Tiktok Shop Publish

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:48 AM UTC
• Version: 1.0.0

Overview

This TikTok Shop automation skill is purpose-aligned, but it handles store credentials, customer data, and business-changing actions with insufficient safeguards.

Review before installing. Use only test or least-privilege TikTok/Feishu credentials, avoid passing cookies or tokens on the command line, inspect and restrict permissions on ~/.clawhub/tiktok-shop/config.json, and do not enable live fulfillment, refunds, pricing changes, customer exports, or Feishu sync without your own approval process and data-handling controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/config.js:112
• Finding: Sensitive credentials are stored in an insufficiently protected configuration file<![CDATA[ ## Vulnerability Details **File Location**: - `src/config.js:112-116` - `commands/init.js:118-120` - `commands/init.js:145-150` - `commands/account.js:19-24` **Vulnerability Type**: Plaintext credential storage with insufficient filesystem protection **Risk Level**: High ### Vulnerable Code `src/config.js:112-116`: ```js try { fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf-8'); console.log(`✓ Configuration saved: ${CONFIG_FILE}`); return true; } catch (error) { ``` `commands/init.js:118-120`: ```js config.feishu.appToken = feishuAnswers.appToken; config.feishu.tableId = feishuAnswers.tableId; config.feishu.webhookUrl = feishuAnswers.webhookUrl; ``` `commands/init.js:145-150`: ```js config.tiktok.apiKey = apiAnswers.apiKey; config.tiktok.apiSecret = apiAnswers.apiSecret; config.tiktok.shopId = apiAnswers.shopId; } // Save configuration saveConfigFromSrc(config); ``` `commands/account.js:19-24`: ```js addAccountConfig({ username: options.username, region: options.region, cookie: options.cookie, addedAt: new Date().toISOString() }); ``` ### Technical Analysis The initialization workflow inserts TikTok API credentials and Feishu credentials directly into the general configuration object. Account creation also inserts a reusable TikTok session cookie into that object. The complete configuration is then serialized in plaintext to: ```text ~/.clawhub/tiktok-shop/config.json ``` The `saveConfig()` function does not assign restrictive permissions to either the configuration directory or the resulting file. Consequently, the effective permissions depend on the process umask and pre-existing filesystem state. On systems with permissive defaults, other local users or processes may be able to read the credentials. The project contains a separate `saveCredentials()` function that applies mode `0600` on non-Windows platforms, but the initialization and account-management paths do not use it. This defeats the intended ...[truncated 1855 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all secrets from the general configuration object: - TikTok API keys and secrets - Session cookies - Feishu application tokens - Feishu webhook URLs 2. Store credentials using an operating-system credential manager where available, such as: - macOS Keychain - Windows Credential Manager - Linux Secret Service - A dedicated secrets-management service for server deployments 3. If file-based storage is unavoidable: - Create `~/.clawhub/tiktok-shop` with mode `0700`. - Atomically create the credentials file with mode `0600`. - Verify permissions every time credentials are loaded. - Reject symlinks and unexpected file ownership. - Avoid relying solely on a post-write `chmod`, which leaves a race window. 4. Update initialization and account creation to call the protected credential-storage API rather than `saveConfig()`. 5. Ensure `exportConfig()` excludes or redacts all sensitive values. 6. Add a migration routine that: - Reads existing sensitive fields from `config.json`. - Writes them to protected storage. - Removes them from `config.json`. - Rotates credentials if insecure permissions are detected. 7. Add automated tests verifying that secret files are owner-readable only and that exported configuration never includes credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/cli.js:51
• Finding: Reusable authentication credentials are accepted through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: - `bin/cli.js:51-55` - `bin/cli.js:170-175` **Vulnerability Type**: Credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `bin/cli.js:51-55`: ```js program .command('add-account') .description('Add TikTok account') .requiredOption('--username <username>', 'TikTok username') .requiredOption('--cookie <cookie>', 'Session Cookie') ``` `bin/cli.js:170-175`: ```js program .command('sync-orders') .description('Synchronize orders') .option('--target <target>', 'Synchronization target (feishu-bitable/csv/api)') .option('--app-token <token>', 'Feishu Bitable App Token') .option('--table-id <id>', 'Feishu Bitable Table ID') ``` ### Technical Analysis The CLI requires users to provide a reusable TikTok session cookie through `--cookie` and permits a Feishu application token through `--app-token`. Command-line arguments are not an appropriate transport for long-lived credentials because they may be exposed through: - Shell history files - Process enumeration tools - Operating-system process telemetry - CI/CD job logs - Terminal session recording - Debugging and crash reports - Command auditing systems Masking interactive prompts elsewhere in the project does not protect credentials supplied as process arguments. The TikTok session cookie is especially sensitive because it may represent an already authenticated browser session and may bypass the need to know the account password. ### Attack Path 1. A user runs a command such as: ```bash tiktok-shop-automation add-account \ --username victim \ --cookie "session-cookie-value" ``` or: ```bash tiktok-shop-automation sync-orders \ --app-token "feishu-token-value" \ --table-id "table-id" ``` 2. The shell may store the complete command in its history. 3. While the process is running, another sufficiently authorized local process may inspect its argument vector. 4. CI, terminal, or oper ...[truncated 1014 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove options that accept literal session cookies or tokens directly from the command line. 2. Use hidden interactive prompts for sensitive values. Ensure input is not echoed and is not retained after use. 3. Support safer non-interactive mechanisms: - Read the credential from standard input. - Accept a path to a protected credential file. - Accept the name of an environment variable rather than its value. - Retrieve credentials from an operating-system keychain or secrets manager. 4. If legacy command-line options must temporarily remain: - Emit a prominent security warning. - Mark them as deprecated. - Avoid printing their values in errors or debug logs. - Document shell-history risks. - Remove them in the next breaking release. 5. Redact sensitive argument values from application telemetry, exception reports, and audit logs. 6. Rotate any session cookies or tokens previously supplied through command-line arguments in shared, logged, or monitored environments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The exported getCurrentAccount function calls itself recursively instead of delegating to the imported initializer function, causing infinite recursion and eventual stack exhaustion whenever consumers invoke it. In an account-management skill, this can reliably break dependent workflows and create a denial-of-service condition for any feature that needs the current account.

Credential Access

High

• Category: Privilege Escalation

Content

}

  async getAccessToken(shopId) {
    console.log('🔐 获取 TikTok Access Token...');
    
    // TODO: 实现真实的 OAuth 2.0 流程
    // 1. 构建授权 URL

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

  async getAccessToken(shopId) {
    console.log('🔐 获取 TikTok Access Token...');
    
    // TODO: 实现真实的 OAuth 2.0 流程
    // 1. 构建授权 URL

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

  async getAccessToken(shopId) {
    console.log('🔐 获取 TikTok Access Token...');
    
    // TODO: 实现真实的 OAuth 2.0 流程
    // 1. 构建授权 URL

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

'tiktok-shop'
);
const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json');

/**
 * 配置 schema

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

  /**
   * 认证 - 模拟获取 access token
   */
  async getAccessToken(shopId) {
    console.log('🔐 [Mock] 获取 Access Token...');

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises automation that can process orders and automatically adjust competitor-based pricing, both of which can directly affect store operations, revenue, and customer experience. Presenting these features without clear warnings, approval controls, rollback guidance, or operational safeguards increases the risk that users enable impactful actions without understanding the consequences.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents automatic order handling, refunds/returns processing, and customer notifications, which can trigger real-world business actions and affect user/customer data without explicit safeguards, confirmation requirements, or warning language. In an automation skill for commerce operations, these capabilities are legitimate, but presenting them without clear constraints increases the risk of accidental destructive actions or privacy-impacting misuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented ability to export customer data, including segmentation such as VIP customers, is privacy-impacting and may expose personal or commercially sensitive information if used improperly. The surrounding text lacks privacy, retention, access-control, or compliance guidance, making misuse or over-collection more likely.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The natural-language description and command help text in this file are written in Chinese, and the CLI does not offer any language selection or opt-in mechanism. That creates a locale/language policy concern because users are forced into a single language experience without documented justification or choice.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The CLI requires a session cookie as a command-line argument, which exposes sensitive credentials through shell history, process listings, logging, and screenshots or shared terminal transcripts. In this automation context, the cookie likely grants direct account access, so accidental disclosure could allow takeover of the linked TikTok Shop account.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code persists `options.cookie`, which is a sensitive authentication credential, but the surrounding comments and logs do not disclose that credential material is being stored. For code files, access to or storage of credentials should have some visible warning, comment, or documentation unless clearly disclosed elsewhere in the skill materials.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s natural-language descriptions and user-facing console messages are entirely in Chinese, starting with the module description and continuing throughout the skill. Under the policy, a fixed language without opt-in or a documented region-specific justification is a locale-policy violation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The function is presented as competitor monitoring, but when options.alert is set it also transmits derived business intelligence to an external Feishu webhook. This hidden side effect can exfiltrate sensitive competitive-monitoring data or trigger outbound communications without the caller clearly consenting to data sharing, which is especially risky in automation contexts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code interactively collects sensitive values such as TikTok API keys, API secrets, and Feishu webhook/app tokens, then persists them to a local JSON config file. Storing secrets on disk without an explicit warning, permission hardening, or use of a secure secret store increases the risk of credential disclosure through local compromise, backups, shared accounts, or accidental file exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The fulfillOrders flow performs live order-status changes and optional outbound notifications immediately based on provided options, with no confirmation gate, dry-run mode, or explicit acknowledgement for irreversible external actions. In an order-management skill, this increases the risk of accidental bulk shipment updates or unintended customer notifications if the command is misused, scripted incorrectly, or triggered with wrong parameters.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The processReturn function directly changes an order to refunded/returned status and sends an external Feishu notification without any explicit operator confirmation or safeguard. Because refund/return actions can have financial and customer-service consequences, a mistaken invocation or malformed automation could trigger real external state changes and messaging immediately.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The function logs and accepts `notifyEmail` as if alerts will be sent to an email recipient, but the implementation does not send email at all. When alerts are triggered, it instantiates the Feishu integration and calls `sendStockAlert`, creating a direct contradiction between the user-facing intent/documentation and the actual notification channel.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file's comments and all user-facing console messages are written in Chinese, indicating the skill forces a specific language experience. The policy for this category requires flagging language or locale constraints when there is no user opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This JavaScript file contains natural-language documentation and runtime messages entirely in Chinese, including the top-level description and later console output, but nowhere indicates that the skill is China-region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code includes natural-language comments and user-visible console output exclusively in Chinese, such as module descriptions and status/error messages. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy violation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The method is documented as obtaining a tenant access token using app credentials, but it returns a fabricated token instead of performing real authentication. This can cause downstream code to operate under false security assumptions, leading to failed authorization checks, broken integrations, or accidental promotion of mock behavior into production.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The order sync sends customer identifiers and contact data, including name and email, to an external Feishu Bitable instance without any consent, minimization, or policy enforcement visible in the module. In a commerce context this creates a real data leakage and privacy/compliance risk if the destination workspace is misconfigured, overbroad, or not approved for customer PII.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The webhook sender posts arbitrary message content to an externally configured URL, and the surrounding helper methods use it for business and customer-related notifications. Because webhook URLs are effectively bearer secrets and messages may contain sensitive operational or customer data, misconfiguration or abuse can exfiltrate information outside the intended boundary.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The notification methods hardcode Chinese-language text and use the 'zh-CN' locale for date formatting, which imposes a specific language/locale choice. There is no indication that users can select another language or that the Chinese locale is a documented, justified constraint.

Static analysis

No suspicious patterns detected.