Security audit

Last30Days CN

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its research purpose, but it includes an automatic startup hook with an unsafe env-file parser that could execute commands from a project-controlled config file.

Install only if you are comfortable with a skill that performs web scraping/searches, uses optional platform credentials, and writes local reports/cookies. Do not enable the included startup hook until check-config.sh is fixed to remove eval and to allowlist config keys. Use tightly scoped API keys, avoid trusting repository-provided .claude/last30days-cn.env files, and clear stored browser cookies when finished.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: hooks/scripts/check-config.sh:27
Finding: Automatic Command Injection Through Project-Controlled Configuration
Content: View full analysis
Remediation: View remediation
&2 ;; esac ``` 5. Do not use `xargs` as a general-purpose configuration parser because it alters quoting and whitespace. 6. Consider removing project-level configuration processing from the automatic `SessionStart` hook. Parse it only when the user explicitly invokes the Skill. 7. If automatic project configuration remains supported, require user confirmation before trusting a repository-provided file. 8. Add regression tests containing command substitutions, backticks, semicolons, quotes, newlines, and malformed variable names, and verify that none are executed. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/crawler_bridge.py:54
Finding: Browser Authentication Cookies Persisted Without Restrictive Permissions
Content: View full analysis
Path: _ensure_cookie_dir() return COOKIE_DIR / f"{platform}_cookies.json" def save_cookies(platform: str, cookies: list): path = _get_cookie_path(platform) path.write_text(json.dumps(cookies, ensure_ascii=False, indent=2), encoding="utf-8") def load_cookies(platform: str) -> Optional[list]: path = _get_cookie_path(platform) if path.exists(): try: return json.loads(path.read_text(encoding="utf-8")) except Exception: return None return None ``` The browser context automatically persists all cookies when it closes: ```python cookies = load_cookies(platform) if cookies: try: context.add_cookies(cookies) except Exception as e: sys.stderr.write(f"[爬虫-{platform}] 加载 Cookie 失败: {e}\n") page = context.new_page() try: yield browser, context, page finally: try: save_cookies(platform, context.cookies()) except Exception: pass ``` ### Technical Analysis The crawler writes the entire Playwright browser-context cookie collection to plaintext JSON files under: ```text ~/.config/last30days-cn/browser_cookies/ ``` The directory is created without an explicit mode, and `Path.write_text` creates files without explicitly restricting their permissions. Effective permissions therefore depend on the process umask. With a permissive umask, the directory or fil ...[truncated 1824 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/baidu.py:121
Finding: Baidu API Key Exposed in Request URL
Content: View full analysis
List[Dict[str, Any]]: """通过百度搜索 API 进行搜索。""" items = [] try: encoded = urllib.parse.quote(topic) url = f"https://api.baidu.com/search/v1?q={encoded}&rn={limit}&key={api_key}" req = urllib.request.Request(url, headers={"User-Agent": _UA_POOL[0]}) with urllib.request.urlopen(req, timeout=15) as response: data = json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis The Baidu API key is embedded directly in the request URL as the `key` query parameter. HTTPS protects the URL while it is in transit between the client and the TLS endpoint, but it does not prevent the complete URL from being retained by: - Provider access logs. - Reverse proxies and gateways. - Local or enterprise HTTP diagnostics. - Monitoring and tracing systems. - Exception or debugging output. - Network-security products that terminate TLS. Query strings are commonly logged more broadly than authorization headers. A leaked API key may therefore be recovered from systems that legitimately record request URLs. The function also requires a `secret_key` argument but never uses it. This creates a misleading security model: the Skill loads and requests a second credential while authentication is performed using only the URL-exposed API key. Sending an API credential to the declared Baidu API is necessary for the optional API feature. The unsafe part is the transport location and the unnecessary handling of an unused secret. ### Attack Path 1. The user configures `BAIDU_API_KEY` and `BAIDU_SECRET_KEY`. 2. A Baidu search invokes `_search_via_api`. 3. The function constructs a URL containing the plaintext API key. 4. A provider, prox ...[truncated 870 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (135)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 12)May include surrounding context.
text
*.egg-info/ dist/ build/ .env

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · README.md (reported line 394)May include surrounding context.
md
> **This project is for educational and research purposes only.** 1. All crawler features are intended solely for technical learning and research. **Commercial use is strictly prohibited.** 2. Users must comply with all applicable laws and regulations, including but not limited to data protection and privacy laws. 3. Users must respect each platform's Terms of Service (ToS) and robots.txt. 4. The developer assumes **no liability** for any legal consequences arising from the use of this project. 5. **Do NOT** use this project for large-scale data scraping, personal data collection, or any illegal activities.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full-featured multi-platform research engine with platform coverage, anti-crawling fixes, fallback search, and AI synthesis. The supplied code chunk does none of that. It is a configuration helper script whose role is limited to locating env files, checking permissions, loading variables, determining whether optional keys/cookies are configured, estimating the number of available sources, and printing welcome/readiness messages. While the messages reference the same China platforms, the actual behavior is only setup/status checking, which is materially different from the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the declared description and the supplied code. The code chunk is effectively empty aside from a comment in init.py and does not demonstrate any of the claimed platform coverage, network access, scraping logic, search fallback, or report-generation behavior. Given only this code, the declared primary purpose is not represented at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents a comprehensive cross-platform research engine with eight platform coverage, anti-crawling improvements for Baidu and Xiaohongshu, XHR interception, Bing fallback, and AI-based report generation. The supplied code chunk does not implement that overall behavior. It is a narrowly scoped Bilibili search module that fetches Bilibili search results via public API, optionally uses a crawler fallback through a local bridge, parses and ranks video items, and returns them. While this may be a supporting component of a larger system, taken on its own it does not accurately represent the declared purpose because the declared capabilities are substantially broader and mostly absent from the code shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a multi-platform Chinese research/search and analysis engine. However, the supplied code chunk does not implement any of that primary functionality. It is a generic caching module that reads and writes JSON files in a local cache directory, checks TTLs, and stores model-selection metadata. While caching could be a supporting utility within such a system, this chunk by itself materially differs from the declared purpose and also introduces filesystem access that is not reflected in the declared permissions. Therefore this code chunk does not accurately represent the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: There is a meaningful description-behavior mismatch. The code clearly supports part of the declared crawler functionality: Playwright browser automation, cookie-backed login reuse, and XHR interception replacing DOM parsing for Xiaohongshu and Douyin. That aligns partially with the description’s crawler-oriented claims. However, the declared purpose is substantially broader than what this code chunk actually does. The description emphasizes an 8-platform deep research engine with Baidu/Xiaohongshu anti-crawling fixes, Bing fallback, and AI-generated research reports. In contrast, this code chunk only implements crawling/search extraction for Weibo, Xiaohongshu, Douyin, Bilibili, and Zhihu, with no evidence of WeChat Official Accounts, Baidu, Toutiao, Bing fallback, or AI analysis/report generation. Additionally, the code stores and reloads browser cookies for persistent authenticated sessions, which is a notable operational capability not stated in the description. While some missing features could exist elsewhere, based on this supplied chunk alone the declared description overstates the implemented functionality and omits local credential persistence behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full-featured Chinese platform research engine with scraping/search capabilities and AI report synthesis. The supplied code chunk does none of that: it is only a generic date helper library for calculating recent date ranges, parsing dates, and scoring recency. This is a materially different primary purpose, not merely a supporting implementation detail for the declared functionality, because the code itself exposes only date utilities and no platform access, crawling, interception, search, or analysis behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied code is a support module for environment/config management, not the described deep research engine itself. It loads API keys and cookies from environment files, checks availability of data sources like Weibo/Xiaohongshu/Douyin/WeChat/Baidu, and validates source selection strings. While the platform names align with the description, the chunk does not implement the advertised primary behaviors: multi-platform content retrieval, anti-crawl handling, XHR interception, search fallback, or AI report synthesis. This is a material mismatch between declared purpose and actual behavior for this specific code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a complete multi-platform China research engine with specific data-source coverage and analysis features. The supplied code chunk does not implement any of those user-facing capabilities. It is only a reusable HTTP helper library for sending requests, parsing JSON, retrying on failures, and handling rate limits. While such a module could support a larger scraping/research system, this chunk by itself materially differs from the declared primary purpose and lacks the claimed platform coverage and analysis behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a full research engine with platform collection, anti-bot workarounds, fallback search, and AI synthesis/report generation. The supplied code chunk does not implement those capabilities. It is a data-transformation utility: it maps raw dictionaries into typed schema objects for Weibo, Xiaohongshu, Bilibili, Zhihu, Douyin, WeChat, Baidu, and Toutiao, computes date confidence, filters by date range, and converts items to dicts. While supporting normalization for the same eight platforms is related to the broader product, the behavior shown is much narrower than the declared functionality, so the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code is narrowly focused on text preprocessing: cleaning verbose queries, removing noise words, handling Chinese tokenization (with jieba if available), and identifying compound terms. It does not implement any of the major capabilities emphasized in the description, such as interacting with Chinese content platforms, performing search, handling anti-scraping, intercepting XHR traffic, invoking Bing, or generating research reports. While query preprocessing could be a supporting component of a search system, this code chunk by itself materially differs from the declared purpose and lacks the core declared behaviors.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a full-featured cross-platform Chinese research engine with concrete acquisition and analysis capabilities. The supplied code chunk, however, is a narrow utility module: it classifies a user topic into categories such as product/how-to/comparison, and configures source-selection and scoring preferences accordingly. While the source names align with the declared platforms, this module does not actually access those platforms or implement the headline capabilities in the description. This is a material description-to-behavior mismatch for the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full-featured cross-platform Chinese research engine with web collection, anti-bot handling, fallback search, and AI report synthesis. The supplied code does none of that. It only implements text relevance scoring: tokenizing English/Chinese text, removing stopwords, expanding synonyms, and computing a numeric overlap score between a query and candidate text/hashtags. While such a module could be a supporting component inside a search/ranking pipeline, this chunk by itself does not exhibit the core declared behavior and has a materially different primary purpose. Therefore this is a clear description-to-code mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a full cross-platform research engine with collection, anti-crawling workarounds, search fallback, and AI analysis/report generation. The supplied code is a narrow library module for popularity-aware scoring: it computes engagement scores for different platforms, combines them with relevance and recency, applies penalties/bonuses, sorts results, and filters by relevance. While the platforms named in the code overlap with the description, the actual behavior shown is only ranking/post-processing of items, not the claimed end-to-end research functionality. This is a material description-behavior mismatch, not merely an implementation detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents the skill as a platform research engine with anti-crawling fixes, multi-platform content acquisition, Bing fallback search, and AI synthesis into reports. The supplied code does not implement those behaviors. Instead, it is a setup wizard utility: it detects first run, checks availability of platform/API-related settings via helper functions, writes a SETUP_COMPLETE flag to a local .env file, and generates a human-readable setup status message. While configuration support can be a supporting part of a larger skill, this chunk’s primary purpose is materially different from the declared purpose, and it includes local config-writing behavior not mentioned in the description. Therefore this chunk does not accurately represent the declared functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a multi-platform deep research engine with broad source coverage and higher-level analysis/reporting features. The actual code chunk is a narrow, single-platform retrieval component for 微信公众号 articles. It does not demonstrate support for the other named platforms, does not implement XHR interception or Bing fallback, and does not generate any research report or AI synthesis. While this module is consistent with one small part of the declared system (WeChat search), the description materially overstates the behavior of the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad, cross-platform research engine with multiple platform integrations, anti-crawling improvements, XHR interception, Bing fallback, and AI-generated research reports. The supplied code chunk is much narrower: it is a standalone Weibo search module. Its behavior is limited to retrieving Weibo results through three methods (official API, crawler bridge, and public mobile API), parsing returned posts, cleaning text, normalizing dates, and ranking by token-overlap relevance. While this is plausibly a component of a larger system, the code shown does not substantiate the declared primary purpose or most of the claimed capabilities. Therefore, for this chunk, the description materially overstates what the code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad, cross-platform research engine with coverage of eight Chinese platforms plus search fallbacks and AI-generated research reports. The supplied code chunk, however, is a single-platform Xiaohongshu search module. It searches Xiaohongshu via three retrieval methods (self-hosted API, Playwright crawler, public endpoint), parses note metadata, and ranks results by relevance. There is no evidence in this chunk of support for the other listed platforms, Bing fallback, XHR interception logic, or AI synthesis/report generation. While a single module can be part of a larger system, the task is to compare the declared description against the supplied code chunk itself, and this chunk materially underdelivers relative to the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad, end-to-end multi-platform research engine with specialized anti-crawling improvements, cross-platform fallback behavior, and AI report synthesis. The supplied code chunk does something much narrower: it searches Zhihu content via Zhihu APIs, optionally uses a crawler fallback for Zhihu, and returns parsed/ranked Zhihu items. There is no evidence in this chunk of coverage for the other listed platforms, no Baidu/Xiaohongshu-specific fixes, no XHR interception logic, no Bing fallback, and no AI report generation. This is a material scope mismatch between the declared purpose and the actual behavior of the provided code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向多中国平台的研究与搜索引擎，核心能力应包括网络访问、平台内容检索/抓取、反爬处理、XHR拦截、搜索兜底和AI报告生成。但实际代码仅是一个 shell 部署脚本：创建本地目录并复制技能相关文件到多个目标路径。其主要目的与声明完全不同，且体现了未声明的文件系统操作与多平台安装/同步能力。因此这是明显的描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a substantial multi-platform research and scraping engine with specific technical mechanisms and AI report generation. However, the supplied code chunk is only an empty test package initializer with a comment ('# last30days tests'). It does not implement any of the declared capabilities, does not access any platforms or resources, and has no observable functional behavior related to the stated purpose. Therefore, the description does not accurately represent the provided code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full-featured Chinese multi-platform research engine with web data collection, anti-bot handling, fallback search, and AI report synthesis. The supplied code chunk does none of that. It is only a test module validating helper behavior in a cache library, such as deterministic cache keys, file paths, and missing-cache handling. This is a materially different primary purpose and does not implement the declared capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full-featured Chinese platform research engine with active crawling/search and AI analysis capabilities. However, the supplied code chunk is only a test module (tests/test_crawler_bridge.py) that validates utility behavior in another module. It does not itself crawl platforms, intercept XHR, search Bing, generate reports, or perform cross-platform research. Its actual purpose is materially different: testing parser, status, and cookie helper functions. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a multi-platform research/scraping engine with anti-bot workarounds and AI report generation. The actual code chunk contains only unit tests for date-related helper functions. It does not access any external platforms, perform web requests, scrape content, intercept XHR, use Bing, or generate reports. This is a clear and material mismatch in primary purpose and capabilities.
Content: No source excerpt is available for this finding.