toutiao-publish-docx

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:42 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed Toutiao publishing helper, but it requires account-session access and can publish posts when the user enables publishing.

Install only if you are comfortable letting the agent access your Toutiao account session and prepare or publish posts. Treat cookie_header like a password, avoid placing it in logs or shared prompts, review content before setting publish=true, and remember that saved screenshots or artifact folders may contain draft or account-visible information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs operators to pass a raw browser cookie header into an environment variable for authentication, but provides no warning that this value is a highly sensitive session secret equivalent to account access. In an agent or automation context, such cookies can be exposed through logs, shell history, process inspection, screenshots, crash reports, or downstream tool traces, enabling unauthorized publication and account takeover of the Toutiao session.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.