Security audit

Weibo Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent Weibo automation purpose, but it ships under-scoped account-changing tools that can publish or delete posts using stored session cookies without reliable enforcement of the documented approval flow.

Review this skill carefully before installing. It should only be used with a dedicated Weibo account and tightly controlled local filesystem access. Do not install it for sensitive or shared accounts unless the publisher removes or gates deletion tools, enforces approval in code, replaces shell-based execSync calls, validates paths and pending records, and protects stored cookies as credentials.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: src/request_publish.js:25
Finding: Shell Command Injection Through Untrusted CLI Arguments and Stored Post Data<![CDATA[ ## Vulnerability Details **File Location**: `src/request_publish.js:25-30, 68-70`; `src/approve_post.js:31-49`; `src/login.js:80-84, 108-122`; equivalent command construction also occurs in `src/force_login.js` and `src/verify_login.js` **Vulnerability Type**: OS command injection **Risk Level**: Critical ### Vulnerable Code ```js // src/request_publish.js:25-30 if (images.length > 0) { try { for (const img of images) { const uploadCmd = `node skills/feishu-sender/upload_image.js "${img}"`; const rawOutput = execSync(uploadCmd).toString(); ``` ```js // src/request_publish.js:68-70 const sendCmd = `node skills/feishu-sender/send_post.js "${TARGET_CHAT_ID}" '${msg}'`; try { execSync(sendCmd); ``` ```js // src/approve_post.js:31-37 const msg = JSON.stringify({ zh_cn: { title: "发布成功！🚦", content: [[{ tag: "text", text: `已执行审核通过的操作：${post.content}` }]] } }); require('child_process').execSync( `node skills/feishu-sender/send_post.js "${TARGET_CHAT_ID}" '${msg}'` ); ``` ```js // src/login.js:80-84 // Use send_post logic directly or via exec // Since we are inside node, we can just call the script or reuse logic if modular // But for now, exec is safest to avoid context issues const sendCmd = `node skills/feishu-sender/send_post.js "${TARGET_CHAT_ID}" '${msg}'`; execSync(sendCmd); ``` ### Technical Analysis The scripts interpolate caller-controlled values directly into command strings passed to `child_process.execSync()`. A shell interprets these strings. The affected values include: - `TARGET_CHAT_ID`, obtained from `process.argv[2]`. - Image paths obtained from command-line arguments. - Post content embedded in serialized Feishu messages. - Error text embedded in failure notifications. Double quotation marks do not prevent command substitution in common shells. In addition, the serialized message is enclosed in single quotation marks, but JSON strings can legitimately contain apost ...[truncated 1669 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every string-based `execSync()` invocation with a non-shell API: ```js const { execFileSync } = require('child_process'); execFileSync(process.execPath, [ path.resolve('skills/feishu-sender/send_post.js'), TARGET_CHAT_ID, msg ], { shell: false, stdio: 'inherit' }); ``` 2. Invoke Feishu functionality through an imported module rather than launching another script where possible. 3. Pass large structured messages through stdin or a securely created file rather than shell syntax. 4. Apply strict allow-list validation to chat IDs. 5. Resolve image paths, verify that they are regular files beneath an approved asset directory, and reject symlinks and traversal. 6. Treat post content and error messages as untrusted even after human approval. 7. Add regression tests containing apostrophes, quotation marks, command separators, backticks, and command-substitution syntax. 8. Search the entire project for `exec`, `execSync`, or `{ shell: true }` and eliminate all cases where arguments can contain external data. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/approve_post.js:5
Finding: Documented Human-Approval Requirement Is Not Enforced by the Publishing Code<![CDATA[ ## Vulnerability Details **File Location**: `src/approve_post.js:5-28`; `src/publisher.js:151-158` **Vulnerability Type**: Missing authorization and workflow bypass **Risk Level**: High ### Vulnerable Code ```js // src/approve_post.js:5-21 const pendingDir = path.join(__dirname, '../pending_posts'); const TARGET_CHAT_ID = process.argv[2]; const postId = process.argv[3]; // e.g., "post_177..." if (!postId) { console.error('Usage: node approve_post.js <chat_id> <post_id>'); process.exit(1); } const postFile = path.join(pendingDir, `${postId}.json`); if (!fs.existsSync(postFile)) { console.error(`Post ID not found: ${postId}`); process.exit(1); } const post = JSON.parse(fs.readFileSync(postFile)); console.log(`Approving post ${postId}: "${post.content}"`); ``` ```js // src/approve_post.js:23-28 publishWeibo(post.content, post.images) .then(() => { console.log('Published successfully.'); fs.unlinkSync(postFile); // Remove pending file ``` ```js // src/publisher.js:151-158 // CLI usage if (require.main === module) { const content = process.argv[2]; const images = process.argv.slice(3); publishWeibo(content, images).catch(err => { console.error(err); process.exit(1); }); } ``` ### Technical Analysis `SKILL.md` states that all publishing must follow a request, administrator approval, and execution workflow. The implementation does not enforce that requirement. `approve_post.js` treats possession of a post ID and the ability to invoke the script as sufficient authorization. It does not verify: - That Feishu delivered an approval event. - That the approver is an authorized administrator. - That the approval came from the expected chat. - That the approved content and images match the pending file. - That the approval is signed, recent, and single-use. - That the supplied `TARGET_CHAT_ID` is associated with the request. In addition, `publisher.js` exposes a direct command-line entr ...[truncated 1498 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct command-line publishing entry point from `publisher.js`. 2. Make the low-level publishing function require a verified authorization object, not just content and image paths. 3. Generate a cryptographically random request ID rather than a timestamp-only identifier. 4. Store an approval record containing: - Request ID. - Authorized administrator identity. - Originating chat ID. - Hash of post content. - Hashes of every approved image. - Creation and expiration timestamps. - A single-use nonce. 5. Authenticate the Feishu callback and verify its signature before recording approval. 6. Verify the approval record inside the final publishing function immediately before interacting with Weibo. 7. Atomically mark approvals as consumed to prevent replay or concurrent reuse. 8. Restrict filesystem and process permissions so unrelated processes cannot invoke the publisher or modify pending records. 9. Log request creation, approval identity, content hashes, and execution result in an append-only audit log. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: src/approve_post.js:6
Finding: Path Traversal Allows Approval Logic to Read JSON Files Outside the Pending Queue<![CDATA[ ## Vulnerability Details **File Location**: `src/approve_post.js:6-21` **Vulnerability Type**: Path traversal and unsafe deserialization of local task data **Risk Level**: High ### Vulnerable Code ```js const TARGET_CHAT_ID = process.argv[2]; const postId = process.argv[3]; // e.g., "post_177..." if (!postId) { console.error('Usage: node approve_post.js <chat_id> <post_id>'); process.exit(1); } const postFile = path.join(pendingDir, `${postId}.json`); if (!fs.existsSync(postFile)) { console.error(`Post ID not found: ${postId}`); process.exit(1); } const post = JSON.parse(fs.readFileSync(postFile)); console.log(`Approving post ${postId}: "${post.content}"`); ``` ### Technical Analysis The caller controls `postId`, and the code appends `.json` before passing the value to `path.join()`. No validation restricts the identifier to the generated `post_<timestamp>` form, and no containment check confirms that the resolved file remains inside `pending_posts`. A value containing `../` components can therefore resolve outside the pending queue. If the resulting target is an accessible JSON file with compatible `content` or `images` properties, it is treated as an approved publishing request. The parsed data is also not schema-validated. In particular, `images` can contain paths to arbitrary local files. Puppeteer's file-upload API can then submit those files to Weibo. ### Attack Path 1. An attacker identifies or creates a readable JSON file outside `pending_posts`. 2. The file contains a `content` field and, optionally, an `images` array referring to local files. 3. The attacker invokes `approve_post.js` with a traversal identifier that resolves to that file after `.json` is appended. 4. `fs.existsSync()` and `fs.readFileSync()` operate on the resolved external path. 5. The JSON is parsed as a pending post. 6. `publishWeibo()` publishes its content and uploads the referenced files. 7. On successful publication, `unlinkSync(postFile)` ...[truncated 641 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce the exact expected identifier format: ```js if (!/^post_[0-9]+$/.test(postId)) { throw new Error('Invalid post ID'); } ``` 2. Resolve and verify the final path: ```js const base = fs.realpathSync(pendingDir); const candidate = path.resolve(base, `${postId}.json`); if (path.dirname(candidate) !== base) { throw new Error('Post path escapes pending directory'); } ``` 3. Use `lstat()` and reject symbolic links. 4. Validate the JSON against a strict schema, including required types and maximum lengths. 5. Require image paths to resolve beneath a dedicated approved-assets directory. 6. Verify that image entries are regular files of permitted type and size. 7. Use random opaque request identifiers to reduce identifier discovery. 8. Only delete files that have been positively verified as queue records beneath the canonical pending directory. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/delete_latest.js:10
Finding: Undocumented Scripts Can Irreversibly Delete Weibo Posts Without Approval<![CDATA[ ## Vulnerability Details **File Location**: `src/delete_latest.js:10-14, 47-108, 129-133`; `src/delete_post.js:10-15, 38-132, 157-167` **Vulnerability Type**: Unauthorized destructive account operation **Risk Level**: High ### Vulnerable Code ```js // src/delete_latest.js:10-14 async function deleteLatestPost() { if (!fs.existsSync(COOKIE_FILE)) { throw new Error('No cookies found. Please run login first.'); } const cookies = JSON.parse(fs.readFileSync(COOKIE_FILE)); ``` ```js // src/delete_latest.js:47-57 const buttons = await page.$$('button[title="展开"]'); console.log(`[Weibo] Found ${buttons.length} expand buttons.`); if (buttons.length > 0) { const btn = buttons[0]; // First post usually await btn.click(); console.log('[Weibo] Clicked menu button.'); // Wait for popover await new Promise(r => setTimeout(r, 1000)); ``` ```js // src/delete_latest.js:82-108 if (deleteOption) { // Ensure it's visible await deleteOption.click(); console.log('[Weibo] Clicked Delete option.'); // Confirm dialog await new Promise(r => setTimeout(r, 1000)); let realConfirm = null; const dialogButtons = await page.$$('button, a, span'); for (const btn of dialogButtons) { const text = await page.evaluate(el => el.textContent, btn); if (text && text.trim() === '确定') { const isVisible = await btn.boundingBox(); if (isVisible) { realConfirm = btn; break; } } } if (realConfirm) { await realConfirm.click(); console.log('[Weibo] Confirmed deletion.'); ``` ```js // src/delete_latest.js:129-133 if (require.main === module) { deleteLatestPost().catch(console.error); } module.exports = { deleteLatestPost }; ``` ```js // src/delete_post.js:157-167 if (require.main === module) { const text = process.argv[2]; if (!text) { console.error('Usage: node delete_post.js "con ...[truncated 2213 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the deletion scripts if deletion is not an intended and documented Skill capability. 2. If deletion is required, apply the same authenticated human-approval mechanism recommended for publishing. 3. Require an immutable Weibo post ID rather than positional selection or substring matching. 4. Before approval, display the exact post ID, full content, timestamp, and account identity. 5. Bind the approval cryptographically to the specific post ID and operation type. 6. Require a second explicit confirmation for destructive actions. 7. Verify the authenticated account ID before changing content. 8. Avoid global text-based DOM searches; scope every control to the verified post container. 9. Confirm deletion success and preserve an append-only audit record. 10. Provide a dry-run mode and make it the default. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: src/login.js:90
Finding: Authenticated Weibo Session Cookies Are Stored in Plaintext With Default File Permissions<![CDATA[ ## Vulnerability Details **File Location**: `src/login.js:90-100`; `src/force_login.js:88-96` **Vulnerability Type**: Insecure storage of authentication material **Risk Level**: Medium ### Vulnerable Code ```js // src/login.js:90-100 for (let i = 0; i < maxRetries; i++) { if (page.url().includes('weibo.com') && !page.url().includes('login.php')) { // Check if actually logged in (e.g. user avatar present or specific cookie) const cookies = await page.cookies(); const subCookie = cookies.find(c => c.name === 'SUB'); // Weibo's main auth cookie if (subCookie) { console.log('[Weibo] Login detected! Saving cookies...'); fs.writeFileSync(COOKIE_FILE, JSON.stringify(cookies, null, 2)); loggedIn = true; break; } ``` The forced-login flow performs the equivalent write: ```js fs.writeFileSync(COOKIE_FILE, JSON.stringify(cookies, null, 2)); ``` ### Technical Analysis The scripts persist the complete browser cookie array, including Weibo's primary authenticated session cookie, in `cookies.json`. The file is plaintext and is created with Node.js default permissions subject to the process umask. The implementation does not: - Explicitly restrict permissions to the owning account. - Use an operating-system credential store. - Encrypt the stored session. - Minimize the saved cookie set. - Define secure deletion or revocation. - Demonstrate that the file is excluded from source control and packaged artifacts. Possession of a reusable session cookie may allow account impersonation without knowing the account password or completing the QR-login process again. ### Attack Path 1. Another local user, compromised process, backup job, artifact collector, or accidentally published repository obtains `cookies.json`. 2. The attacker imports the cookies into a browser or compatible automation tool. 3. If the session remains valid and Weibo accepts it, the attacker obtains the a ...[truncated 862 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Store session material in an operating-system secret manager or dedicated encrypted credential service. 2. If a file is unavoidable, create it with owner-only permissions: ```js fs.writeFileSync(COOKIE_FILE, JSON.stringify(cookies), { encoding: 'utf8', mode: 0o600, flag: 'w' }); fs.chmodSync(COOKIE_FILE, 0o600); ``` 3. Save only cookies strictly required for the operation. 4. Add `cookies.json`, QR images, and debug screenshots to version-control and packaging exclusions. 5. Verify permissions before every read and refuse to use a broadly accessible credential file. 6. Define session expiration, logout, revocation, and secure cleanup procedures. 7. Avoid copying the project directory while live credentials are present. 8. Run the Skill under a dedicated least-privileged operating-system account. 9. Document that cookie possession is equivalent to account access and must be handled as a secret. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (67)

Known Vulnerable Dependency: basic-ftp==5.1.0 — 4 advisory(ies): CVE-2026-27699 (Basic FTP has Path Traversal Vulnerability in its downloadToDir() method); GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: basic-ftp 5.1.0 is present as a transitive dependency of get-uri/pac-proxy-agent/proxy-agent rather than an explicitly used top-level package. The package has serious published issues, but from this lockfile alone there is no evidence the skill actually invokes FTP flows or downloadToDir(), so exploitability is context-dependent; still, if hostile proxy/PAC/FTP inputs are processed, path traversal or command injection risks could become reachable.

Ae1

High

Category: analysis-evasion
Content: 2. **Request**: Call `request_publish.js` to create a pending task and notify admin (via Feishu).
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 4. **Execute**: Agent observes approval and calls `approve_post.js` (which calls `publisher.js`) to publish.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: The lockfile pins axios 1.13.5, and the supplied advisories include multiple high-risk issues such as SSRF-related proxy bypass and prototype-pollution-based request/credential compromise. In this project context, axios is a direct dependency and likely used for outbound authenticated requests, so these flaws could enable request redirection, credential leakage, or abuse of internal network access if attacker-controlled input reaches HTTP request construction.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: brace-expansion 1.1.12 is a known ReDoS/DoS-prone package, but here it appears only as a transitive dependency under glob/minimatch/rimraf-related tooling. In a package-lock context this is a real vulnerable component, yet the practical impact on the running skill is likely limited unless attacker-controlled glob patterns are processed at runtime.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

Category: Supply Chain
Confidence: 84% confidence
Finding: extract-zip 2.0.1 has symlink/path traversal style arbitrary write issues and is included via @puppeteer/browsers. If the skill downloads and extracts browser archives or other attacker-influenced ZIP content, exploitation could write files outside the intended directory; otherwise this remains latent but real supply-chain risk.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart names/filenames, and it is pulled in by axios. If the skill builds multipart requests from attacker-controlled field names or filenames, an attacker may inject malformed headers or manipulate upstream requests; absent such usage, exposure is reduced but the vulnerable component is still present.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: ip-address 10.1.0 is transitively included through socks and is flagged for parsing inconsistencies and HTML-emitting XSS helpers. In this skill context, unless the code relies on these parsing routines for SSRF filtering or renders Address6 HTML output, practical exploitability is limited, but the package version is still known-vulnerable.

Known Vulnerable Dependency: minimatch==3.1.2 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: minimatch 3.1.2 has multiple ReDoS findings and is included transitively via glob/rimraf. This is a real vulnerable package in the dependency graph, but unless the skill accepts attacker-controlled glob patterns during runtime operations, the impact is more likely denial-of-service than direct compromise.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 88% confidence
Finding: ws 8.19.0 is a runtime dependency of puppeteer-core and is flagged for memory disclosure and memory-exhaustion DoS issues. Because this skill uses browser automation, WebSocket transport is likely active in normal operation, making the vulnerable library more relevant than purely build-time dependencies; exploitation could destabilize the process or expose process memory in some communication scenarios.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 89% confidence
Finding: The project permits installation of an axios version reported by the scanner as having multiple known advisories, including SSRF-related and prototype-pollution-assisted man-in-the-middle/credential theft issues. In a skill that depends on network access and may interact with authenticated social-media workflows, a vulnerable HTTP client can materially increase risk of request tampering, token leakage, SSRF, or response hijacking depending on how axios is used elsewhere.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The script performs an irreversible destructive action—deleting a social media post—based solely on a CLI argument and existing cookies, without any interactive confirmation, dry-run mode, or secondary verification of the matched post. In an automation skill context, this raises the risk of accidental or unauthorized deletion if the target text is ambiguous, mis-specified, or the script is invoked by another component without the operator realizing it.

Missing User Warnings

High

Confidence: 97% confidence
Finding: On failure, the script automatically invokes another program to upload a debug screenshot, potentially exfiltrating sensitive account content to an external service without clear notice or approval. This is especially dangerous because the screenshot likely captures authenticated session data or private content, and the subprocess call obscures the data flow from the user operating the skill.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The script reads persistent cookies from disk and injects them into a browser session, effectively reusing an authenticated login without interactive user consent at runtime. Stored session cookies are highly sensitive credentials; if misused or exposed, they can enable account takeover, unauthorized access to private data, and actions performed as the logged-in user.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The workflow says the admin must reply "同意" to approve, which imposes a specific language requirement in the skill's natural-language interface. The file does not offer alternative approval phrases or explain that the skill is intentionally limited to a Chinese-language environment.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script publishes content through publishWeibo and then includes the post content in a Feishu notification message. While there is console logging, there is no explicit user disclosure in this file that approval will transmit the content to external services, which matters for privacy and data-handling awareness.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: With no manifest available, this file appears to be an approval/publishing workflow for pending posts. In addition to approving and publishing content, it invokes a separate script via child_process.execSync to send Feishu chat notifications on both success and failure, which is a materially broader capability than local approval and publication logic and is not justified by any stated purpose in this file's documentation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code builds a shell command with untrusted data and passes it to execSync: both TARGET_CHAT_ID and the JSON message can contain shell-sensitive characters. If an attacker can influence the chat ID, post content, or an error message, they may break quoting and execute arbitrary OS commands with the privileges of this script.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This script automates deletion of the latest Weibo post using stored session cookies and immediately confirms the deletion in the UI without any user approval, dry-run mode, or target verification. Because the action is irreversible and selector logic is broad and brittle, accidental or unauthorized execution could delete content unexpectedly or delete the wrong item.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code writes screenshots of the live account UI to disk during the deletion workflow, and those images may contain sensitive personal content, account details, private messages, or other visible data from the session. Because the screenshots are created automatically without consent, redaction, retention limits, or access controls, they create a privacy and data exposure risk if the host is shared or compromised.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script saves authenticated Weibo cookies to a local JSON file immediately after login, but the user-facing flow only says that cookies will be saved after scanning and does not provide meaningful prior disclosure, consent, retention details, or protection of the credential material. Session cookies are effectively bearer tokens, so storing them on disk can enable account takeover if the host, workspace, or file permissions are compromised.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: No manifest is available, so there is no declared purpose that would justify invoking an external command via `execSync`. The code shells out to `uv run ... generate_image.py`, which is a broader capability than simple local data handling and can have side effects beyond this file's apparent scope.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: No manifest is available, so the skill has no declared purpose that would justify spawning an external command runner. The code constructs a shell command and executes a separate Python image-generation script, which is a broader capability than simple in-process data handling and can be security-relevant when not explicitly part of the skill's stated scope.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script hard-codes a path to a user image in a home directory and logs that path during execution, which can expose personal file locations and indicate processing of user-provided media without any consent, minimization, or warning. In a skill context, embedding a specific user asset path also creates a privacy leak and makes accidental reuse of personal data more likely if the script is shared, committed, or run in other environments.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The script hard-codes both an input image and an output directory under a different skill namespace (`skills/weibo-manager/...`) despite being evaluated as a separate skill artifact. Cross-skill access to user-provided assets and writing into another skill’s asset tree can violate isolation expectations, create unintended data dependencies, and expose or overwrite data belonging to a different component.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/approve_post.js:37

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/delete_post.js:145

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/force_login.js:59

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_beijing_tour_pixel.js:41

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_beijing_tour.js:41

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_cosplay_portrait.js:16

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_cosplay.js:23

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_1k_fix_v2.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_1k_fix.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_2k_fix_v2.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_2k_fix.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_70mm.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_cozy.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_dimension_break.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_fashion.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_final_legs.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_final.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_mixed.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_profile.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_real.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_refined.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_separated.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_side.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_ski.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_snow.js:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_weibo_noref.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_learning_weibo.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/generate_tanghulu.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/login.js:54

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/request_publish.js:30

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/retry_cosplay.js:16

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/retry_final_pixel.js:32

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/retry_generation.js:33

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/retry_pixel_1080p.js:34

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/verify_login.js:44

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/weibo_client.js:9