TokPortal

Automate TikTok and Instagram at scale with account creation, video distribution, content uploads, and detailed analytics using 30 AI-native tools via TokPor...

This skill appears to do what it says — automate TokPortal tasks — but it has practical risks you should review before enabling. Specifically: (1) tokportal‑mcp is an npm package you will install/run (npx will download and execute code); review its npm page and source, and only run it from a trusted maintainer. (2) The skill uploads local files (video/image) to produce public URLs — do not let it upload sensitive or private files. (3) The service returns delivered account credentials and 2FA/verification codes; consider the legal/abuse implications of bulk account creation and protect those credentials. (4) Avoid placing your API key in shared configs if other users/processes can read them; prefer a least‑privilege key and rotate it if you suspect misuse. (5) If you need stronger assurance, ask the publisher for the tokportal‑mcp source repository and audit it or run it in an isolated sandbox/container. Proceed only if you trust TokPortal and the npm package maintainers.

Type: OpenClaw Skill Name: tokportal Version: 1.0.0 The skill is classified as suspicious due to several high-risk capabilities that could be exploited via prompt injection against the AI agent. Specifically, the `upload_video` and `upload_image` tools (described in SKILL.md) allow the agent to upload local files, creating a clear path for data exfiltration if the agent is compromised. Additionally, the `get_account_detail` tool exposes 'Full credentials' for managed accounts, and the reliance on executing an external `npm` package (`tokportal-mcp`) introduces a supply chain risk. While these capabilities align with the stated purpose, their broad access to local files and credentials presents significant vulnerabilities.