weibo-auto-post

• Outcome: Review
• Latest audit: May 28, 2026 · 11:49 AM UTC
• Version: 1.0.0

Overview

This Weibo automation is mostly disclosed and purpose-aligned, but it can post publicly from a logged-in account, run scheduled posts, take screenshots, overwrite the clipboard, and delete matching files with weak safeguards.

Install only if you are comfortable with an agent operating your desktop and publishing to a live Weibo account. Use a test account or separate browser profile, require manual review before each post, avoid unattended cron jobs until you add a dry-run or approval gate, and change cleanup to a dedicated temporary folder that deletes only files created by that run.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

$img.Dispose()
Write-Output "CLIPBOARD_OK"
'''
        result = subprocess.run(["powershell", "-Command", ps_cmd], capture_output=True, text=True)
        if result.returncode == 0:
            print(f"[clipboard] Image copied: {args.image}")
        else:

• Confidence: 97% confidence
• Finding: This PowerShell command embeds the user-controlled image path directly into a script string without escaping PowerShell metacharacters. An attacker who can supply a crafted --image value could break out of the quoted string and inject arbitrary PowerShell commands, leading to code execution under the current user context.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill invokes shell commands and appears to rely on environment access, but it does not declare permissions or clearly bound those capabilities. In practice this hides impactful behavior from users and hosts, making it easier for the skill to execute local commands, manipulate files, and interact with the system without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose understates several impactful behaviors: screenshot capture, local file deletion, and browser-driven posting on a logged-in account. This mismatch is dangerous because users may authorize a seemingly simple image/posting helper without realizing it can capture screen contents and remove local files, which increases privacy and integrity risk.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests like 'help me post to Weibo' or 'generate a Weibo image,' which can cause the skill to activate in situations where the user did not intend full automation. In this context, overbroad activation is more dangerous because the skill can post publicly, use browser automation, and delete files afterward.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes automatic public posting and deletion of local files but does not present an explicit warning or consent step for those high-impact actions. Because it acts on a logged-in social media session and removes files using wildcard patterns, accidental or misunderstood execution could cause unauthorized posts, privacy exposure, or unintended data loss.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: These instructions explicitly tell the agent to perform browser automation to publish to Weibo, write execution records to a local file, and delete local image files, but they do not present these as side effects requiring explicit user acknowledgement. In a skill whose purpose is automated posting, undisclosed posting and filesystem modification materially increase the risk of unintended account actions, duplicate posts, and silent local data changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The example cron payload instructs the agent to search trending topics, generate content, post through browser automation, and record links into a local markdown file, yet the guide frames this as normal setup without any warning that future scheduled runs will autonomously act on the user's account and modify local state. Because this is a recurring cron job, the lack of disclosure is more dangerous than a one-off action: it can repeatedly post or edit files without fresh review.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script silently deletes files from a fixed Pictures path and the TEMP directory using broad wildcard patterns, without explicit user confirmation. In an automation skill that manipulates the user's desktop, unexpected file deletion is risky because it can remove legitimate user files matching the pattern and reduces user control over side effects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function overwrites the system clipboard with user text without warning or restoring prior contents. In a desktop automation skill, clipboard hijacking is security-relevant because it can disrupt user workflows, destroy sensitive copied data, and create opportunities for unintended pastes into other applications if focus changes.

Static analysis

No suspicious patterns detected.