投放Agent自动化体验测试

• Analyzed: May 11, 2026, 8:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: 654873e78a5852756e60a701cec377f9d8b255e7946da0fb601acab9fec64197
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates UX testing of the Tencent Advertising platform (ad.qq.com) by requiring users to manually extract and provide full session cookies, including sensitive internal tokens (RIO_TOKEN for .woa.com) and login credentials (gdt_mlogin). While the scripts (inject_cookies.js and run_test.js) use these cookies locally for Playwright automation as described, the practice of manual cookie injection is a high-risk pattern. Furthermore, the test script (run_test.js) sends active commands to the advertising agent that could modify live campaign budgets or pause ads (e.g., 'adjust all daily budgets to 200 yuan'), which may lead to unintended financial impact during a 'test' run.