Security audit

xfg-zsxq-skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ZSXQ automation tool, but it needs Review because it handles full session cookies, can post or reply with saved credentials, includes a real-looking token in documentation, and documents persistent scheduled actions.

Install only if you are comfortable giving the skill a ZSXQ browser session that can read account data and post or reply on your behalf. Treat any cookie or token used with it as sensitive, avoid command-line credential examples, verify the target group before publishing, do not enable scheduled jobs unless you want recurring access, and rotate any token copied into logs, shell history, or shared files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: references/token-config.md:12
Finding: <![CDATA[Credential-Like Access Token Embedded in Documentation]]>
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zsxq-auto-post.js:20
Finding: <![CDATA[Full Session Cookies Accepted Through Command-Line Arguments]]>
Content: View full analysis
文章内容" node zsxq-auto-post-article.js --cookie "xxx" --title "标题" --content "
内容
" --article "文章ID" node zsxq-auto-post-article.js --cookie "xxx" --title "文章标题" --content "
文章内容
" --publish true --article "文章ID" ``` ### Technical Analysis The scripts accept the complete authenticated session cookie through `process.argv`. Although sending the cookie to `api.zsxq.com` is necessary for the declared functionality, transporting the secret through command-line arguments is not necessary and creates additional local exposure. Command-line arguments can be retained in shell history, copied into terminal transcripts, captured by CI logs, recorded by monitoring software, or exposed to local process inspection depending on the operating system and host configuration. The cookie may include `zsxq_access_token` and other session identifiers. This issue also affects the equivalent argument handling in `scripts/zsxq-auto-post-article.js` and `scripts/post.sh`. ### Attack Path 1. A user follows the documented invocation and places the full cookie in `--cookie`. 2. The shell records the command in history, a CI system logs ...[truncated 733 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zsxq-auto-post-article.js:146
Finding: <![CDATA[Posting Scripts Silently Default to a Hardcoded Group Destination]]>
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/package.json:8
Finding: <![CDATA[Unpinned and Apparently Unused Puppeteer Dependency Adds Supply-Chain Exposure]]>
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (64)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 描述将该技能定义为一个较完整的知识星球自动化套件，但代码片段的实际功能明显更窄，只实现了“发帖”这一项，而且还是通过直接调用 HTTP API 完成。代码中没有任何与回帖、帖子浏览、通知检查、被圈提醒、定时任务、配置文件读取、自动化调度或 Playwright 浏览器控制相关的逻辑。虽然“发帖”属于描述中的一部分，但整体描述与该代码片段实际行为存在显著能力落差，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 描述把该技能定义为一个较完整的知识星球自动化工具，覆盖发布、回复、浏览、自动化任务等多项能力；但给出的代码块实际只是“检查通知/动态”的单一脚本。它确实会自动读取 ~/.xfg-zsxq/groups.json，也确实检查新帖子、评论和被圈提醒，这部分与描述部分一致。但核心能力范围明显缩小：没有任何发帖、评论提交、浏览器自动化、定时调度或帖子浏览实现。依据评估标准，这属于声明能力显著多于代码实际行为的描述-行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个多功能的“知识星球自动化技能”，覆盖发帖、回帖、浏览、通知、定时任务、配置读取和浏览器自动化回复等多个能力；但提供的代码块仅实现了文章发布相关能力：解析命令行参数、从 cookie 提取 token、生成签名、调用 /v2/articles 或 /v2/articles/drafts 接口，并在正式发布时调用 /v2/groups/{groupId}/topics 进行确认。虽然“发帖”大方向与声明部分重合，但声明中的大多数核心能力在该代码中不存在，因此描述明显宽于实际行为，属于显著不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个功能较完整的“知识星球自动化技能”，覆盖发帖、回帖、浏览、通知检查、自动化与定时任务等多个能力；但提供的代码块只实现了“发帖”这一项，而且是通过直接构造签名并调用知识星球 HTTP API 完成。代码中没有任何回帖、浏览帖子、获取通知、自动检查、定时调度、读取 groups.json、或 Playwright 浏览器自动化的实现。因此，虽然“发帖”与声明的一部分一致，但整体描述明显夸大了实际能力，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该描述与代码存在明显行为不一致。代码核心能力集中在“配置管理 + 发帖（含图片上传）”，并且确实使用 ~/.xfg-zsxq/groups.json。它通过 HTTPS 直接调用知识星球 API 和七牛上传接口完成获取星球信息、申请上传 token、上传图片、发布帖子等操作。但声明中大量强调的能力——回帖、浏览帖子、检查通知、自动回帖、自动发帖、定时任务、被圈提醒，以及 Playwright 浏览器自动化——在代码中完全看不到对应实现。因此这是实质性描述夸大/失配，而不仅是未写全细节。虽然存在少量未声明但相关的配置管理能力，这不是主要问题；主要问题是声明了多项关键能力而代码未实现。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list contains broad everyday terms like '通知', '发帖', and '回帖', making accidental invocation much more likely in ordinary conversation. In this skill's context, misfires are more dangerous because activation can lead to shell commands, browsing automation, remote posting, local config reads, and handling of session cookies.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Multiple manifest triggers are ambiguous and lack product-specific qualifiers, which raises the risk that unrelated user requests are interpreted as commands for this skill. Because the documented actions include content publication and notification checking against a third-party service, unintended invocation could affect user data and external accounts.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs users to extract full authentication cookies from browser network traffic and reuse them in automation, then points to local storage of those secrets in ~/.xfg-zsxq/groups.json. Full session cookies are bearer credentials; exposing or mishandling them can allow full account takeover or unauthorized posting and reading on the user's behalf.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The examples pass raw cookies directly on the command line, which commonly exposes secrets through shell history, process listings, logs, crash reports, and transcript capture. In this skill's context those cookies authorize remote publishing and account access, so disclosure can immediately compromise the user's account.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The troubleshooting and cookie-format sections encourage copying, storing, and revealing complete cookie values and specific token fields. This normalizes unsafe secret handling and increases the probability that credentials are pasted into chats, docs, terminals, or files where they can be stolen and reused.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The debugging examples show passing a token directly on the command line and enabling shell tracing with bash -x / set -x, which can expose secrets in shell history, process listings, CI logs, terminal scrollback, and debug output. Because this skill uses access tokens to post and reply on behalf of a user, exposure of the token can immediately enable unauthorized account actions.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This document provides step-by-step instructions to log into a live account, inspect network traffic, copy x-signature and x-timestamp values, and then operationalize them for automation. In a skill explicitly designed for automated posting/replying, this is dangerous because it directly enables harvesting and reuse of active authentication/signing material, potentially leading to account abuse, unauthorized posting, and circumvention of platform controls.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file exposes a real-looking credential directly in natural-language setup instructions, which is especially risky because users are explicitly told how to obtain and store similar tokens for a live web service. This context makes accidental disclosure, reuse, logging, and credential harvesting more likely than in abstract example documentation.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/token-config.md (reported line 22)May include surrounding context.
md
## 首次使用流程 ### 1. 获取 Access Token 1. 登录知识星球网页版：https://wx.zsxq.com 2. 按 `F12` 打开开发者工具

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/token-config.md (reported line 112)May include surrounding context.
删除配置

bash
rm -rf ~/.xfg-zsxq

安全说明

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/token-config.md (reported line 112)May include surrounding context.
删除配置

bash
rm -rf ~/.xfg-zsxq

安全说明

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documentation teaches users how to retrieve an authentication token from browser cookies, which is a credential-access pattern even if presented as setup guidance. In this skill's context, the token enables authenticated actions against the user's knowledge-platform account, so exposing or mishandling it could permit unauthorized posting, replies, or broader account misuse.
Content: Scanner excerpt · references/usage.md (reported line 5)May include surrounding context.
md
## 快速开始 ### 1. 获取 Access Token 1. 登录 https://wx.zsxq.com 2. 按 `F12` 打开开发者工具

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example invocation encourages use of a broad natural-language phrase ("帮我在知识星球发帖：...") that closely resembles normal conversation rather than an explicit command format. In systems with loose trigger matching, this can increase collision risk and lead to unintended activation of a skill that performs authenticated external actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes the standalone phrase "发帖", which is a common everyday term and lacks any product-specific qualifier. In an agent environment, this increases the chance of accidental invocation from ordinary conversation, potentially causing unintended posting actions to an external service using stored cookies.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documents shell commands, local file access, and browser/API automation, but it does not declare any explicit tool scope or permissions boundary. That increases the chance an agent invokes shell or environment-capable tools more broadly than the user expects, especially because the skill also handles authentication material and system-level cron setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill advertises automatic creation of cron jobs without clearly warning that it will modify persistent system scheduler state. Persistence-changing behavior is security-sensitive because it can create recurring execution, network access, or data processing beyond the immediate session if triggered without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents network operations authenticated via Cookie + Token, and later includes concrete header examples with zsxq_access_token. Under SQP-2 for markdown files, documentation should warn users when behavior could affect privacy or authenticated account actions, but no such warning is present near the authentication description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The section explains how to directly publish an article and notes the required two-step flow, but the warning only covers implementation steps, not the user impact of publishing content to a live group. For markdown files, actions affecting user data or account state should include an explicit warning about visibility and potential unintended publication.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 264)May include surrounding context.
请求示例

cURL 示例

bash
curl 'https://api.zsxq.com/v2/groups/48885154455258/topics' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 313)May include surrounding context.
} }

response = requests.post(url, headers=headers, cookies=cookies, json=data) print(response.json())

text

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Vague Triggers

Vague Triggers

Ssd 3

Ssd 3

Ssd 3

Missing User Warnings

Ssd 4

Ssd 3

Credential Access

Tool Parameter Abuse

删除配置

安全说明

Tool Parameter Abuse

删除配置

安全说明

Credential Access

Vague Triggers

Vague Triggers

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

请求示例

cURL 示例

External Transmission

Static analysis