ClawHub
Back to skill

Security audit

toutiao-publish-docx

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Toutiao publishing helper, but it requires account-session access and can publish posts when the user enables publishing.

Install only if you are comfortable letting the agent access your Toutiao account session and prepare or publish posts. Treat cookie_header like a password, avoid placing it in logs or shared prompts, review content before setting publish=true, and remember that saved screenshots or artifact folders may contain draft or account-visible information.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs operators to pass a raw browser cookie header into an environment variable for authentication, but provides no warning that this value is a highly sensitive session secret equivalent to account access. In an agent or automation context, such cookies can be exposed through logs, shell history, process inspection, screenshots, crash reports, or downstream tool traces, enabling unauthorized publication and account takeover of the Toutiao session.

Static analysis

No suspicious patterns detected.