Security audit

Zhihu Search

Security checks across malware telemetry and agentic risk

Overview

This Zhihu scraping skill is mostly purpose-aligned, but it handles live session cookies and includes optional persistence plus broad browser-process termination that deserve manual review before installation.

Install only if you are comfortable giving the skill access to a Zhihu logged-in session. Use a dedicated low-privilege account if possible, keep the cookie file private, avoid running install-cron unless you intentionally want daily background refreshes, and be aware that keepalive commands may restart existing agent-browser sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The helper installs a persistent daily cron job that modifies system-level scheduler state, which exceeds the narrow expectation of a content-fetching skill. While the behavior is openly implemented rather than hidden, persistence increases attack surface and can surprise users by continuing to execute after the skill's immediate task is complete.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The check command is documented as read-only, but its implementation calls ab_load_and_open(), which in turn kills matching daemon processes before reopening the browser. This mismatch can cause unexpected state disruption and violates least surprise, making the tool more dangerous in operational environments.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide instructs contributors to place authenticated Zhihu session cookies into a local file for testing, but it does not warn that these cookies are credential-equivalent secrets that can enable account access if exposed. In the context of a scraping skill that depends on authenticated access, this increases the chance that developers will mishandle live session tokens, commit them accidentally, or reuse personal account cookies without understanding the privacy and account-takeover risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup instructs users to export authenticated Zhihu cookies into a local file, but it does not clearly frame those values as account credentials equivalent to a session token. If mishandled, copied into logs, or read by another tool, those cookies could enable unauthorized account access and scraping under the user's identity.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents storing cookies, raw cookies, browser state, and scraped content under local data directories, but the privacy and retention risks are only lightly discussed and not surfaced as a strong warning near setup. Persisting both credentials and harvested content on disk increases the chance of credential theft, accidental disclosure, or retention beyond what users expect.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Installing a cron job changes host persistence and execution behavior, but the user-facing messaging does not provide a strong runtime warning about modifying the system crontab. In a skill context, especially one for content fetching, such persistence should be treated as sensitive and require explicit acknowledgement.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The helper force-kills all matching agent-browser-linux processes with SIGKILL, which can terminate unrelated sessions and prevent graceful cleanup. Because this happens without a user-facing warning at execution time, it can cause data loss or disrupt other workflows that happen to use the same process name.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The tool automatically reads a session cookie from disk and sends it on authenticated requests without an explicit user-facing warning, confirmation, or scope restriction. In an agent skill context, this is more dangerous because the skill may be triggered on arbitrary topics or URLs and could silently transmit a live session credential, increasing the risk of account misuse or credential exposure to unintended endpoints if URL handling expands or is abused.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.