Security audit

Tieba Spider

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Tieba crawler, but its unsafe network handling deserves review before installation.

Install only if you are comfortable running a crawler that contacts Tieba and downloads files locally. Use --no-images on untrusted networks or when crawling untrusted threads, choose a dedicated output directory, and review the generated files before sharing them.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: tieba_spider.py:151
Finding: Unrestricted Image URL Retrieval Enables Server-Side Request Forgery and Local Resource Access
Content: View full analysis
str: """下载图片到本地，返回本地路径""" os.makedirs(save_dir, exist_ok=True) ext = ".jpg" url_path = url.split("?")[0] if "." in url_path.split("/")[-1]: ext = "." + url_path.split("/")[-1].split(".")[-1] if len(ext) > 5: ext = ".jpg" local_filename = filename + ext local_path = os.path.join(save_dir, local_filename) if os.path.exists(local_path): return local_filename try: req = urllib.request.Request( url, headers={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Referer": "https://tieba.baidu.com/", }, ) with urllib.request.urlopen(req, timeout=20) as resp: with open(local_path, "wb") as f: f.write(resp.read()) log(f"已下载图片: {local_filename}") return local_filename except Exception as e: log(f"图片下载失败: {url[:60]}... 错误: {e}") return "" ``` ### Technical Analysis Image URLs are obtained from remotely supplied Tieba post data and passed directly to `urllib.request.urlopen()`. The implementation does not validate: - The URL scheme. - The destination hostname or port. - The resolved IP address. - Redirect destinations. - Whether the destination is a loopback, private, link-local, or otherwise reserved network address. - The response content type. - The response size. Consequently, a malicious or tampered API response can cause the crawler to request attacker-selected resources. Depending on the URL handlers available to `urllib`, this can include internal HTTP services or non-HTTP local resources. Redirects may also move an initially acceptable request to a prohi ...[truncated 1596 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tieba_spider.py:26
Finding: Tieba API Requests Use Unencrypted Plaintext HTTP
Content: View full analysis
dict: """发起贴吧API请求""" base_params = { "_client_id": CLIENT_ID, "_client_type": CLIENT_TYPE, "_client_version": CLIENT_VERSION, "_phone_imei": PHONE_IMEI, } base_params.update(params) base_params["sign"] = sign(base_params) post_data = "&".join(f"{k}={urllib.parse.quote(str(v))}" for k, v in base_params.items()) req = urllib.request.Request( f"{API_BASE}{endpoint}", data=post_data.encode("utf-8"), headers={ "User-Agent": USER_AGENT, "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json", }, ) with urllib.request.urlopen(req, timeout=timeout) as resp: return json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis The API base URL explicitly uses `http://`. Requests and responses therefore receive no TLS confidentiality, server authentication, or transport integrity protection. The request includes thread identifiers, client metadata, and a request signature. More importantly, the API response controls thread metadata, post content, user information, and image URLs later processed by the crawler. The request signature does not protect the returned response from modification by an on-path attacker. Because downloaded image URLs are accepted from the API response, transport-level response tampering can be chained with the unrestricted URL retrieval vulnerability. An attacker able to intercept plaintext traffic can inject a malicious image URL even when the original Tieba thread was benign. ### Attack Path 1. A user runs the crawler over an untrusted or compromise ...[truncated 1187 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises a Python-based crawler that performs network access to Baidu Tieba and writes crawled content and images to local disk, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: a host agent or reviewer cannot reliably constrain or understand the skill's operational capabilities before execution, increasing the risk of unintended network access or filesystem writes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code creates an output directory and later saves a Markdown file plus optional downloaded images, which stores potentially large amounts of third-party content on the user's filesystem. While the CLI exposes output-related options, there is no explicit warning or disclosure that running the tool will persist scraped content locally.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.