T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/publish.py:244- Finding
Session Cookie Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Juejin Publisher
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to publish Juejin articles as advertised, but it handles a full browser session cookie and can publish immediately with weak credential-safety guidance.
Review before installing. Use this only on a trusted machine and only if you are comfortable giving the skill a full Juejin browser Cookie that can act on your account. Prefer a local credential file or protected environment variable, avoid the --cookie command-line option, use --draft-only first to verify content, and rotate the Cookie if it may have appeared in history or logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented behavior materially overstates what the skill does, including claims around authenticated publishing, Markdown processing, and metadata handling that are not actually implemented. This mismatch is dangerous because users may provide sensitive cookies or trust the skill to perform controlled publishing actions when the real implementation may behave differently, making review and safe use much harder.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README instructs users to place a Juejin Cookie into an environment file and use it for publishing, but it provides no warning that the cookie is a sensitive bearer credential that can enable account actions if exposed. In this skill context, the risk is heightened because publishing is performed through official authenticated APIs, so mishandling the cookie could directly lead to unauthorized article publication or account misuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill advertises and instructs use of sensitive capabilities including reading a local credential file and making authenticated network requests, but it declares no explicit tool scope or permissions boundary. In an agent setting, this increases the chance that the skill can access files or secrets more broadly than intended, especially since it handles a reusable Juejin Cookie copied from the browser.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation phrase is broad enough that an assistant may trigger the skill from natural-language requests without strong confirmation or constraints. Because the skill is intended to read credentials and publish content over the network, overly permissive triggering can lead to accidental use, unintended publication, or use with the wrong file/content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language strings in the docstring and console output are written only in Chinese, and the usage model does not indicate that language selection is optional. This creates a locale policy issue because the skill effectively forces a specific language without user opt-in or documented justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import urllib.request import urllib.parse API_URL = "https://api.juejin.cn/tag_api/v1/query_tag_list" def search_tags(keyword): params = urllib.parse.urlencode({
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language instructions and description are written in Chinese, which can impose a language/locale constraint on users without any opt-in or justification in the file. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing title and description text only in Chinese, which imposes a specific language on users without any visible opt-in or justification. The policy requires flagging language or locale constraints when the skill does not offer a choice or clearly document why the restriction exists.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The module docstring, usage text, option descriptions, and later user-facing strings are all Chinese-only. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code sends the user-supplied search keyword to an external service via HTTP, but the script provides no explicit warning beyond a generic usage line. There is no confirmation prompt and no user-facing notice at the point of transmission explaining that input will be sent to api.juejin.cn.
- Content
Static analysis
No suspicious patterns detected.