effectiveness statements such as '亲测有效', '放心冲', and scarcity-driven CTAs without any guidance to verify claims, disclose sponsorships, or avoid deceptive advertising. This can lead users to generate misleading promotional content that unfairly influences consumer trust and purchasing decisions.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The manifest description and all user-facing template content are entirely in Chinese, with no indication that the skill is region-specific or that users may request another language. Per the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The checklist recommends cloud backup and iCloud/network drives without any caution about privacy, access controls, or sensitive media handling. In a content-production workflow, raw footage may contain unreleased products, personal data, faces, locations, or client assets, so encouraging cloud storage by default can increase the risk of accidental exposure or overbroad sharing.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This markdown file contains user-facing skill content exclusively in Chinese, including the title, instructions, and templates. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language or justification is provided.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The file includes promotional templates for categories such as skincare, food, baby products, pet products, and fitness items, using persuasive claims like '亲测好用', '必须安利', and implied outcome statements without embedding category-specific safety or suitability cautions. Although there is a general note saying claims must be truthful, it does not warn users to verify ingredients, allergies, age suitability, usage risks, or other health/safety constraints before promotion, which can encourage misleading or unsafe recommendations at scale.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This markdown file presents all instructions, templates, and examples exclusively in Chinese, and it does not mention that the skill is Chinese-only or provide any user opt-in for language/locale. Under the policy rule for natural-language violations, forcing a specific language without user choice is in scope.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: This markdown file presents all instructions in a single fixed language, which can be a natural-language policy concern when no user opt-in or locale justification is provided. The content does not state that the skill is intended only for Chinese-speaking users or offer an alternative language option.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The skill content appears to require Chinese-language use throughout, including headings, instructions, and all script templates. There is no indication that the language is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Static analysis

No suspicious patterns detected.