Security audit

toutiao-publish-docx

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to publish Toutiao articles, but it handles account cookies and shell commands in a way users should review carefully before installing.

Install only if you trust the environment and understand it can act as your logged-in Toutiao account, including publishing content. Treat cookie_header as a password-equivalent secret, avoid pasting it into ordinary prompts or logs, prefer a protected secret channel, and ensure commands are executed with structured arguments rather than text-substituted shell strings.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Shell Command Injection Through Untrusted Parameter Interpolation
Content: View full analysis
' \ ./.venv/bin/python -m toutiao_poster post \ --title '' \ --content-text '<content>' \ ``` The same unsafe interpolation pattern also appears in the publishing and image-upload examples at lines 52–55, 64–69, 78–80, 103–106, and 139–142. ### Technical Analysis The skill instructs an agent to substitute user-controlled `cookie_header`, `title`, and `content` values directly into a shell command. Wrapping a placeholder in literal single quotes is not sufficient sanitization: an input containing a single quote can terminate the quoted string and introduce shell operators or additional commands. For example, if raw substitution is used, a title shaped like the following can escape the intended argument: ```text '; attacker_command; # ``` The vulnerability applies to other interpolated values as well, including image paths. Whether exploitation succeeds depends on the calling agent constructing and executing the documented command through a shell without robust argument escaping. The artifact does not contain the caller or the referenced `toutiao_poster` implementation, so that runtime behavior could not be independently verified. ### Attack Path 1. An attacker supplies a crafted title, article body, cookie header, or image path containing a single quote and shell metacharacters. 2. The agent replaces the corresponding placeholder in the documented shell template with the supplied value. 3. The inserted single quote closes the intended quoted argument. 4. The system shell interprets the remaining attacker-controlled text as shell syntax. 5. The injected command executes with the operating-system privileges of the account running the skill, identified in the document as an Ubuntu environment. ### Impact Assessment Successful exploitation c ...[truncated 559 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:42
Finding: Authentication Cookie Exposed in Rendered Shell Commands
Content: View full analysis
' \ ./.venv/bin/python -m toutiao_poster post \ --title '' \ --content-text '<content>' \ ``` Equivalent plaintext cookie handling is documented in additional examples at lines 52, 64, 103, and 139. ### Technical Analysis The complete Toutiao authentication cookie is embedded directly into rendered command text. Although the value is assigned as an environment variable rather than passed as a program argument, the command itself can still be retained by the agent transcript, shell history, execution telemetry, debug logs, error reports, or command-echo output. A valid session cookie functions as an authentication credential. Anyone able to retrieve it may be able to impersonate the authenticated browser session until the session expires, is revoked, or is otherwise invalidated. The project contains only `SKILL.md`; therefore, it is not possible to determine whether the external runner suppresses command logging or redacts secrets. The documented pattern nevertheless encourages plaintext secret insertion into a potentially recorded command channel. ### Attack Path 1. A user supplies a valid `cookie_header` to authenticate to `mp.toutiao.com`. 2. The agent places the complete cookie into the documented command template. 3. The rendered command is stored or displayed in a transcript, shell history, diagnostic log, telemetry record, or error report. 4. A party with access to that record extracts the cookie. 5. The exposed cookie is replayed against the Toutiao service before it expires or is revoked. 6. If the service accepts the replayed session, the party acts with the permissions associated with the compromised account. ### Impact Assessment A successfully replayed cookie may permit unauthorized access to the associated Tout ...[truncated 395 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly encourages passing a raw cookie_header for authentication but does not warn that browser cookies are bearer secrets that can fully impersonate the user's Toutiao session. In an agent setting, this increases the chance that users paste highly sensitive session material into prompts, logs, histories, screenshots, or downstream tooling, enabling account takeover if exposed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.