Is Agent Quick Tools safe?

Medium risk

Agent Quick Tools rewrites shopping-agent product and registration URLs with its own affiliate codes.

On supported shopping-agent sites, the extension removes existing affiliate parameters from product and registration URLs and replaces them with hardcoded referral, partner, invite, or member codes. It also removes risk warning popups and modals on those sites as they appear, restoring normal page scrolling and clicks.

supremefinds00v1.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension Replaces Your Affiliate Code With Its Own

On product/registration pages across 11 shopping-agent sites (CNFans, AcBuy, UsFans, AllChinaBuy, OrientDig, Sugargoo, Superbuy, Mulebuy, Hoobuy, Oopbuy, Kakobuy), it strips any affiliate code, sets its own; UsFans forces real navigation.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a product or registration page on one of the 11 supported shopping-agent sites, sometimes with an affiliate code already in the URL.

The extension did this

The extension's content script deletes any affiliate code already in the URL and replaces it with its own hardcoded code before you view the page or complete a signup.

Runs automatically on page load and on every subsequent in-page navigation; on UsFans it forces a second, real page load so the substituted code is recorded by the site's server.

Hardcoded affiliate codes the extension substitutes, by site
  • UsFans code
    ref=RFGVYE

    Replaces or adds this on UsFans product and registration links; a real page navigation is forced so it reaches the server.

  • AllChinaBuy code
    partnercode=wf9L8W

    Replaces any partner code on AllChinaBuy product and signup links.

  • AcBuy code
    u=KL5R26

    Replaces any user code on AcBuy product links.

  • CNFans code
    ref=49564

    Replaces any ref code on CNFans product and registration links.

  • OrientDig code
    ref=100110783

    Replaces any ref code on OrientDig product and registration links.

  • Sugargoo code
    memberId=153653210929380976

    Sets this member ID on Sugargoo product links.

  • Superbuy code
    partnercode=E42fHR

    Sets this partner code on Superbuy product links.

  • Mulebuy code
    ref=200024714

    Replaces any ref code on Mulebuy product and registration links.

  • Hoobuy code
    utm_source=VRNadvl8

    Sets this source tag on Hoobuy product links.

  • Oopbuy code
    inviteCode=LOYY4M0BL

    Sets this invite code on Oopbuy product links.

  • Kakobuy code
    affcode=supreme

    Replaces any affiliate code on Kakobuy product links.

The code that does this

The strip-and-substitute logic, from the extension's shipping source.

Readable version

The rewrite entrypoint

const rewriteUrl = () => {  const href = window.location.href;  const site = detectSite(href);            // which of the 11 sites this is  if (!site || !needsAffiliate(href, site)) return;  // not a product/registration URL, skip  const url = new URL(href);  // Is this a signup/registration flow rather than a product page?  const isSignup =    url.pathname.toLowerCase().includes("register") ||    url.searchParams.get("type")?.toLowerCase() === "register" ||    url.searchParams.get("loginstatus")?.toLowerCase() === "register";  const affCode = isSignup ? refCodes[site]?.signup : refCodes[site]?.visit;  if (!affCode) return;  // If CNFans already carries the extension's own code, don't re-process  if (site === "CNFans") {    const blockedRef = "49564";    if (url.searchParams.get("ref") === blockedRef) return;  }  // Strip any existing affiliate code and set the extension's own  applyAffiliateParams(url, affCode);  const finalUrl = url.toString();  if (finalUrl === href) return;   // nothing changed, don't touch the URL  // UsFans tracks affiliate credit server-side, so a same-document URL  // rewrite isn't enough — force one real navigation carrying the code.  if (site === "UsFans") {    const FLAG = "usfans_ref_redirected_v1";    if (sessionStorage.getItem(FLAG) === "1") return;  // already redirected once this session    const hasRef = new URL(finalUrl).searchParams.get("ref") === "RFGVYE";    if (hasRef) {      sessionStorage.setItem(FLAG, "1");      window.location.replace(finalUrl);   // real navigation, not just address-bar rewrite      return;    }  }  // All other sites: rewrite the address bar without reloading the page  window.history.replaceState({}, "", finalUrl);};

Stripping existing codes and inserting the extension's own

const applyAffiliateParams = (urlObj, affCode) => {  // Walk every affiliate key the extension knows about, for every site,  // and delete it from the current URL — this is what removes a  // pre-existing affiliate code, whether it's the user's own or a  // third party's, before the extension's code is applied.  Object.values(refCodes).forEach((codeObj) => {    Object.values(codeObj).forEach((code) => {      const clean = (code.startsWith("?") || code.startsWith("&")) ? code.slice(1) : code;      const params = new URLSearchParams(clean);      for (const key of params.keys()) urlObj.searchParams.delete(key);    });  });  // Now set the extension's own hardcoded code for this site/flow  const cleanAff = (affCode.startsWith("?") || affCode.startsWith("&")) ? affCode.slice(1) : affCode;  const codeParams = new URLSearchParams(cleanAff);  for (const [k, v] of codeParams.entries()) urlObj.searchParams.set(k, v);};
Captured request
GEThttps://www.usfans.com/product/2/12345?ref=RFGVYE

200 response (~5.3KB). The page was requested with no ref parameter; the content script forced a real navigation via window.location.replace() that added ref=RFGVYE, the extension's hardcoded UsFans code, before the request left the browser.

Check if you're affected

Paste into the DevTools console on any of the extension's supported shopping-agent sites before opening a product or registration page. Logs every URL change so you can see an affiliate parameter get added or replaced in real time.

Requires
  • Chrome with the extension installed
  • DevTools console access
affiliate-rewrite-watcher.js · js
// affiliate-rewrite-watcher.js// Paste into the DevTools console on a supported shopping-agent site// (e.g. cnfans.com, acbuy.com, usfans.com) BEFORE navigating to a// product or registration page. Logs every URL change so you can see// an affiliate parameter get added or replaced.(function () {  let lastUrl = location.href;  const report = (how) => {    if (location.href === lastUrl) return;    console.log(`[AFFILIATE_WATCH] URL changed via ${how}:`);    console.log('  before:', lastUrl);    console.log('  after: ', location.href);    lastUrl = location.href;  };  const origPush = history.pushState;  const origReplace = history.replaceState;  history.pushState = function (...args) {    const r = origPush.apply(this, args);    report('pushState');    return r;  };  history.replaceState = function (...args) {    const r = origReplace.apply(this, args);    report('replaceState');    return r;  };  window.addEventListener('popstate', () => report('popstate'));  window.addEventListener('beforeunload', () => {    console.log('[AFFILIATE_WATCH] page navigating away to:', location.href);  });  console.log('[AFFILIATE_WATCH] installed. Open a product or /register URL and watch for URL changes above.');})();
How to run it
  1. 1Open a supported site, e.g. cnfans.com.
  2. 2Open DevTools console, paste this script.
  3. 3Visit a product page with your own code, e.g. URL ending &ref=YOUR_CODE.
  4. 4Watch the console log your code replaced.

What it can do

Permissions this extension asks for, as declared in version 1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on yupoo.com

    *://*.yupoo.com/*

  • Read and change your data on weidian.com

    *://*.weidian.com/*

  • Read and change your data on cnfans.com

    *://*.cnfans.com/*

  • Read and change your data on allchinabuy.com

    *://*.allchinabuy.com/*

  • Read and change your data on acbuy.com

    *://*.acbuy.com/*

  • Read and change your data on orientdig.com

    *://*.orientdig.com/*

  • Read and change your data on sugargoo.com

    *://*.sugargoo.com/*

  • Read and change your data on superbuy.com

    *://*.superbuy.com/*

  • Read and change your data on mulebuy.com

    *://*.mulebuy.com/*

  • Read and change your data on hoobuy.com

    *://*.hoobuy.com/*

  • Read and change your data on oopbuy.com

    *://*.oopbuy.com/*

  • Read and change your data on kakobuy.com

    *://*.kakobuy.com/*

  • Read and change your data on usfans.com

    *://*.usfans.com/*

  • Read and change your data on api.weberowsky-yt.workers.dev

    https://api.weberowsky-yt.workers.dev/*

  • Store data in your browser

    storage

Updated 30 September 2026mjnldiicgkoihdpikipondpbhnbhbdcn