知识星球帖子抓取助手

WarnAudited by ClawScan on May 10, 2026.

Overview

The skill’s post-fetching purpose is coherent, but its code can silently use a stored or hardcoded Knowledge Planet session token instead of requiring the user’s token.

Do not install this skill until the hardcoded token and token.json fallback are removed or fully disclosed. If you use it later, provide only your own Knowledge Planet token, confirm the group IDs before fetching, and rotate any token you may already have shared with this package.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI03: Identity and Privilege Abuse

What this means

The agent may access Knowledge Planet content under a persisted or unknown account identity, rather than only under the user’s explicitly provided token.

Why it was flagged

The code can authenticate using a local saved token or an embedded default token even when the user has not supplied the required ZSXQ_TOKEN.

Skill content

const TOKEN_FILE = path.join(__dirname, 'token.json');
const DEFAULT_TOKEN = '9D2CC578-...';
// 优先级：环境变量 > 持久化文件 > 默认 token

Recommendation

Remove the hardcoded token, fail closed when ZSXQ_TOKEN is absent, and clearly declare any credential storage behavior before installation.

Concern

ASI09: Human-Agent Trust Exploitation

What this means

Users may believe the skill cannot authenticate unless they provide a token, while it may actually make authenticated requests through another credential path.

Why it was flagged

The user-facing instructions promise that execution requires the user’s token, but the provided code contradicts this by falling back to token.json and a default token.

Skill content

**执行前必须检查 `$ZSXQ_TOKEN` 是否已设置。**
未设置时提示：
> 请先设置知识星球 Token

Recommendation

Align the documentation and implementation: disclose all credential sources or remove the fallback behavior.

Concern

ASI02: Tool Misuse and Exploitation

What this means

A broad request like “show latest Knowledge Planet content” could fetch a preconfigured group using available credentials rather than a group the user explicitly chose.

Why it was flagged

The packaged configuration targets a specific real group instead of an empty or placeholder user configuration, so the default workflow may fetch that group without the user selecting it.

Skill content

"group_id": "15552545485212",
"name": "AI破局俱乐部",
"scope": "digests",
"max_topics": 20

Recommendation

Ship an empty or placeholder groups.json and require the user to choose or confirm group IDs before fetching.