zhihu-for-opencode

• Outcome: Pass
• Latest audit: Aug 17, 2026 · 8:06 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Zhihu CLI/API skill whose install and credential behavior is purpose-aligned, but users should treat the Access Secret as a sensitive credential.

Install only if you trust Zhihu's CLI distribution path and need this integration. Prefer a host secret store or environment variable for the Access Secret when available, avoid pasting real secrets into shared transcripts or logs, and use auth logout or revoke/regenerate the Access Secret if it may have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to execute shell and PowerShell scripts (`scripts/run.sh`, `setup.sh`, `run.ps1`, `setup.ps1`) but does not declare permissions for shell execution. This creates a trust and review gap: a host may treat the skill as lower risk while it can install software, inspect system state, and invoke external binaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The description frames the skill mainly as a Zhihu search/content tool, but the body also performs local software installation, upgrade management, credential setup, and remote manifest/binary retrieval. That mismatch can mislead users and reviewers about the actual trust boundary, increasing the chance that they approve execution of code or handling of secrets without understanding the operational risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to place an Access Secret directly into the Authorization header but does not warn that this value is a sensitive credential that must not be hardcoded, logged, shared, or committed. In a skill focused on API integration, omission of secret-handling guidance increases the chance that users will expose credentials during setup, debugging, or example reuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The chat/completions section documents a messages field without warning that its contents are transmitted to Zhihu's remote service and may include sensitive user or enterprise data. For a conversational API, lack of privacy and data-transfer disclosure can lead integrators to send secrets, personal data, or regulated content unintentionally.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The documentation repeatedly shows credential-bearing `Authorization: Bearer <your_access_secret>` headers but does not warn users not to paste real secrets into shell history, screenshots, shared logs, or committed example code. In a setup/reference file for an agent skill, this omission can lead to accidental credential disclosure during installation, debugging, or support interactions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document describes access to user-specific Zhihu data and use of OAuth tokens, but it does not clearly warn operators about privacy implications, consent requirements, or data-minimization expectations for personal content such as followees and favorites. In an agent skill context, this omission increases the risk of collecting or exposing personal data without adequate user awareness or policy controls.

Credential Access

High

• Category: Privilege Escalation

Content

2. `update_check.status=unavailable`：只表示本次无法确认远端版本，不得声称已是最新版；本地 CLI 可用时继续用户任务。
3. `compatible=false`：当前 CLI 低于 Skill 最低要求，先请求用户授权升级，升级完成前不调用业务命令。
4. CLI 或 Skill 存在可选更新：先完成当前任务，再简短提醒用户；只有用户同意后才更新。
5. 用户已经明确要求“安装并初始化”，或提供了明确要求完成初始化的开放平台安装 prompt：视为同时授权安装 CLI、在线验证 Access Secret，并最小读取一条本人内容作为验收；后两项会调用开放平台接口，可能消耗接口额度，无需逐项重复询问。若用户只授权安装，不执行第 9 步。
6. 获得授权后，运行对应平台的 `scripts/setup.sh` 或 `scripts/setup.ps1`，保存 stdout JSON 中的绝对 `binary_path`，再运行一次 status。
7. `auth.configured=false`：引导用户打开 <https://developer.zhihu.com/profile>，登录并手动生成 Access Secret，然后等待用户在对话中发送。
8. 收到 Access Secret 后，不在回复中复述完整内容。启动以下命令，并通过进程标准输入传入 Secret：

• Confidence: 88% confidence
• Finding: The skill directs the user to send an `Access Secret` in the conversation and then have the agent pass it to a local command via stdin. Requesting a long-lived credential through chat exposes it to the model/runtime, logs, transcripts, and potentially other integrations, which materially increases secret-handling risk even if the secret is not echoed back.

Credential Access

High

• Category: Privilege Escalation

Content

)

func main() {
    accessSecret := flag.String("access-secret", "", "Access Secret for Bearer authentication")
    query := flag.String("query", "chatgpt", "Search query")
    count := flag.Int("count", 10, "Number of results to return")
    filter := flag.String("filter", "", "Advanced filter expression")

• Confidence: 88% confidence
• Finding: The Go example accepts the Access Secret as a command-line flag, which commonly exposes secrets through shell history, process listings, job logs, and diagnostic output. In a developer integration skill, this pattern is especially risky because users may copy it verbatim into local or CI environments.

Static analysis

No suspicious patterns detected.