Is Simple Allow Copy safe?

Medium risk

Simple Allow Copy routes Chrome updates through agency.pictureknow.com and injects server-controlled affiliate links into shopping pages.

The extension sets a PAC proxy that intercepts Chrome's update requests to clients2.google.com and redirects them through agency.pictureknow.com, a server controlled by the extension developer. The proxy server address is stored as AES-encrypted ciphertext in the bundle with a hardcoded key. On Taobao, Tmall, and JD.com product pages, the extension fetches configuration from api.pictureknow.com and uses it to inject DOM elements and affiliate link buttons whose targets can be changed remotely at any time.

tomxuxuv2.1.6Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Server-controlled config drives link injection on Taobao, Tmall, and JD pages

On item.taobao.com, detail.tmall.com, and item.jd.com, the extension fetches a config from api.pictureknow.com and injects a button/link per it.

On JD it added a coupon button to coupons.pictureknow.com; the server controls injection.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a product page on Taobao, Tmall, or JD.com.

The content script's componentDidMount fires and requests a page config from api.pictureknow.com/api/v1/page/info with a hardcoded id.

The extension did this

The extension injects a button and link into the page using values from the server's response.

The response's url, selectors, and button HTML template are used to build and insert an anchor whose href is derived from the server-supplied base URL plus the page title.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://api.pictureknow.com/api/v1/page/info?id=1152437ca8084e5ab50327ec66fb5662
Observed during dynamic analysis on https://item.jd.com/100012043978.html: the background service worker fetched this URL (HTTP 200, ~498-byte JSON body). The response carried valid:1, a base url of https://coupons.pictureknow.com?key=, an icon JSON with the parent selector .bottom-btns-root and title selector .sku-title-name, and a button HTML template (an anchor labelled 优惠券). The content script injected this button into the JD product page.
03EvidenceFIELD TABLE
Server-controlled response fields used to build the injected element
FieldValueWhy it matters
Injected link base URL
https://coupons.pictureknow.com?key=The destination the injected button links to; controlled by the server.
Button HTML template
<a coupon_place>优惠券</a>The HTML inserted into the page; the placeholder is replaced with the link.
Container selector
.bottom-btns-rootWhere on the page the button is placed.
Title selector
.sku-title-nameElement whose text is appended to the injected link URL.
Enable flag
valid: 1Injection only runs when the server returns this as truthy.
04EvidenceCODE COMPARE
The code that does this

Fetching the remote config and injecting the server-supplied link

What it actually does
Same logic, readablejs/jd_coupon_content.js
// On a JD product page:
const url = v().host + "api/v1/page/info?id=1152437ca8084e5ab50327ec66fb5662";
sendMessage({ type: "request", params: { url } }).then((resp) => {
  const host = resp.url;          // server-controlled base, e.g. https://coupons.pictureknow.com?key=
  const data = JSON.parse(resp.icon); // server-controlled selectors + button template
  if (resp.valid) injectButton();
});

function injectButton() {
  const container = $(data.parent);              // e.g. .bottom-btns-root
  const title = $(data.title).text();            // e.g. .sku-title-name
  const href = host + encodeURIComponent(title);
  const html = data.button.replace("coupon_place", `href="${href}" target="_blank"`);
  container.append(html);                         // injected into the JD page
}

Data recipients

agency.pictureknow.comapi.pictureknow.com
Updated 17 September 2026jhodmcfehicjonjdoljadkbkenaoehfm