TikTok Shop Automation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:42 AM UTC
• Version: 1.0.0

Overview

The skill is a plausible TikTok Shop automation tool, but it handles live commerce actions, credentials, and customer/order data with weak safeguards and misleading security posture.

Review this carefully before installing on a real shop. Use only with mock or sandbox data until credential storage is fixed, Feishu sync is strictly opt-in per command, live inventory/order/refund actions require confirmation or dry-run, and customer PII exports are documented and minimized. Rotate any TikTok cookies, API secrets, or Feishu webhook URLs already saved by this version.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/config.js:108
• Finding: Plaintext storage of TikTok and Feishu credentials in an insufficiently protected configuration file<![CDATA[ ## Vulnerability Details **File Location**: `src/config.js:108-116`, with credential sources in `commands/init.js:113-145` and `commands/account.js:18-24` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code `src/config.js:108-116`: ```js export function saveConfig(config) { initConfigDir(); try { fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf-8'); console.log(`✓ 配置已保存：${CONFIG_FILE}`); return true; } catch (error) { ``` `commands/init.js:113-119`: ```js config.feishu.appToken = feishuAnswers.appToken; config.feishu.tableId = feishuAnswers.tableId; config.feishu.webhookUrl = feishuAnswers.webhookUrl; } ``` `commands/init.js:143-145`: ```js config.tiktok.apiKey = apiAnswers.apiKey; config.tiktok.apiSecret = apiAnswers.apiSecret; config.tiktok.shopId = apiAnswers.shopId; ``` `commands/account.js:18-24`: ```js addAccountConfig({ username: options.username, region: options.region, cookie: options.cookie, addedAt: new Date().toISOString() }); ``` ### Technical Analysis The initialization and account-management paths place the following sensitive values directly in the general configuration object: - TikTok API key and API secret - TikTok session cookies - Feishu webhook URL - Feishu application token and table identifier The complete object is serialized as plaintext to: ```text ~/.clawhub/tiktok-shop/config.json ``` `saveConfig()` does not specify a restrictive creation mode and does not call `chmod()` after writing. Consequently, the resulting permissions depend on the process umask and operating-system defaults. On a multi-user system, permissive defaults may allow other local users or processes to read the file. The project contains a separate `saveCredentials()` function that applies mode `0600` on non-Windows systems, but the initialization and account commands do not use that protected ...[truncated 1719 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove API secrets, session cookies, and webhook URLs from the general configuration object. 2. Store secrets in an operating-system credential vault, such as Keychain, Credential Manager, Secret Service, or a managed secret store. 3. If file storage is unavoidable: - Create `~/.clawhub/tiktok-shop` with mode `0700`. - Create credential files atomically with mode `0600`. - Verify ownership and permissions every time credentials are loaded. - Reject credential files that are symlinks or are owned by another user. 4. Change `init` and `add-account` to call a dedicated credential-storage interface rather than `saveConfig()`. 5. Ensure `exportConfig()` excludes or redacts all secrets. 6. Avoid accepting session cookies directly on the command line because shell history and process listings may expose them. Use a masked prompt, standard input, or a credential-store reference. 7. Rotate any credentials that may already have been stored in permissively accessible configuration files. 8. Update documentation so security claims accurately describe the implemented protection. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: commands/order.js:39
• Finding: Explicit synchronization destination is overridden, causing unexpected disclosure of customer order data to Feishu<![CDATA[ ## Vulnerability Details **File Location**: `commands/order.js:39-50`, with the transmitted fields and network sink in `src/feishu.js:95-106` and `src/feishu.js:119-133` **Vulnerability Type**: Unintended sensitive-data transmission and failure to honor destination selection **Risk Level**: Medium ### Vulnerable Code `commands/order.js:39-50`: ```js // 2. 同步到飞书多维表格 if (options.target === 'feishu-bitable' || config.feishu?.enabled) { const feishu = createFeishuIntegration(config); const appToken = options.appToken || config.feishu?.appToken; const tableId = options.tableId || config.feishu?.tableId; if (appToken && tableId) { const syncResult = await feishu.syncOrdersToBitable(orders, { appToken, tableId }); ``` `src/feishu.js:95-106`: ```js const records = orders.map(order => ({ fields: { '订单 ID': order.order_id, '订单状态': this._translateOrderStatus(order.status), '订单金额': order.amount, '下单时间': order.created_at, '客户姓名': order.customer?.name || '', '客户邮箱': order.customer?.email || '', '商品数量': order.items?.reduce((sum, item) => sum + item.quantity, 0) || 0, '物流单号': order.tracking_number || '', '同步时间': new Date().toISOString() } })); ``` `src/feishu.js:119-133`: ```js for (let i = 0; i < records.length; i += batchSize) { const batch = records.slice(i, i + batchSize); const result = await this.request( `/bitable/v1/apps/${appToken}/tables/${tableId}/records/batch_create`, { method: 'POST', body: { records: batch } } ); results.push(result); } ``` The request helper constructs the destination from the fixed Feishu API base: ```js const FEISHU_API_BASE = 'https://open.feishu.cn/open-apis'; ``` ### Technical Analysis The condition uses a logical OR: ```js options.target === 'feishu-bitable' || co ...[truncated 2910 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Honor the explicit target strictly: ```js if (options.target === 'feishu-bitable') { // Perform Feishu synchronization. } ``` 2. Resolve the effective target once, validate it against an allowlist, and invoke only the selected backend. 3. Change the initialization default for optional Feishu integration to disabled. 4. Before the first external synchronization, show: - The exact destination - The recipient application and table - Every field that will be transmitted - The applicable retention or privacy implications 5. Require explicit confirmation before exporting customer PII unless the user has enabled a documented noninteractive policy. 6. Minimize the payload. Make customer names, email addresses, and tracking numbers opt-in fields rather than defaults. 7. Support pseudonymization or hashing where full customer identity is unnecessary. 8. Implement correct Feishu authentication and fail before constructing or sending sensitive payloads when authorization is absent. 9. Add tests proving that `--target csv` and `--target api` produce no Feishu network requests, regardless of persistent Feishu configuration. 10. Record auditable synchronization logs without logging credentials or full customer data. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (32)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The exported getCurrentAccount function calls itself recursively with no termination condition, causing infinite recursion and a stack overflow whenever it is invoked. In this account-management context, that creates a reliable denial of service for any feature that depends on retrieving the current account and also prevents callers from accessing the intended configuration-backed value.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The inventory sync routine claims to synchronize with an ERP system, but instead fabricates stock levels using `Math.random()` and can push those values to TikTok when `autoUpdate` is enabled. In a product-management skill, this is dangerous because it can corrupt live inventory data, causing overselling, underselling, or operational disruption based on false stock counts.

Credential Access

High

• Category: Privilege Escalation

Content

}

  async getAccessToken(shopId) {
    console.log('🔐 获取 TikTok Access Token...');
    
    // TODO: 实现真实的 OAuth 2.0 流程
    // 1. 构建授权 URL

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

  async getAccessToken(shopId) {
    console.log('🔐 获取 TikTok Access Token...');
    
    // TODO: 实现真实的 OAuth 2.0 流程
    // 1. 构建授权 URL

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

  async getAccessToken(shopId) {
    console.log('🔐 获取 TikTok Access Token...');
    
    // TODO: 实现真实的 OAuth 2.0 流程
    // 1. 构建授权 URL

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

'tiktok-shop'
);
const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json');

/**
 * 配置 schema

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

  /**
   * 认证 - 模拟获取 access token
   */
  async getAccessToken(shopId) {
    console.log('🔐 [Mock] 获取 Access Token...');

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README promotes fully automated order processing and automatic competitor-price adjustment without any visible safeguards, approval steps, rollback guidance, or warnings about operational and financial risk. In an e-commerce automation context, users may enable these features expecting safe defaults, which can lead to erroneous order handling, price wars, margin loss, or store policy violations if the automation behaves unexpectedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly documents customer data export functionality but does not pair it with any privacy, consent, retention, or access-control guidance. In an e-commerce context, exported customer datasets can contain personal information, so normalizing export workflows without safeguards increases the risk of unauthorized disclosure, misuse, or noncompliance with privacy laws.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file includes natural-language descriptions such as the header and command/help text in Chinese, but there is no indication that users can choose another language or locale. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The code explicitly formats timestamps with the fixed locale 'zh-CN', which imposes a specific language/locale on users. The file also uses Chinese-only user-facing messages throughout, but line L57 is the clearest hardcoded locale policy issue because it programmatically forces a locale rather than honoring user settings or offering opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code contains natural-language descriptions and console messages in Chinese throughout the file, which effectively forces a specific language for users interacting with the skill. The policy only permits this when the skill offers language/locale choice or clearly documents a justified regional constraint, neither of which is present here.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The function is presented as competitor monitoring, but when options.alert is set it also performs an outbound Feishu webhook send. This hidden side effect can leak monitored business data to an external system and create unexpected network activity that users or higher-level agents may not anticipate from a read/analysis-style command.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code changes order state to 'shipped', which is a consequential and potentially irreversible business operation. Although it logs basic context, there is no confirmation prompt or explicit user-facing warning that the action will mark orders as shipped and generate tracking numbers before the API call executes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When autoNotify is enabled, the code transmits order identifiers and tracking numbers through Feishu webhook messaging. The function logs that buyer notification is enabled, but it does not clearly warn that customer/order data will be sent to an external integration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This API call changes the order to a refunded or returned state, which can have financial and operational consequences. The surrounding logs show the selected action but do not provide an explicit warning or confirmation gate before the status change is performed.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This JavaScript file contains natural-language comments and console output entirely in Chinese, including operational status and error messaging. Under the stated policy, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The function advertises email-based notification via `notifyEmail`, but the implementation only sends Feishu alerts when `config.feishu?.enabled || options.notifyEmail` is truthy. This mismatch can cause operators to believe alerts are reaching an email destination when they are not, leading to missed low-stock events and business-impacting failures in monitoring.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This JavaScript file contains natural-language comments and runtime messages entirely in Chinese, including user-facing status and error output. Under the policy rule, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The description forces a specific language/locale in user-facing natural language content: "TikTok Shop 自动化运营技能 - 商品管理、订单处理、数据分析、营销自动化". There is no indication that users can choose another language or that the Chinese-only presentation is a justified region-specific constraint.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This JavaScript file contains natural-language documentation and operational log messages exclusively in Chinese, such as the class header and method status messages. Under the policy rule for language/locale, forcing a single language without user opt-in or justification is a policy concern because users may be unable to understand warnings or operational behavior.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This JavaScript file uses Chinese-only natural-language comments and console messages throughout, starting with the module description and continuing in exported function documentation and runtime output. Under the policy rule for language/locale, this is a violation because the skill does not offer user opt-in or indicate that the skill is intentionally restricted to a Chinese-speaking or region-specific context.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The function documentation says it retrieves a tenant access token using app credentials, but the implementation always returns a fabricated mock token. This can mislead callers into believing authentication is real, causing security controls and environment validation to be bypassed and potentially leading to unsafe deployment behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This method batches and sends order records to the Feishu Bitable API, including customer name and email fields, which is a network transmission of user data to an external service. While the code logs that syncing is happening, it does not disclose that personally identifiable customer data will be sent, nor does it prompt for confirmation before transmission.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This function sends arbitrary message content to a configured Feishu webhook via HTTP POST, which can transmit user or system data to an external service. Although it logs that a message is being sent, it does not warn users that message contents are being sent outside the local system or describe the privacy impact.

Static analysis

No suspicious patterns detected.