Security audit

zhihu-ops

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-only Zhihu browser workflow skill discloses its account actions and keeps them aligned with user-requested Zhihu tasks.

Install this only if you want an agent to operate your Zhihu account in a browser. Review requests carefully before public posts, article edits, comments, replies, likes, or favorites, and do not let the skill update its own reference files unless you intend to preserve those page observations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is broad enough to match common conversational phrases like '点个赞' or '评论一下', which can cause the skill to activate when the user did not explicitly intend Zhihu operations. Because this skill performs external side effects on a live account, accidental invocation could result in unintended likes, comments, replies, edits, or posting actions.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: L153-L184 以“知乎文章格式规范”的形式要求内容使用特定中文写作方式，如自然语言表达层次、标题字数建议和具体中文表达示例，但没有说明这仅适用于中文文章场景，也未给出用户语言偏好选择。对于多语言用户，这构成了未获用户选择的语言/locale 约束。

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This markdown file uses only Chinese for headings and instructions, which can amount to a language/locale constraint for users who do not read Chinese. The file does not indicate that Chinese is optional, user-selected, or required for a justified region-specific purpose.

Static analysis

No suspicious patterns detected.