ClawHub
Back to skill

Security audit

Zhihu Content Strategist

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Zhihu writing helper, but it presents mock analytics and invented personal/research claims as usable strategy and draft output.

Review this before installing as a production content tool. It appears safe from a system-access perspective, but its outputs should be treated as templates or demo content, not real Zhihu analytics. Do not publish generated drafts without replacing unsupported personal experience, research, and statistics with verified facts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Warning
Location
scripts/strategist.py:139
Finding

Undisclosed Synthetic Analytics Presented as Real Zhihu Analysis

Content
View full analysis

Vulnerability Details

File Location: scripts/strategist.py, lines 139-166 and 491-499
Vulnerability Type: Content integrity and capability misrepresentation
Risk Level: Medium

Evidence

python
def analyze_answers(answers_data, domain):
    patterns = ANSWER_PATTERNS.get(domain, {})

    report = {
        "domain": domain,
        "sources": {
            "note": "Mock data — replace with actual scraped answers in production",
            "sample_size": 20,
        },
        "opening_hooks": patterns.get("opening_hooks", [
            {"type": "question_based", "example": "你有没有遇到过这样的情况…"},
            {"type": "story_based", "example": "五年前我也面临同样的选择……"},
        ]),
        "structure_patterns": patterns.get("structure", [
            "Problem-Solution", "Timeline narrative", "Listicle"
        ]),
        "avg_length_chars": patterns.get("avg_length_chars", 2000),
        "golden_line_pattern": patterns.get(
            "golden_line_pattern",
            "Personal experience + actionable insight"
        ),
        "emotional_tone_distribution": {
            "empathetic": 0.35,
            "authoritative": 0.30,
            "humorous": 0.20,
            "contrarian": 0.15,
        },
    }
    return report

The command-line workflow invokes this function with an empty dataset:

python
elif task == "analyze":
    print(f"\n[Steps 2-3/8] Analyzing high-performing answers in {domain}")
    result = analyze_answers({}, domain)
    output["pattern_analysis"] = result
    if args.output == "text":
        print(f"  Sample size: {result['sources']['sample_size']}")
        print(f"  Opening hook types: {[h['type'] for h in result['opening_hooks']]}")
        print(f"  Common structures: {', '.join(result['structure_patterns'])}")
        print(f"  Avg length: {result['avg_length_chars']} chars")

Technical Analysis

The `answers_da ...[truncated 1783 chars]

Remediation
View remediation

Remediation Suggestions

  1. Implement the advertised data ingestion or scraping workflow with explicit user consent, rate limiting, timeout controls, and Zhihu terms-of-service compliance.
  2. Make analyze_answers consume and validate answers_data; derive sample size and all statistics from the supplied records.
  3. If no real dataset is available, stop the analysis with a clear error rather than silently using mock values.
  4. If demonstration mode is intentionally supported, require an explicit --demo flag and prominently label every text and JSON result as synthetic.
  5. Print provenance fields in normal text output, including collection time, source type, sample size, and whether fallback data was used.
  6. Keep mock fixtures outside production execution paths, such as under a dedicated test or example directory.
  7. Add tests confirming that an empty dataset cannot produce claims about analyzed answers.
  8. Update SKILL.md and skill.json so capabilities accurately reflect the implementation until real collection and analysis are available.

other

Warning
Location
scripts/strategist.py:273
Finding

Generated Strategies Embed Fabricated Research and Personal-Experience Claims

Content
View full analysis

Vulnerability Details

File Location: scripts/strategist.py, lines 273-275
Vulnerability Type: Misinformation generation and false attribution
Risk Level: Medium

Evidence

python
"hook_variants": [
    f"数据切入: 我分析了{topic}领域的100个案例，发现…",
    f"故事切入: 去年我亲身经历了一个{topic}项目，结果让我…",
    f"反直觉: 你可能不相信，但{topic}的真相和大部分人想的恰恰相反",
],

The draft generator further embeds unsupported personal and quantitative claims:

python
draft.append(f"在过去的半年里，我花了大量时间研究{topic}。"
             "这篇文章不讲大道理，只分享真实经历和可复用的方法。")

draft.append(f"去年我做了一个关于{topic}的项目，结论让我自己都很意外。"
             "直接说最关键的发现：...（此处用具体数字和案例展开）")

draft.append("| 维度 | 我的发现 | 行业普遍认知 | 差异 |")
draft.append("|------|----------|--------------|------|")
draft.append(f"| {topic}效果 | 案例A | 案例B | +30% |")
draft.append("| 投入产出 | 时间X | 时间Y | -40% |")

Technical Analysis

The strategy generator states that the author analyzed 100 cases and personally participated in a project, regardless of whether the user supplied research, project history, or supporting evidence. The draft generator similarly claims six months of research, real experience, and quantitative differences such as +30% and -40%.

These assertions are generated solely from the topic string. There is no evidence model, source validation, user confirmation, or provenance check. This contradicts the documented security requirement not to generate misinformation.

The CLI accepts arbitrary domains, including documented finance and psychology domains, but does not add the promised warnings or disclaimers for sensitive content. The generic footer saying that content should be adjusted does not clearly identify the specific claims as fabricated placeholders.

Attack Path

  1. A user supplies any topic through --topic.
  2. generate_strategy automatically produces claims of research and personal project experience.
  3. For the draft task, generate_draft embeds further clai ...[truncated 1053 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove unconditional first-person claims, research counts, project history, and numerical outcomes from generated text.
  2. Replace them with explicit placeholders, such as [insert verified sample size], [describe your actual experience], and [add a sourced result].
  3. Require structured evidence input before generating factual claims, including source URL or citation, sample size, collection date, methodology, and user confirmation.
  4. Add a claim-provenance model that distinguishes user-provided facts, externally verified facts, illustrative examples, and unresolved placeholders.
  5. Block ready-to-publish output while unresolved evidence placeholders remain, or display a prominent validation warning.
  6. Add domain-sensitive handling for financial, medical, legal, and mental-health content, including clear disclaimers and stricter evidence requirements.
  7. Avoid implying personal experience unless the user explicitly provides and confirms that experience.
  8. Add automated tests asserting that arbitrary topic input cannot produce invented research, credentials, personal experiences, or statistics.
  9. Clearly label generated examples as fictional when fictional examples are intentionally requested.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is presented as a general content strategist, but its title, examples, and generated outputs are all Chinese-specific and Chinese-language by default. There is no explicit user choice or opt-in for language/locale, which can violate language/locale policy when a skill imposes a specific language implicitly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This JSON reference data is explicitly tailored to Zhihu and includes Chinese-language examples and category values throughout the file. That represents a locale/language constraint embedded in natural-language content, with no indication that users can choose another language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The prompt text hardcodes "current Zhihu hot list," and multiple labels are presented in Chinese, steering output toward a specific language and platform context. The file does not indicate that the user can choose another language or locale, nor does it justify this as a region-specific-only tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The schema allows a 'publish' task even though the stated skill scope is limited to analysis, strategy, and draft generation. This creates a capability mismatch that can enable downstream automation to perform content posting actions without clear user consent, review gates, or alignment with the documented purpose of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file positions itself as a Zhihu content strategist and all usage examples and generated content patterns are written in Chinese, implying a fixed language/locale for outputs. There is no option for users to select another language or any documented justification that the language constraint is mandatory beyond the platform context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest explicitly describes scraping Zhihu hot lists and top answers, but it provides no warning that the skill may access external sites, collect remote content, or process third-party data. This lack of disclosure is risky because users may unknowingly trigger network activity and content collection, creating privacy, compliance, and expectation-management issues, especially if the target platform has access restrictions or terms governing scraping.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The first-success activation phrase is a broad natural-language trigger that can cause the skill to engage on loosely related requests without clearly signaling boundaries, exclusions, or required user confirmation. In a skill that performs trend analysis and scraping-oriented workflows, overly broad triggering increases the chance of unintended execution, surprise data collection, or content generation on behalf of the user when they only meant to ask a general question.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON manifest includes a trigger-like prompt template tied to "current Zhihu hot list," but it does not clarify whether the template is only for Zhihu-specific workflows or when it should not be used. In a manifest-style reference file, that lack of scope specificity can cause overly broad or unintended use of the template outside its intended context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The schema is explicitly branded as a "Zhihu" content workflow, which implies a Chinese-platform and locale-specific output context. In this file there is no accompanying natural-language indication that this locale/platform constraint is optional, user-selected, or justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.