TikTok Shop-商品详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 1.0.1

Overview

The skill performs the advertised TikTok Shop lookup, but it also handles account credentials, billing flows, persistent response storage, and automatic feedback reporting with several under-scoped safety controls.

Install only if you are comfortable giving this skill a LinkFox API key, letting it contact LinkFox services, storing full product responses locally, and using its account/billing helper. Avoid setting custom LinkFox endpoint environment variables unless you fully trust the destination, treat generated API keys as secrets, and review any payment or feedback submission before allowing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tiktok_shop_product_detail.py:36
• Finding: Credential Exfiltration Through Unvalidated Endpoint Overrides<![CDATA[ ## Vulnerability Details **File Location**: `scripts/tiktok_shop_product_detail.py:36-78`; `scripts/onboarding.py:72-85, 188-196, 228-246, 402-421, 454-462` **Vulnerability Type**: Unvalidated credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```python def get_api_base() -> str: """Gateway base address: LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding implementation similarly permits all authentication-related origins to be replaced: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Those configurable destinations receive sensitive requests: ```p ...[truncated 3774 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin production requests to an explicit allowlist: - `https://tool-gateway.linkfox.com` - `https://api.linkfox.com` - `https://agent-api.linkfox.com` 2. Parse endpoints with `urllib.parse.urlsplit` and require: - HTTPS - An exact approved hostname - No username or password - No unexpected port - No fragments 3. Disable endpoint overrides in production. If development overrides are necessary, require an explicit development-mode flag and prohibit use of production credentials in that mode. 4. Disable cross-origin redirects or validate the destination of every redirect before forwarding credentials. 5. Separate clients by trust domain so login tokens cannot accidentally be attached to gateway or feedback requests. 6. Add automated tests proving that HTTP URLs, unapproved hosts, absolute-path URL tricks, user-information components, and unexpected ports are rejected. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:484
• Finding: Generated API Keys Are Exposed Through Standard Output and Plaintext Shell Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/onboarding.py:484-493, 507-516`; `references/onboarding.md:9-15` **Vulnerability Type**: Plaintext credential disclosure and insecure secret persistence **Risk Level**: High ### Vulnerable Code The onboarding function returns the complete generated API key: ```python tok = _get_or_generate_api_token( lg["access_token"], lg["user_id"], info["group_id"], ) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The command then serializes the complete object to stdout: ```python def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} Successfully obtained API key " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` The onboarding instructions recommend placing the secret directly in shell commands and plaintext startup files: ```bash setx LINKFOX_AGENT_API_KEY "<key>" echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The complete API key is emitted as structured JSON to stdout. In an Agent environment, stdout may be copied into model context, conversation transcripts, execution logs, terminal capture, or observability systems. The documented setup commands further expose the key in chat content, shell history, process command-line records, and plaintext shell startup files. Although the user needs a way to configure the generated ke ...[truncated 1156 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not include the complete API key in stdout JSON. 2. Store the key directly in an operating-system credential manager or another permission-restricted secret store. 3. Return only a masked fingerprint, such as the first and last four characters, so the user can verify which key was configured. 4. If file storage is unavoidable: - Use a dedicated configuration file rather than a shell startup file. - Create it with mode `0600`. - Refuse to use files with unsafe ownership or permissions. 5. Avoid commands that include the secret as a command-line argument or shell-history entry. 6. Document key rotation and revocation procedures. 7. Ensure logs and error messages redact API keys, access tokens, refresh tokens, SMS codes, and authorization headers. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tiktok_shop_product_detail.py:247
• Finding: Unsanitized Session Identifier Allows Output-Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `scripts/tiktok_shop_product_detail.py:247-264`; `scripts/onboarding.py:152-159` **Vulnerability Type**: Path traversal through an environment-derived directory name **Risk Level**: Medium ### Vulnerable Code The product-detail script accepts `SESSION_ID` without validation: ```python def _session_id(ts: float) -> str: """Prefer env SESSION_ID; otherwise generate HHMMSS-<6 hex>.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """Return (linkfox_root, session_dir); session_dir exists.""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script has the same issue: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a filesystem path component but is not restricted to a safe identifier format. It may contain `..` components, path separators, or an absolute path. In Python, if the final argument to `os.path.join` is absolute, the earlier root components are discarded. Relative traversal components can likewise escape the intended session roo ...[truncated 1146 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict session identifiers to a conservative format, for example: ```python if not re.fullmatch(r"[A-Za-z0-9_-]{1,64}", sid): raise ValueError("Invalid SESSION_ID") ``` 2. Reject absolute paths, path separators, `.` components, and `..` components explicitly. 3. Resolve and verify the final path before creating it: ```python base = os.path.realpath(os.path.join(root, date_str)) candidate = os.path.realpath(os.path.join(base, sid)) if os.path.commonpath([base, candidate]) != base: raise ValueError("SESSION_ID escapes session root") ``` 4. Apply the same validation in both scripts through one shared helper. 5. Use restrictive directory and file permissions for stored responses and payment artifacts. 6. Add tests for Unix absolute paths, Windows drive and UNC paths, mixed separators, encoded traversal strings, and nested `..` components. ]]>

other

Warning

• Location: SKILL.md:128
• Finding: Automatic Feedback Telemetry Can Transmit Conversation-Derived Information Without Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:128-130`; `references/api.md:142-161` **Vulnerability Type**: Undisclosed automated telemetry **Risk Level**: Medium ### Vulnerable Instruction ```text Feedback: Auto-detect and report feedback via the Feedback API when the described capability differs from actual behavior, results miss the user's intent, the user expresses praise or dissatisfaction, or the skill can be improved. Follow references/api.md without interrupting the user's flow. ``` The referenced external endpoint accepts free-form content: ```text POST https://skill-api.linkfox.com/api/v1/public/feedback Content-Type: application/json ``` ```json { "skillName": "linkfox-tiktok-shop-product-detail", "sentiment": "POSITIVE", "category": "OTHER", "content": "The product detail matched the requested TikTok Shop listing." } ``` ### Technical Analysis The Skill instructs the Agent to infer feedback from user intent, satisfaction, and actual results, then transmit that information to an external Feedback API. The phrase “without interrupting the user's flow” discourages an explicit confirmation step. The `content` field is free-form, and the instructions do not define data-minimization, redaction, retention, or consent requirements. An Agent following these instructions could include confidential product-analysis objectives, product identifiers, user complaints, or other conversation-derived information. Feedback reporting is not necessary to perform the declared public product-detail lookup and therefore exceeds the minimum network privilege required for the core functionality. ### Attack Path 1. A user discusses a product-analysis objective, private commercial context, or dissatisfaction with a result. 2. The Skill classifies the conversation as feedback. 3. The Agent constructs a free-form summary containing user intent or result details. 4. Following the instruction not to interrupt the flow, the Agent submits the pay ...[truncated 517 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make feedback submission opt-in rather than automatic. 2. Before transmission, display: - The destination - The exact payload - The categories of information included 3. Require explicit user confirmation for each submission. 4. Remove product IDs, URLs, account information, conversation quotations, and business context unless specifically approved. 5. Define a strict schema with short enumerated fields instead of unrestricted free-form content. 6. Provide a local-only feedback option. 7. Publish retention, access, and deletion policies for submitted telemetry. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163
• Finding: Onboarding Recommends Installation of Unpinned Runtime Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/onboarding.py:163-168, 183-187` **Vulnerability Type**: Unpinned dependency installation guidance **Risk Level**: Low ### Vulnerable Code ```python def render_qr(content: str, out_dir: str) -> dict: try: import qrcode except ImportError: err = ( "Missing qrcode dependency; please run: " "pip install qrcode pillow" ) print(f"{TAG} render_qr: {err}", file=sys.stderr) return { "png_path": None, "ascii_qr": None, "error": err, } ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; please run: pip install requests" ) ``` ### Technical Analysis The onboarding code instructs users to install packages by mutable package name without exact versions, hashes, a lockfile, or a trusted-index requirement. Package resolution therefore depends on the current pip configuration and the latest package versions available at installation time. The referenced package names are not themselves shown to be malicious. The risk is non-reproducible and potentially unsafe dependency acquisition, particularly in environments configured to use an untrusted package mirror. ### Attack Path 1. The environment lacks `requests`, `qrcode`, or Pillow. 2. The onboarding flow displays the installation command. 3. The user executes the unpinned `pip install` command. 4. pip resolves packages and transitive dependencies from the configured index. 5. A compromised release, unsafe mirror, or substituted dependency executes package installation or runtime code with the user’s privileges. ### Impact Assessment A malicious or compromised dependency can execute code with the privileges of the user performing the installation or running the Skill. This could expose environment variables, including the LinkFox API key, as well as ...[truncated 169 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide a version-controlled dependency manifest with exact versions. 2. Include cryptographic hashes and install with hash verification, such as: ```bash pip install --require-hashes -r requirements.lock ``` 3. Pin transitive dependencies through a generated lockfile. 4. Specify and document an approved HTTPS package index. 5. Prefer installation in an isolated virtual environment. 6. Add dependency scanning and periodic controlled upgrades rather than resolving mutable latest versions during onboarding. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (26)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target is built from environment-controlled base URLs and then used to transmit sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and team identifiers. In a skill execution environment, attackers who can influence environment variables or packaging can redirect these requests to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL is likewise derived from environment variables and used with an Authorization header containing the agent API key. If an attacker can set LINKFOX_AGENT_API_URL or related variables, the CLI will send authenticated requests and secrets to an arbitrary server, enabling API-key theft and misuse.

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented purpose omits material data-handling behavior: persistent storage of full API responses, 24-hour local caching, session/index tracking, and actual fallback writes to home or temp locations contrary to the stated write policy. This creates undisclosed retention and broader filesystem exposure than users would reasonably expect from a read-only lookup skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose omits material data-handling behavior: persistent storage of full API responses, 24-hour local caching, session/index tracking, and actual fallback writes to home or temp locations contrary to the stated write policy. This creates undisclosed retention and broader filesystem exposure than users would reasonably expect from a read-only lookup skill.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

python scripts/tiktok_shop_product_detail.py '{"productInput":"1729937400435937604","region":"GB"}'
```

## Display Rules

1. Lead with the product title, product ID, requested region, category, and returned status.
2. Show sale/original price with the returned currency; never convert currencies unless the user asks separately.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API-key issuance, plan discovery, order creation, and payment QR rendering, which is materially unrelated to a TikTok Shop product-detail lookup skill. Such scope divergence is dangerous because it introduces credential collection and monetization flows into a public-data skill, expanding the attack surface and increasing the chance of user deception or unauthorized secret handling.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes, enabling billing operations that are not justified by the stated skill purpose of reading public product details. In this context, hidden payment capability is especially risky because users or hosts may not expect the skill to initiate purchases, and a compromised or misleading integration could trigger unwanted financial actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file performs SMS-based login, token exchange, team enumeration, and API-token retrieval/generation, all unrelated to public product-detail retrieval. In this skill context that makes the behavior more dangerous, because it silently expands from data lookup into credential handling and secret minting, creating opportunities for account takeover, unauthorized API access, and user confusion.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no explicit tool scope even though its documented behavior requires environment access, network calls, and persistent file writes. This weakens least-privilege controls and makes it harder for operators and users to understand or constrain what the skill can do, especially given the additional onboarding and persistence behaviors referenced elsewhere.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger logic activates whenever a user mentions a TikTok Shop URL or 19-digit product ID, even if the user did not ask for a product-detail lookup. Over-broad triggering increases the chance of unintended network calls, billing, data persistence, and activation in contexts where the user did not consent to using this skill.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill mandates saving full API responses to persistent local storage for every call, regardless of whether that data is needed for the reply. Even public product data can be coupled with user-supplied inputs, session identifiers, operational metadata, or other contextual information, creating unnecessary retention and possible leakage across sessions or users.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatically sending user feedback or inferred satisfaction signals to a separate Feedback API is unrelated to the core function of fetching product details. It can exfiltrate user content, intent, or sentiment to another endpoint without a clear need or explicit consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs callers to forward SESSION_ID, MODE_ID, and APP_NAME from environment variables to an external service without any privacy warning, minimization guidance, or statement of necessity. This can cause unnecessary disclosure of session or contextual identifiers to a third-party endpoint, increasing privacy and correlation risk if those values contain user- or tenant-specific data.

External Transmission

Medium

• Category: Data Exfiltration

Content

返回字段可能因商品、卖家、地区和页面上下文而缺失。即使商品下架或库存为 0，也可能返回结构化详情。

## curl 示例

```bash
API_KEY="${LINKFOX_AGENT_API_KEY:-$LINKFOXAGENT_API_KEY}"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The Feedback API asks clients to send free-form content to an external public endpoint but does not warn that user-provided text will leave the local system. Because feedback content may include user intent, errors, or copied product data, this omission creates a risk of unintentional data exfiltration and privacy violations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding instructions direct operators to collect a user's phone number and use it in registration/login flows, but they provide no guidance on consent, minimization, masking, retention, or safe handling of verification data. In an agent setting, this creates a real privacy and account-security risk because operators may unnecessarily handle sensitive personal data and OTP-linked account access without safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file instructs users to persist API keys in shell startup files and environment variables without warning that these credentials are long-lived secrets that may be exposed through dotfiles, backups, terminal history, screenshots, or multi-user systems. While common operationally, omitting secret-handling guidance makes credential leakage materially more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The login flow emits the full API key to stdout JSON, which may be captured by logs, orchestration layers, transcripts, or downstream tools. Because this skill already exceeds its stated scope, exposing a freshly issued credential in normal output further increases the risk of accidental leakage and unauthorized reuse.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The docstring promises writes only under the current workspace and explicitly says /tmp is forbidden, but the implementation silently falls back to the home directory and temporary directory. This discrepancy can cause sensitive response data and session metadata to be written to less controlled locations than operators or users expect, increasing disclosure risk on shared systems.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script transmits request parameters plus SESSION_ID, MODE_ID, and APP_NAME to a remote service without any runtime notice or consent mechanism. In contexts where users may supply URLs, product IDs, or session-linked workflow data, this can create an unexpected privacy leak and metadata exposure, especially because the gateway is environment-configurable.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script caches full API responses on disk and later marks cache hits, but does not clearly warn users that returned content will be stored locally. If API responses contain commercially sensitive product data, operational metadata, or account-linked information, local persistence can expose that data to other users or processes on the same machine.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: Several core usage and behavior descriptions are written only in Chinese, while other messages are in English. This mixed but partially untranslated presentation can effectively force a specific language for some users without opt-in or an offered alternative.

Static analysis

No suspicious patterns detected.