Social Media Automation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:31 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent social-media automation guide, but it directs automated real-account publishing and reporting with credentials/cookies without enough guardrails.

Review before installing or adapting this skill. Use dedicated low-privilege platform accounts, prefer official APIs over cookie automation, add dry-run and explicit approval before public posts, verify the target account before publishing, protect and rotate tokens/cookies, redact query strings from logs, validate platform names against an allowlist, and configure Feishu report recipients and report contents narrowly.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:108

Finding

Access Token Exposed Through URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108-124
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

python

# 配置
API_BASE = "https://api.weixin.qq.com"
ACCESS_TOKEN = "xxx"

# 发布视频
def publish_video(title, video_url, cover_url):
    response = requests.post(
        f"{API_BASE}/channel/post",
        params={"access_token": ACCESS_TOKEN},
        json={
            "title": title,
            "media_video_url": video_url,
            "cover_url": cover_url
        }
    )
    return response.json()

Technical Analysis

The documented implementation transmits the WeChat access token as a URL query parameter. HTTPS protects the request while it is in transit, but URL query strings are commonly retained by application logs, reverse proxies, gateways, monitoring systems, debugging tools, and exception reports.

Authentication is necessary for the declared publishing functionality. However, exposing the credential in a URL exceeds the minimum safe disclosure necessary when the service supports an authorization header or another protected authentication mechanism. The example also provides no log-redaction, token-scoping, or rotation controls.

This finding applies to implementations that adopt the documented code. Whether an authorization header can replace the query parameter depends on the requirements of the specific official API endpoint.

Attack Path

1. The Skill sends a publishing request containing access_token in the query string.
2. An HTTP client, API gateway, proxy, monitoring service, or server records the complete request URL.
3. An attacker or unauthorized operator obtains read access to those logs or diagnostic records.
4. The attacker extracts the bearer token from the recorded URL.
5. Before the token expires or is revoked, the attacker submits authenticated API requests usin ...[truncated 458 chars]

Remediation

View remediation

Remediation Suggestions

1. Use an Authorization header when supported by the official API:

   python

   headers = {"Authorization": f"Bearer {access_token}"}
   requests.post(endpoint, headers=headers, json=payload, timeout=30)
   

2. If the API requires a query-string token, configure all application, proxy, gateway, and monitoring layers to redact the access_token parameter.
3. Never record complete request URLs, headers, or response bodies when they may contain credentials.
4. Retrieve tokens from an encrypted credential store rather than source code or ordinary configuration files.
5. Assign the narrowest available API scopes and use short-lived tokens where supported.
6. Implement automatic expiration handling, rotation, and immediate revocation procedures.
7. Add explicit network timeouts and validate that requests are sent only to an allowlisted official API hostname.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:228

Finding

Path Traversal Through Unvalidated Platform Identifier

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 228-240
Vulnerability Type: Path traversal and unintended local file access
Risk Level: Medium

Vulnerable Code

python

class AccountManager:
    def __init__(self, key_file='.credentials/key.key'):
        self.key = load_key(key_file)
        self.cipher = Fernet(self.key)
    
    def save_account(self, platform, account_info):
        encrypted = self.cipher.encrypt(
            json.dumps(account_info).encode()
        )
        with open(f'.credentials/{platform}.enc', 'wb') as f:
            f.write(encrypted)
    
    def load_account(self, platform):
        with open(f'.credentials/{platform}.enc', 'rb') as f:
            encrypted = f.read()
        decrypted = self.cipher.decrypt(encrypted)
        return json.loads(decrypted.decode())

Technical Analysis

The platform argument is interpolated directly into a filesystem path without validation or canonicalization. If an untrusted caller can control this value, traversal components such as ../ can cause the resolved path to leave the intended .credentials directory.

In save_account, this permits creation or truncation of files reachable by the process, although the written content is Fernet-encrypted account data rather than arbitrary attacker-selected plaintext. In load_account, an attacker can select unintended files for reading, but successful disclosure is constrained because the selected content is subsequently passed to Fernet decryption and JSON parsing. Files that are not valid ciphertext for the configured key will normally cause an error rather than be returned.

The code therefore violates least-privilege filesystem boundaries even though the practical impact is constrained by process permissions and the encryption/parsing steps. This finding applies if the documented example is implemented and platform can be influenced by an untrusted inpu ...[truncated 1388 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace dynamic filenames with a fixed allowlist:

   python

   PLATFORM_FILES = {
       "xiaohongshu": "xiaohongshu.enc",
       "wechat": "wechat.enc",
   }
   
   filename = PLATFORM_FILES.get(platform)
   if filename is None:
       raise ValueError("Unsupported platform")
   

2. Build paths with pathlib.Path, resolve them, and verify that the final path remains under the expected credentials directory.
3. Reject absolute paths, path separators, traversal components, null bytes, and unsupported platform identifiers.
4. Open files using restrictive permissions and run the process under a dedicated, unprivileged operating-system account.
5. Use atomic writes through a securely created temporary file followed by replacement to reduce corruption risk.
6. Handle Fernet decryption and JSON parsing failures without exposing sensitive filesystem details.
7. Add tests covering ../, absolute paths, symbolic links, nested traversal, unsupported platform names, and malformed encrypted files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The browser-automation path reuses login cookies and directly clicks the publish button, enabling full account actions if cookies are stolen, misloaded, or used on the wrong account. Because this operates against production creator portals, mistakes or compromise can lead to unauthorized posting, account takeover effects, or platform enforcement against the user.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

md

| 问题 | 原因 | 解决方案 |
|------|------|----------|
| API 调用失败 | Token 过期 | 刷新 Access Token |
| 发布失败 | 内容违规 | 检查合规用词 |
| Cookie 失效 | 登录态过期 | 重新扫码登录 |
| 图片上传失败 | 格式/大小不符 | 转为 JPG，<10MB |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises automatic posting, browser automation, and outbound reporting without clearly warning users about account sanctions, accidental publication, or transmission of business data to third-party services. In this context, users may enable automation on real social-media accounts without understanding operational and compliance risks, making the omission security-relevant.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

# 发布笔记
def publish_note(title, content, images):
    response = requests.post(
        f"{API_BASE}/note/publish",
        headers={"Authorization": f"Bearer {ACCESS_TOKEN}"},
        json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

# 发布视频
def publish_video(title, video_url, cover_url):
    response = requests.post(
        f"{API_BASE}/channel/post",
        params={"access_token": ACCESS_TOKEN},
        json={

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Automatically sending daily reports to Feishu is an external data transfer, but the document does not disclose what operational or account-performance data will be transmitted or who can access it. This can expose business-sensitive metrics or content plans to unintended recipients through misconfiguration or overbroad sharing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

全文标题、说明、流程和模板均默认以中文面向用户，未看到关于语言可选项、用户偏好继承或区域限定理由的说明。根据 SQP-3，若技能强制特定语言而没有用户选择或明确、合理的区域性约束，可能构成自然语言政策问题。

Content

No source excerpt is available for this finding.