Auto Publisher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:37 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its auto-publishing purpose, but it can post publicly to multiple social accounts and keeps account/log data locally without enough safeguards or confirmation controls.

Review before installing. Use it only with accounts where automated posting is acceptable, start with one platform in a visible browser, avoid putting real passwords in config/accounts.json, protect or delete local config and publish_log.json files, and treat any saved browser sessions or cookies as account credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auto_publisher.py:37

Finding

Account Configuration Supports Plaintext Credential Storage

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The core declared purpose of multi-platform video publishing is mostly accurate: the script automates browser-based login and posting to Douyin, WeChat Channels, Xiaohongshu, Bilibili, and YouTube. However, several advertised capabilities are not actually implemented. There is no scheduling logic, no queue or delayed publishing flow, and no batch processing over multiple videos. The 'auto-caption generation' is limited to choosing from a few hardcoded text templates based on filename/topic, which is materially weaker than typical caption generation. 'Hashtag optimization' is likewise overstated, since the code only creates a small static list of generic tags rather than optimizing them. Therefore the description overstates important capabilities relative to the supplied code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly says login cookies are saved for reuse, but it does not warn that cookies are active session credentials that can allow account takeover if copied from disk. In the context of a multi-platform auto-publisher handling creator accounts across several services, stored browser/session cookies are especially sensitive because compromise could grant broad access to posting capabilities and account data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill advertises automation that reads and writes local files, but it does not declare any tool scope or permissions boundaries in the skill manifest. This creates an avoidable transparency and trust problem: users and hosting systems cannot clearly assess or constrain filesystem access before use, increasing the chance of unintended exposure or modification of local data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation says local account configuration and publish-log files are created automatically, but it does not clearly foreground that authentication/session material and activity history will be persisted on disk. In a tool handling social-media accounts, local storage of cookies or session state can expose account access and sensitive operational history if the files are read by other users, malware, backups, or synced services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script proceeds directly from parsed CLI arguments into automated publishing across one or more live social-media platforms without a final confirmation, dry-run, or explicit warning that posting is irreversible. In the context of a mass auto-publisher, this increases the likelihood of accidental public disclosure, brand damage, or distribution of the wrong content at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The README notes that publish records are stored in publish_log.json but does not warn that those logs may contain sensitive operational metadata such as filenames, posting times, target platforms, titles, and tags. While this is less severe than credential exposure, such logs can still leak business activity, content schedules, and account usage patterns if accessed by other users or malware.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Most of the substantive usage instructions, feature descriptions, trigger phrases, and security notes are presented only in Chinese, despite a partially bilingual heading. This can be a natural-language policy issue if organizational policy requires not forcing a specific language or locale without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file's user-facing description and operational prompts are presented in Chinese, framing the tool as a Chinese-language assistant without any indication of alternate language support or user choice. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/auto_publisher.py (reported line 514)May include surrounding context.

python

print(f"{'='*60}")
                
                # 登录
                login_func = getattr(self, f'login_{platform}', None)
                if login_func:
                    if not login_func():
                        self.results[platform] = False

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/auto_publisher.py (reported line 521)May include surrounding context.

python

continue
                
                # 发布
                publish_func = getattr(self, f'publish_{platform}', None)
                if publish_func:
                    success = publish_func(str(video_path), title, tags)
                    self.results[platform] = success

Static analysis

No suspicious patterns detected.