Is Agent Quick Tools safe?
Agent Quick Tools rewrites shopping-agent product and registration URLs with its own affiliate codes.
On supported shopping-agent sites, the extension removes existing affiliate parameters from product and registration URLs and replaces them with hardcoded referral, partner, invite, or member codes. It also removes risk warning popups and modals on those sites as they appear, restoring normal page scrolling and clicks.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension Replaces Your Affiliate Code With Its Own
On product/registration pages across 11 shopping-agent sites (CNFans, AcBuy, UsFans, AllChinaBuy, OrientDig, Sugargoo, Superbuy, Mulebuy, Hoobuy, Oopbuy, Kakobuy), it strips any affiliate code, sets its own; UsFans forces real navigation.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a product or registration page on one of the 11 supported shopping-agent sites, sometimes with an affiliate code already in the URL.
The extension's content script deletes any affiliate code already in the URL and replaces it with its own hardcoded code before you view the page or complete a signup.
Runs automatically on page load and on every subsequent in-page navigation; on UsFans it forces a second, real page load so the substituted code is recorded by the site's server.
- UsFans coderef=RFGVYE
Replaces or adds this on UsFans product and registration links; a real page navigation is forced so it reaches the server.
- AllChinaBuy codepartnercode=wf9L8W
Replaces any partner code on AllChinaBuy product and signup links.
- AcBuy codeu=KL5R26
Replaces any user code on AcBuy product links.
- CNFans coderef=49564
Replaces any ref code on CNFans product and registration links.
- OrientDig coderef=100110783
Replaces any ref code on OrientDig product and registration links.
- Sugargoo codememberId=153653210929380976
Sets this member ID on Sugargoo product links.
- Superbuy codepartnercode=E42fHR
Sets this partner code on Superbuy product links.
- Mulebuy coderef=200024714
Replaces any ref code on Mulebuy product and registration links.
- Hoobuy codeutm_source=VRNadvl8
Sets this source tag on Hoobuy product links.
- Oopbuy codeinviteCode=LOYY4M0BL
Sets this invite code on Oopbuy product links.
- Kakobuy codeaffcode=supreme
Replaces any affiliate code on Kakobuy product links.
The strip-and-substitute logic, from the extension's shipping source.
The rewrite entrypoint
const rewriteUrl = () => { const href = window.location.href; const site = detectSite(href); // which of the 11 sites this is if (!site || !needsAffiliate(href, site)) return; // not a product/registration URL, skip const url = new URL(href); // Is this a signup/registration flow rather than a product page? const isSignup = url.pathname.toLowerCase().includes("register") || url.searchParams.get("type")?.toLowerCase() === "register" || url.searchParams.get("loginstatus")?.toLowerCase() === "register"; const affCode = isSignup ? refCodes[site]?.signup : refCodes[site]?.visit; if (!affCode) return; // If CNFans already carries the extension's own code, don't re-process if (site === "CNFans") { const blockedRef = "49564"; if (url.searchParams.get("ref") === blockedRef) return; } // Strip any existing affiliate code and set the extension's own applyAffiliateParams(url, affCode); const finalUrl = url.toString(); if (finalUrl === href) return; // nothing changed, don't touch the URL // UsFans tracks affiliate credit server-side, so a same-document URL // rewrite isn't enough — force one real navigation carrying the code. if (site === "UsFans") { const FLAG = "usfans_ref_redirected_v1"; if (sessionStorage.getItem(FLAG) === "1") return; // already redirected once this session const hasRef = new URL(finalUrl).searchParams.get("ref") === "RFGVYE"; if (hasRef) { sessionStorage.setItem(FLAG, "1"); window.location.replace(finalUrl); // real navigation, not just address-bar rewrite return; } } // All other sites: rewrite the address bar without reloading the page window.history.replaceState({}, "", finalUrl);};Stripping existing codes and inserting the extension's own
const applyAffiliateParams = (urlObj, affCode) => { // Walk every affiliate key the extension knows about, for every site, // and delete it from the current URL — this is what removes a // pre-existing affiliate code, whether it's the user's own or a // third party's, before the extension's code is applied. Object.values(refCodes).forEach((codeObj) => { Object.values(codeObj).forEach((code) => { const clean = (code.startsWith("?") || code.startsWith("&")) ? code.slice(1) : code; const params = new URLSearchParams(clean); for (const key of params.keys()) urlObj.searchParams.delete(key); }); }); // Now set the extension's own hardcoded code for this site/flow const cleanAff = (affCode.startsWith("?") || affCode.startsWith("&")) ? affCode.slice(1) : affCode; const codeParams = new URLSearchParams(cleanAff); for (const [k, v] of codeParams.entries()) urlObj.searchParams.set(k, v);};200 response (~5.3KB). The page was requested with no ref parameter; the content script forced a real navigation via window.location.replace() that added ref=RFGVYE, the extension's hardcoded UsFans code, before the request left the browser.
Paste into the DevTools console on any of the extension's supported shopping-agent sites before opening a product or registration page. Logs every URL change so you can see an affiliate parameter get added or replaced in real time.
- Chrome with the extension installed
- DevTools console access
// affiliate-rewrite-watcher.js// Paste into the DevTools console on a supported shopping-agent site// (e.g. cnfans.com, acbuy.com, usfans.com) BEFORE navigating to a// product or registration page. Logs every URL change so you can see// an affiliate parameter get added or replaced.(function () { let lastUrl = location.href; const report = (how) => { if (location.href === lastUrl) return; console.log(`[AFFILIATE_WATCH] URL changed via ${how}:`); console.log(' before:', lastUrl); console.log(' after: ', location.href); lastUrl = location.href; }; const origPush = history.pushState; const origReplace = history.replaceState; history.pushState = function (...args) { const r = origPush.apply(this, args); report('pushState'); return r; }; history.replaceState = function (...args) { const r = origReplace.apply(this, args); report('replaceState'); return r; }; window.addEventListener('popstate', () => report('popstate')); window.addEventListener('beforeunload', () => { console.log('[AFFILIATE_WATCH] page navigating away to:', location.href); }); console.log('[AFFILIATE_WATCH] installed. Open a product or /register URL and watch for URL changes above.');})();- 1Open a supported site, e.g. cnfans.com.
- 2Open DevTools console, paste this script.
- 3Visit a product page with your own code, e.g. URL ending &ref=YOUR_CODE.
- 4Watch the console log your code replaced.
What it can do
Permissions this extension asks for, as declared in version 1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on yupoo.com
*://*.yupoo.com/*
Read and change your data on weidian.com
*://*.weidian.com/*
Read and change your data on cnfans.com
*://*.cnfans.com/*
Read and change your data on allchinabuy.com
*://*.allchinabuy.com/*
Read and change your data on acbuy.com
*://*.acbuy.com/*
Read and change your data on orientdig.com
*://*.orientdig.com/*
Read and change your data on sugargoo.com
*://*.sugargoo.com/*
Read and change your data on superbuy.com
*://*.superbuy.com/*
Read and change your data on mulebuy.com
*://*.mulebuy.com/*
Read and change your data on hoobuy.com
*://*.hoobuy.com/*
Read and change your data on oopbuy.com
*://*.oopbuy.com/*
Read and change your data on kakobuy.com
*://*.kakobuy.com/*
Read and change your data on usfans.com
*://*.usfans.com/*
Read and change your data on api.weberowsky-yt.workers.dev
https://api.weberowsky-yt.workers.dev/*
Store data in your browser
storage