ClawHub
Back to skill

Security audit

微博下载器 / Weibo Downloader

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Weibo media downloader, but it needs review because it stores long-lived visitor cookies and auto-loads them using an unsafe format.

Install only if you are comfortable with the tool contacting Weibo, creating visitor session cookies, and keeping them locally for up to about a year. Keep the skill directory private, do not use cookie files from anyone else, avoid untrusted batch URL lists, and prefer a version that stores cookies in JSON with restrictive permissions and validates fx URLs strictly.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/weibo_core.py:61
Finding

Unsafe Cookie Deserialization Allows Arbitrary Code Execution

Content
View full analysis

Vulnerability Details

File Location: scripts/weibo_core.py, lines 61–63
Vulnerability Type: Unsafe Python pickle deserialization
Risk Level: High

Vulnerable Code

python
with open(COOKIE_FILE, "rb") as f:
    jar = pickle.load(f)
session.cookies.update(jar)

Technical Analysis

The application automatically deserializes storage/weibo_cookies.pkl using pickle.load(). Python pickle data is executable serialization: specially constructed objects can invoke attacker-selected callables during deserialization.

The file is loaded without validating its integrity, ownership, permissions, type, or contents. Consequently, the fact that the resulting object is expected to be a cookie jar does not prevent code execution because the malicious operation occurs inside pickle.load() before session.cookies.update() is reached.

Attack Path

  1. An attacker gains the ability to create or replace storage/weibo_cookies.pkl. This could occur through shared-directory access, another compromised process, a malicious archive overlay, or modification of a writable project checkout.
  2. The attacker generates a pickle payload whose reduction operation invokes arbitrary Python or operating-system functionality.
  3. A user runs the downloader when the session does not already contain the required cookie.
  4. _ensure_cookies() calls _load_cookies().
  5. _load_cookies() invokes pickle.load() on the attacker-controlled file.
  6. The embedded callable executes with the privileges of the user running the downloader.

Impact Assessment

Successful exploitation provides arbitrary code execution under the downloader process's operating-system account. The attacker could read or modify any files accessible to that account, steal local credentials, alter downloaded content, invoke network services, or install additional user-level persistence.

This does not inherently provide administrator or root priv ...[truncated 260 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove pickle-based cookie persistence entirely.
  2. Serialize only required primitive cookie attributes, such as name, value, domain, path, expiry, and secure flags, using JSON.
  3. Validate every decoded field against an explicit schema before reconstructing the cookie jar.
  4. Create the storage directory and cookie file with restrictive permissions, such as directory mode 0700 and file mode 0600 on supported systems.
  5. Reject cookie files that are symbolic links, are not regular files, have unexpected ownership, or are writable by other users.
  6. If integrity must be protected against unauthorized local modification, authenticate the serialized data with a securely managed MAC key. A signature does not make pickle safe; it should only supplement a non-executable format.
  7. Remove or safely migrate any existing .pkl cookie file rather than deserializing it during migration.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/weibo_core.py:304
Finding

Improper Share URL Validation Permits Server-Side Request Forgery

Content
View full analysis

Vulnerability Details

File Location: scripts/weibo_core.py, lines 139–145 and 304–305
Vulnerability Type: Server-side request forgery through insufficient URL and redirect validation
Risk Level: Medium

Vulnerable Code

python
def resolve_fx_url(url, session=None):
    """解析 mapp.api.weibo.cn/fx/ 分享链接为真实微博链接"""
    s = session or requests.Session()
    try:
        # 不跟进重定向，直接看 location
        r = s.get(url, headers=HEADERS, allow_redirects=False, timeout=10)
        if r.status_code in (301, 302) and "location" in r.headers:
            real_url = r.headers["location"]
            print(f"  🔗 分享链接 → {real_url}")
            return real_url
        # 如果没重定向，降到 HTML 里找 return_url
        r = s.get(url, headers=HEADERS, timeout=10)
python
# 处理 fx 分享链接
if "mapp.api.weibo.cn/fx/" in url:
    url = resolve_fx_url(url, session)

Technical Analysis

The application decides whether to resolve a share URL by searching for the literal string mapp.api.weibo.cn/fx/ anywhere in the supplied URL. It does not parse the URL and require that the actual hostname equals mapp.api.weibo.cn.

An attacker can therefore place the expected text in the path or query of a URL whose real destination is another host. resolve_fx_url() then sends a request to that attacker-selected destination. If the first response is not a recognized redirect, the second s.get() follows redirects by default, and neither the initial destination nor subsequent redirect targets are checked for loopback, private, link-local, or otherwise restricted addresses.

Although the first response body is not directly returned to the attacker, request timing, status-dependent behavior, redirect behavior, terminal output, and observable interactions with an attacker-controlled endpoint may provide an SSRF oracle.

Attack Path

  1. An attacker provides a crafted command-line URL or inserts it into a batch input fi ...[truncated 1472 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse input with urllib.parse.urlsplit() or an equivalent standards-compliant parser.
  2. Require the scheme to be exactly https and the normalized hostname to be exactly mapp.api.weibo.cn.
  3. Reject embedded user information, malformed hostnames, fragments, unexpected ports, and backslash-based parser ambiguities.
  4. Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and unspecified IPv4 and IPv6 addresses.
  5. Keep automatic redirects disabled and process redirects manually with a strict maximum count.
  6. Parse and validate every redirect destination before sending the next request. Apply the same scheme, hostname, port, and IP-address restrictions at every hop.
  7. Allow only expected Weibo redirect hosts and URL paths rather than accepting arbitrary destinations.
  8. Apply outbound firewall or sandbox rules so the process cannot access localhost, private networks, or cloud metadata addresses when such access is unnecessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents behavior that fetches visitor credentials from Weibo and stores cookies locally for 365 days, but it does not include a user-facing warning about the privacy and persistence implications of that behavior. Under SQP-2 for markdown files, descriptions should warn when skill behavior may affect user data or privacy.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises and instructs use of network access and local file storage, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can cause an agent platform or user to grant broader capabilities than intended without clear consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states that it persists visitor cookies for 365 days in a local pickle file, but the user-facing description does not clearly warn about the privacy and security implications of storing long-lived authentication-related tokens on disk. If that file is exposed through local compromise, backup leakage, or multi-user environments, the cookies could be reused to access Weibo as that visitor session and may reveal browsing activity or enable unintended requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill handles and persists Weibo authentication-like cookies without explicit user warning or consent. In this context, the lack of disclosure is security-relevant because the module quietly stores reusable session material for about a year, which can surprise users and increase the chance of credential leakage or unauthorized reuse.

Content

No source excerpt is available for this finding.

Insecure deserialization: pickle.load()

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The code deserializes a cookie jar from disk using pickle.load(), which can execute arbitrary code if the file is replaced or tampered with. Because the file is loaded automatically on normal execution, any attacker who can write to storage/weibo_cookies.pkl can achieve code execution when the skill runs.

Content

Scanner excerpt · scripts/weibo_core.py (reported line 64)May include surrounding context.

python
return False
    try:
        with open(COOKIE_FILE, "rb") as f:
            jar = pickle.load(f)
        session.cookies.update(jar)
        # 检查 SUB 是否还在有效期内
        if "SUB" in session.cookies:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This module automatically acquires visitor cookies and persists them for long-term reuse in order to bypass Weibo's visitor gating. That behavior expands the skill from simple downloading into credential/session persistence and access-control circumvention, increasing privacy, compliance, and account/session misuse risk if the stored cookies are exposed or reused unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The documented instructions and descriptions are predominantly in Chinese, with only a brief English title, which can amount to an implicit language constraint without user opt-in. SQP-3 applies to language or locale policy violations when a skill forces a specific language without offering a choice or clear justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency is specified as requests>=2.28.0, which allows any future version to be installed and makes builds non-reproducible. This increases supply-chain risk and can unexpectedly pull in vulnerable or breaking releases, especially for a downloader skill that makes network requests to untrusted external URLs.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Because the manifest does not pin requests to a specific patched version, it is impossible to verify whether installations will avoid known advisories affecting some requests releases. In a skill designed to fetch remote content and bypass visitor restrictions, this uncertainty matters more because attacker-controlled URLs or network interactions may expose any unpatched client-side issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The module docstring and user-facing usage text are written only in Chinese, which can impose a specific language on users without opt-in. The policy allows locale constraints when explicitly documented and justified, but this file does not state that it is intentionally Chinese-only or region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module description and all user-visible status/error messages are written exclusively in Chinese, which imposes a specific language on users without opt-in or documented locale scope. This matches the policy concern for language/locale constraints that are not optional or justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring states that cookies are loaded from a home-directory path, implying one storage location. The actual COOKIE_FILE constant resolves to a path under the project directory's storage folder, so the inline documentation actively contradicts runtime behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

Saving downloaded files is expected for a downloader, but this file additionally writes session cookies to a persistent pickle file under storage/. The manifest description does not mention local persistence of authentication/session material, creating a mild description-to-behavior mismatch.

Content

No source excerpt is available for this finding.