Security audit

Tiktok Shop Publish

Security checks for vulnerabilities and agentic risk

Overview

This TikTok Shop automation skill is purpose-aligned, but it handles store credentials, customer data, and business-changing actions with insufficient safeguards.

Review before installing. Use only test or least-privilege TikTok/Feishu credentials, avoid passing cookies or tokens on the command line, inspect and restrict permissions on ~/.clawhub/tiktok-shop/config.json, and do not enable live fulfillment, refunds, pricing changes, customer exports, or Feishu sync without your own approval process and data-handling controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: src/config.js:112
Finding: Sensitive credentials are stored in an insufficiently protected configuration file
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: bin/cli.js:51
Finding: Reusable authentication credentials are accepted through command-line arguments
Content: View full analysis
', 'TikTok username') .requiredOption('--cookie ', 'Session Cookie') ``` `bin/cli.js:170-175`: ```js program .command('sync-orders') .description('Synchronize orders') .option('--target ', 'Synchronization target (feishu-bitable/csv/api)') .option('--app-token ', 'Feishu Bitable App Token') .option('--table-id ', 'Feishu Bitable Table ID') ``` ### Technical Analysis The CLI requires users to provide a reusable TikTok session cookie through `--cookie` and permits a Feishu application token through `--app-token`. Command-line arguments are not an appropriate transport for long-lived credentials because they may be exposed through: - Shell history files - Process enumeration tools - Operating-system process telemetry - CI/CD job logs - Terminal session recording - Debugging and crash reports - Command auditing systems Masking interactive prompts elsewhere in the project does not protect credentials supplied as process arguments. The TikTok session cookie is especially sensitive because it may represent an already authenticated browser session and may bypass the need to know the account password. ### Attack Path 1. A user runs a command such as: ```bash tiktok-shop-automation add-account \ --username victim \ --cookie "session-cookie-value" ``` or: ```bash tiktok-shop-automation sync-orders \ --app-token "feishu-token-value" \ --table-id "table-id" ``` 2. The shell may store the complete command in its history. 3. While the process is running, another sufficiently authorized local process may inspect its argument vector. 4. CI, terminal, or oper ...[truncated 1014 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The exported getCurrentAccount function calls itself recursively instead of delegating to the imported initializer function, causing infinite recursion and eventual stack exhaustion whenever consumers invoke it. In an account-management skill, this can reliably break dependent workflows and create a denial-of-service condition for any feature that needs the current account.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/api.js (reported line 21)May include surrounding context.
js
} async getAccessToken(shopId) { console.log('🔐 获取 TikTok Access Token...'); // TODO: 实现真实的 OAuth 2.0 流程 // 1. 构建授权 URL

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/api.js (reported line 117)May include surrounding context.
js
} async getAccessToken(shopId) { console.log('🔐 获取 TikTok Access Token...'); // TODO: 实现真实的 OAuth 2.0 流程 // 1. 构建授权 URL

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/mock-api.js (reported line 125)May include surrounding context.
js
} async getAccessToken(shopId) { console.log('🔐 获取 TikTok Access Token...'); // TODO: 实现真实的 OAuth 2.0 流程 // 1. 构建授权 URL

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/config.js (reported line 19)May include surrounding context.
js
'tiktok-shop' ); const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json'); const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json'); /** * 配置 schema

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/mock-api.js (reported line 122)May include surrounding context.
js
} /** * 认证 - 模拟获取 access token */ async getAccessToken(shopId) { console.log('🔐 [Mock] 获取 Access Token...');

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises automation that can process orders and automatically adjust competitor-based pricing, both of which can directly affect store operations, revenue, and customer experience. Presenting these features without clear warnings, approval controls, rollback guidance, or operational safeguards increases the risk that users enable impactful actions without understanding the consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documents automatic order handling, refunds/returns processing, and customer notifications, which can trigger real-world business actions and affect user/customer data without explicit safeguards, confirmation requirements, or warning language. In an automation skill for commerce operations, these capabilities are legitimate, but presenting them without clear constraints increases the risk of accidental destructive actions or privacy-impacting misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented ability to export customer data, including segmentation such as VIP customers, is privacy-impacting and may expose personal or commercially sensitive information if used improperly. The surrounding text lacks privacy, retention, access-control, or compliance guidance, making misuse or over-collection more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language description and command help text in this file are written in Chinese, and the CLI does not offer any language selection or opt-in mechanism. That creates a locale/language policy concern because users are forced into a single language experience without documented justification or choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI requires a session cookie as a command-line argument, which exposes sensitive credentials through shell history, process listings, logging, and screenshots or shared terminal transcripts. In this automation context, the cookie likely grants direct account access, so accidental disclosure could allow takeover of the linked TikTok Shop account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code persists options.cookie, which is a sensitive authentication credential, but the surrounding comments and logs do not disclose that credential material is being stored. For code files, access to or storage of credentials should have some visible warning, comment, or documentation unless clearly disclosed elsewhere in the skill materials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s natural-language descriptions and user-facing console messages are entirely in Chinese, starting with the module description and continuing throughout the skill. Under the policy, a fixed language without opt-in or a documented region-specific justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function is presented as competitor monitoring, but when options.alert is set it also transmits derived business intelligence to an external Feishu webhook. This hidden side effect can exfiltrate sensitive competitive-monitoring data or trigger outbound communications without the caller clearly consenting to data sharing, which is especially risky in automation contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code interactively collects sensitive values such as TikTok API keys, API secrets, and Feishu webhook/app tokens, then persists them to a local JSON config file. Storing secrets on disk without an explicit warning, permission hardening, or use of a secure secret store increases the risk of credential disclosure through local compromise, backups, shared accounts, or accidental file exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fulfillOrders flow performs live order-status changes and optional outbound notifications immediately based on provided options, with no confirmation gate, dry-run mode, or explicit acknowledgement for irreversible external actions. In an order-management skill, this increases the risk of accidental bulk shipment updates or unintended customer notifications if the command is misused, scripted incorrectly, or triggered with wrong parameters.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The processReturn function directly changes an order to refunded/returned status and sends an external Feishu notification without any explicit operator confirmation or safeguard. Because refund/return actions can have financial and customer-service consequences, a mistaken invocation or malformed automation could trigger real external state changes and messaging immediately.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function logs and accepts notifyEmail as if alerts will be sent to an email recipient, but the implementation does not send email at all. When alerts are triggered, it instantiates the Feishu integration and calls sendStockAlert, creating a direct contradiction between the user-facing intent/documentation and the actual notification channel.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file's comments and all user-facing console messages are written in Chinese, indicating the skill forces a specific language experience. The policy for this category requires flagging language or locale constraints when there is no user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JavaScript file contains natural-language documentation and runtime messages entirely in Chinese, including the top-level description and later console output, but nowhere indicates that the skill is China-region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code includes natural-language comments and user-visible console output exclusively in Chinese, such as module descriptions and status/error messages. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The method is documented as obtaining a tenant access token using app credentials, but it returns a fabricated token instead of performing real authentication. This can cause downstream code to operate under false security assumptions, leading to failed authorization checks, broken integrations, or accidental promotion of mock behavior into production.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The order sync sends customer identifiers and contact data, including name and email, to an external Feishu Bitable instance without any consent, minimization, or policy enforcement visible in the module. In a commerce context this creates a real data leakage and privacy/compliance risk if the destination workspace is misconfigured, overbroad, or not approved for customer PII.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The webhook sender posts arbitrary message content to an externally configured URL, and the surrounding helper methods use it for business and customer-related notifications. Because webhook URLs are effectively bearer secrets and messages may contain sensitive operational or customer data, misconfiguration or abuse can exfiltrate information outside the intended boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The notification methods hardcode Chinese-language text and use the 'zh-CN' locale for date formatting, which imposes a specific language/locale choice. There is no indication that users can select another language or that the Chinese locale is a documented, justified constraint.
Content: No source excerpt is available for this finding.