T09 · Insecure Skill Coding Practices
Error
- Location
src/config.js:108- Finding
Plaintext storage of TikTok and Feishu credentials in an insufficiently protected configuration file
- Content
View full analysis
- Remediation
View remediation
Security audit
TikTok Shop Automation
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible TikTok Shop automation tool, but it handles live commerce actions, credentials, and customer/order data with weak safeguards and misleading security posture.
Review this carefully before installing on a real shop. Use only with mock or sandbox data until credential storage is fixed, Feishu sync is strictly opt-in per command, live inventory/order/refund actions require confirmation or dry-run, and customer PII exports are documented and minimized. Rotate any TikTok cookies, API secrets, or Feishu webhook URLs already saved by this version.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
commands/order.js:39- Finding
Explicit synchronization destination is overridden, causing unexpected disclosure of customer order data to Feishu
- Content
View full analysis
({ fields: { '订单 ID': order.order_id, '订单状态': this._translateOrderStatus(order.status), '订单金额': order.amount, '下单时间': order.created_at, '客户姓名': order.customer?.name || '', '客户邮箱': order.customer?.email || '', '商品数量': order.items?.reduce((sum, item) => sum + item.quantity, 0) || 0, '物流单号': order.tracking_number || '', '同步时间': new Date().toISOString() } })); ``` `src/feishu.js:119-133`: ```js for (let i = 0; i < records.length; i += batchSize) { const batch = records.slice(i, i + batchSize); const result = await this.request( `/bitable/v1/apps/${appToken}/tables/${tableId}/records/batch_create`, { method: 'POST', body: { records: batch } } ); results.push(result); } ``` The request helper constructs the destination from the fixed Feishu API base: ```js const FEISHU_API_BASE = 'https://open.feishu.cn/open-apis'; ``` ### Technical Analysis The condition uses a logical OR: ```js options.target === 'feishu-bitable' || co ...[truncated 2910 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (32)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The exported getCurrentAccount function calls itself recursively with no termination condition, causing infinite recursion and a stack overflow whenever it is invoked. In this account-management context, that creates a reliable denial of service for any feature that depends on retrieving the current account and also prevents callers from accessing the intended configuration-backed value.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The inventory sync routine claims to synchronize with an ERP system, but instead fabricates stock levels using
Math.random()and can push those values to TikTok whenautoUpdateis enabled. In a product-management skill, this is dangerous because it can corrupt live inventory data, causing overselling, underselling, or operational disruption based on false stock counts.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } async getAccessToken(shopId) { console.log('🔐 获取 TikTok Access Token...'); // TODO: 实现真实的 OAuth 2.0 流程 // 1. 构建授权 URL
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } async getAccessToken(shopId) { console.log('🔐 获取 TikTok Access Token...'); // TODO: 实现真实的 OAuth 2.0 流程 // 1. 构建授权 URL
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } async getAccessToken(shopId) { console.log('🔐 获取 TikTok Access Token...'); // TODO: 实现真实的 OAuth 2.0 流程 // 1. 构建授权 URL
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js 'tiktok-shop' ); const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json'); const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json'); /** * 配置 schema
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } /** * 认证 - 模拟获取 access token */ async getAccessToken(shopId) { console.log('🔐 [Mock] 获取 Access Token...');
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README promotes fully automated order processing and automatic competitor-price adjustment without any visible safeguards, approval steps, rollback guidance, or warnings about operational and financial risk. In an e-commerce automation context, users may enable these features expecting safe defaults, which can lead to erroneous order handling, price wars, margin loss, or store policy violations if the automation behaves unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly documents customer data export functionality but does not pair it with any privacy, consent, retention, or access-control guidance. In an e-commerce context, exported customer datasets can contain personal information, so normalizing export workflows without safeguards increases the risk of unauthorized disclosure, misuse, or noncompliance with privacy laws.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file includes natural-language descriptions such as the header and command/help text in Chinese, but there is no indication that users can choose another language or locale. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code explicitly formats timestamps with the fixed locale 'zh-CN', which imposes a specific language/locale on users. The file also uses Chinese-only user-facing messages throughout, but line L57 is the clearest hardcoded locale policy issue because it programmatically forces a locale rather than honoring user settings or offering opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code contains natural-language descriptions and console messages in Chinese throughout the file, which effectively forces a specific language for users interacting with the skill. The policy only permits this when the skill offers language/locale choice or clearly documents a justified regional constraint, neither of which is present here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function is presented as competitor monitoring, but when options.alert is set it also performs an outbound Feishu webhook send. This hidden side effect can leak monitored business data to an external system and create unexpected network activity that users or higher-level agents may not anticipate from a read/analysis-style command.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code changes order state to 'shipped', which is a consequential and potentially irreversible business operation. Although it logs basic context, there is no confirmation prompt or explicit user-facing warning that the action will mark orders as shipped and generate tracking numbers before the API call executes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
When autoNotify is enabled, the code transmits order identifiers and tracking numbers through Feishu webhook messaging. The function logs that buyer notification is enabled, but it does not clearly warn that customer/order data will be sent to an external integration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This API call changes the order to a refunded or returned state, which can have financial and operational consequences. The surrounding logs show the selected action but do not provide an explicit warning or confirmation gate before the status change is performed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JavaScript file contains natural-language comments and console output entirely in Chinese, including operational status and error messaging. Under the stated policy, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function advertises email-based notification via
notifyEmail, but the implementation only sends Feishu alerts whenconfig.feishu?.enabled || options.notifyEmailis truthy. This mismatch can cause operators to believe alerts are reaching an email destination when they are not, leading to missed low-stock events and business-impacting failures in monitoring.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JavaScript file contains natural-language comments and runtime messages entirely in Chinese, including user-facing status and error output. Under the policy rule, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description forces a specific language/locale in user-facing natural language content: "TikTok Shop 自动化运营技能 - 商品管理、订单处理、数据分析、营销自动化". There is no indication that users can choose another language or that the Chinese-only presentation is a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains natural-language documentation and operational log messages exclusively in Chinese, such as the class header and method status messages. Under the policy rule for language/locale, forcing a single language without user opt-in or justification is a policy concern because users may be unable to understand warnings or operational behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JavaScript file uses Chinese-only natural-language comments and console messages throughout, starting with the module description and continuing in exported function documentation and runtime output. Under the policy rule for language/locale, this is a violation because the skill does not offer user opt-in or indicate that the skill is intentionally restricted to a Chinese-speaking or region-specific context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The function documentation says it retrieves a tenant access token using app credentials, but the implementation always returns a fabricated mock token. This can mislead callers into believing authentication is real, causing security controls and environment validation to be bypassed and potentially leading to unsafe deployment behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This method batches and sends order records to the Feishu Bitable API, including customer name and email fields, which is a network transmission of user data to an external service. While the code logs that syncing is happening, it does not disclose that personally identifiable customer data will be sent, nor does it prompt for confirmation before transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function sends arbitrary message content to a configured Feishu webhook via HTTP POST, which can transmit user or system data to an external service. Although it logs that a message is being sent, it does not warn users that message contents are being sent outside the local system or describe the privacy impact.
- Content
Static analysis
No suspicious patterns detected.