Article Fetcher（文章抓取+Notion/Obsidian知识库存档）

• Outcome: Pass
• Latest audit: Jul 19, 2026 · 3:15 AM UTC
• Version: 1.3.4

Overview

The skill does what it advertises: fetches supported articles, uploads images, optionally sends article text to configured services, and archives results, with no hidden exfiltration or destructive behavior found.

Install only if you are comfortable giving the skill Aliyun OSS credentials and, if enabled, Notion and LLM API access. Use limited-scope OSS and Notion credentials, use low-risk platform cookies, avoid sending private or regulated articles to the configured LLM endpoint, and upgrade the pinned lxml dependency before routine use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The README states that cookies and other sensitive information 'will not be uploaded or leaked,' but the documented fetch flow explicitly uses those cookies in HTTP requests and Playwright sessions against third-party platforms. Even if the skill does not exfiltrate cookies to the author, it does transmit authenticated session data to external services, so the security claim is misleading and may cause users to underestimate privacy and account-risk exposure.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The Playwright fallback loads stored authentication cookies into a real browser context and then navigates to a user-supplied URL. If URL validation is weak upstream or a malicious/redirecting Zhihu URL is accepted, those cookies could be exposed to unintended origins or used for authenticated actions in a live session. In this skill’s context, automated scraping with account cookies makes the risk more significant because the browser is intentionally acting as the user against a remote site.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code sends article text to a configurable external LLM endpoint for keyword extraction, but there is no explicit consent gate, data-classification check, or transmission warning at the point where potentially sensitive article content is uploaded. In a content archiving skill, users may process private, paywalled, unpublished, or regulated material, so silent third-party transmission creates a real confidentiality and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

for attempt in range(3):
        try:
            timeout = [60, 90, 120][attempt]
            response = requests.post(endpoint, headers=headers, json=body, timeout=timeout)

            if response.status_code == 200:
                return response.json()['choices'][0]['message']['content']

• Confidence: 95% confidence
• Finding: requests.post(endpoint, headers=headers, json=

Known Vulnerable Dependency: lxml==6.0.4 — 2 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2026-41066 (lxml is a library for processing XML and HTML in the Python language. Prior to 6)

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: lxml==6.0.4

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.