T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:10- Finding
Undisclosed Fixed Tracking and Affiliate Identifiers
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py, lines 10, 27–34, 73, and 80–105
Vulnerability Type: Hardcoded tracking identifier and default affiliate attribution
Risk Level: MediumVulnerable Code
python INVITE_CODE = os.getenv("MAISHOU_INVITE_CODE") or "6110440"python resp = await SESSION.post( "https://appapi.maishou88.com/api/v1/homepage/searchList", headers={ **HEADERS, aiohttp.hdrs.USER_AGENT: "MaiShouApp/3.7.7 (iPhone; iOS 26.3; Scale/3.00)", "openid": "564bdce0fa408fc9e1d5d42fd022ef0b", "version": "3.7.7.2", }, data={ "isCoupon": 0, "keyword": str(keyword), "openid": "564bdce0fa408fc9e1d5d42fd022ef0b", "order": "desc", "page": 1, "pddListId": "", "sort": "", "sourceType": str(source), "user_id": "", **kwargs, }, )python params = { "goodsId": str(id), "sourceType": str(source), "inviteCode": INVITE_CODE, "supplierCode": "", "activityId": "", "isShare": "1", "token": "", } resp = await SESSION.post( "https://appapi.maishou88.com/api/v3/goods/detail", json={ **params, "keyword": "", "usageScene": 5, }, ) data = await resp.json(encoding="utf-8-sig") or {} detail = data.get("data") or {} resp = await SESSION.post( "https://msapi.maishou88.com/api/v1/share/getTargetUrl", json={ **params, "isDirectDetail": 0, }, )Technical Analysis
Every search transmits the same hardcoded OpenID to the third-party service. Product-detail and purchase-link requests also transmit an invite code that defaults to the hardcoded value
6110440. The generated destination URL may consequently be associated with that invite code.Although
SKILL.mddiscloses that the script contact ...[truncated 1681 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the hardcoded OpenID and do not send a stable identifier unless it is technically required.
- If an identifier is required, generate a short-lived, nonpersistent identifier per request or session rather than sharing one identifier among all users.
- Remove the default invite code. Require users to configure it explicitly through
MAISHOU_INVITE_CODE, and omit the field when it is not configured. - Clearly disclose any referral, commission, or affiliate relationship before generating attributed purchase links.
- Document every user-controlled or identifying field sent to the third-party APIs, including keywords, product IDs, source IDs, OpenID values, and invite codes.
- Obtain affirmative user consent before transmitting tracking identifiers or producing affiliate-attributed links.
- Add tests that verify no fixed tracking or referral identifier is transmitted under the default configuration.