詹明明·找对标

• Outcome: Review
• Latest audit: Sep 6, 2026 · 12:21 PM UTC
• Version: 0.1.4

Overview

The skill is mostly coherent for creator benchmarking, but it asks users to store a broad paid API key insecurely and uses persistent/shared memory without clear user controls.

Review this skill before installing. It is not clearly malicious, but only use it if you are comfortable with paid TikHub API usage, third-party platform scraping, and persistent local records. Do not create an all-permissions API key unless necessary, avoid pasting secrets into shell commands or chat, prefer a scoped/revocable key in a secure credential store, and avoid feeding private or copyrighted third-party content into the workflow.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/抓取手册.md:13
• Finding: Overprivileged API key stored insecurely in a plaintext environment file<![CDATA[ ## Vulnerability Details **File Location**: `references/抓取手册.md`, lines 13 and 28-39 **Vulnerability Type**: Insecure credential handling and excessive API permissions **Risk Level**: Medium ### Vulnerable Code ```bash echo $TIKHUB_API_KEY ``` The registration instructions then direct the user to create a key with all permissions enabled and persist it as follows: ```bash echo 'TIKHUB_API_KEY=YOUR_KEY' >> ~/.env ``` They also provide this alternative: ```bash export TIKHUB_API_KEY=YOUR_KEY ``` ### Technical Analysis The instructions expose the TikHub API key through several unsafe practices: 1. Printing the environment variable can place the secret in terminal output, agent tool output, execution logs, or conversation transcripts. 2. Entering the key directly into a shell command can preserve it in shell history. 3. Appending the key to a generic plaintext `~/.env` file does not ensure restrictive filesystem permissions. 4. Directing the user to enable every API permission violates least privilege. The skill only requires access to the selected social-media platform APIs, not necessarily every capability associated with the account. The project does not contain a hardcoded credential, but it instructs users to handle their own credential in a way that can expose it. ### Attack Path A practical exploitation path requires local, transcript, backup, or log access: 1. The user follows the instructions and executes a command containing the API key. 2. The key is retained in shell history, terminal output, an agent transcript, or the plaintext `~/.env` file. 3. Another local user, compromised process, support operator, transcript reader, or backup recipient obtains access to one of those artifacts. 4. The attacker extracts the TikHub key. 5. The attacker submits requests to TikHub using all permissions granted to the key. 6. Requests consume the victim's paid balance and can access any TikHub functionality authorized by that key. ### Impact Ass ...[truncated 685 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not print the credential or ask the agent to inspect its value. Test only whether it exists: ```bash if [ -n "${TIKHUB_API_KEY:-}" ]; then printf '%s\n' 'TikHub API key is configured' else printf '%s\n' 'TikHub API key is not configured' fi ``` 2. Request only the minimum platform-specific permissions needed for the selected workflow. Do not instruct users to select all permissions. 3. Prefer an operating-system credential store or secret manager, such as macOS Keychain, Windows Credential Manager, or a managed secrets service. 4. If a file must be used, create a dedicated credential file with restrictive permissions: ```bash install -m 600 /dev/null "$HOME/.tikhub.env" ``` Populate it through hidden input or a trusted local editor rather than placing the secret directly in the shell command line. 5. Ensure the credential file is excluded from version control, diagnostic bundles, backups where appropriate, and agent-visible artifacts. 6. Document how to revoke and rotate the key after suspected exposure. 7. Redact values matching the key format from command output, logs, error reports, and transcripts. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:19
• Finding: Cross-skill memory access and persistent storage of user profiling data without defined controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19 and 304-310 **Vulnerability Type**: Excessive access to shared memory and uncontrolled retention of user profile data **Risk Level**: Medium ### Vulnerable Instructions The skill instructs the agent to read both its own memory and shared general memory: ```text Read memory from: {config.paths.memory}/zmm-benchmark/ {config.paths.memory}/_general/ ``` At completion, it instructs the agent to retain profiling information: ```text Before finishing, check: - Which benchmark types the user rejected and why; record this as a correction. - Which filter was decisive. - Record collection failures in shared general memory. Write to {config.paths.memory}/zmm-benchmark/ after deduplication. ``` The broader workflow also requires asking about the user's current income, which increases the sensitivity of contextual data available during memory processing. ### Technical Analysis The skill reads a shared `_general/` memory area rather than limiting access to its own namespace. It then persists user preference and decision-boundary information, including which candidates the user rejected and why. No explicit controls are defined for: - User consent before persistent storage. - Exclusion of current income or other sensitive contextual values. - Data minimization. - Separation between users or tenants. - Retention duration. - User inspection, correction, or deletion. - Prevention of unrelated skills reading the resulting profile. - Sanitization of user-controlled content before it is written to shared memory. This is a least-privilege issue because the skill's primary task—evaluating and analyzing benchmark creator accounts—does not inherently require unrestricted access to general cross-skill memory. The persistent profile also expands the scope of information available to future sessions. The reviewed instructions do not direct the agent to write executable rules or attacker-controlled instr ...[truncated 1748 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict default reads and writes to the skill-specific namespace: ```text {config.paths.memory}/zmm-benchmark/ ``` 2. Do not read `_general/` memory unless a specific item is necessary and the user has explicitly authorized that cross-skill access. 3. Obtain explicit opt-in before retaining preferences or derived behavioral profiles. The default should be no persistence. 4. Never persist current income, credentials, account identifiers, profile links, or raw conversation content unless strictly required and separately authorized. 5. Store only minimal operational facts. Prefer a short task-state record over explanations of why the user rejected candidates. 6. Define a retention period and automatically delete expired records. 7. Provide commands or documented procedures that allow users to inspect, correct, export, and delete retained memory. 8. Enforce per-user and per-tenant filesystem isolation, restrictive permissions, and encryption at rest where the memory may contain sensitive data. 9. Separate non-sensitive technical collection failures from user-profile memory. Shared troubleshooting memory must be sanitized to remove user content, identifiers, URLs, and credentials. 10. Treat all user-controlled text as data. Do not persist it as future agent instructions, and escape or structure stored fields to prevent later instruction interpretation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The guide instructs checking environment variables and reading `~/.env`, then persisting a third-party API key there. That expands the skill from benchmark analysis into access to local secret storage and teaches handling of credentials in a way that is broader than necessary for the stated task.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Telling the operator to probe command execution with `python3 --version` introduces an execution-capability check that is not strictly needed for content-analysis logic. In an agent setting, capability probing can normalize unnecessary command access and widen the operational surface beyond the manifest's core purpose.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes very broad natural-language phrases such as '我该学谁', '帮我找个对标', and 'is this creator worth learning from', which can overlap with ordinary user conversation and cause accidental invocation. In this skill, accidental activation is more concerning because the workflow can lead into account searching, scraping, and paid data collection, increasing privacy, cost, and data-handling risk from a casual query.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill description prominently advertises scraping creators' accounts, extracting covers, transcripts, and engagement data, but the upfront description does not immediately disclose privacy, copyright, consent, or data-handling implications. Although later sections mention cost and some operational risks, users could invoke the skill without early notice that it performs large-scale collection and analysis of third-party content.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The guide tells users to copy a private API key and persist it in plaintext in `~/.env`, with broad permissions enabled. Plaintext secret storage and over-scoped credentials materially increase the chance of credential theft, accidental disclosure, reuse by other tools, or compromise if the local environment is exposed.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The manual workflow asks users to paste third-party content and comments back into the conversation for processing. That can transfer copyrighted, personal, or sensitive third-party data into the chat system without minimization, consent, or clear boundary controls, creating privacy and data-handling risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

**第 2 步**　登录后进 https://user.tikhub.io ，左边找到「**API Keys**」。

**第 3 步**　点「Create API Key」，名字随便起（比如 `zmm`），**权限全选**（要用到抖音、小红书、视频号三块）。

**第 4 步**　生成后**立刻复制那串 key**——它只完整显示一次，关掉页面就看不全了。

• Confidence: 88% confidence
• Finding: The workflow promotes persistent storage and reuse of an API credential across sessions, including a full-access key saved for later execution. Persistent credential setup increases exposure duration and blast radius if the endpoint, shell history, config files, or adjacent tools are compromised.

Static analysis

No suspicious patterns detected.