xingtuTaskAuthor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.1

Overview

The skill does the advertised XingTu author export, but it asks for and stores a live browser cookie in plaintext and exports sensitive contact data without enough safeguards.

Review before installing. Use this only in an environment where exposing a XingTu session cookie to the agent is acceptable, delete ~/.xingtuCookie.txt after use, avoid reusing broad or privileged sessions, and treat the generated Excel file as sensitive because it may contain contact and business information from third parties.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Shell Command Injection Through Untrusted Cookie and Task ID Substitution

Content

View full analysis

/scripts/fetch_xingtu_authors.py" --task-id "" --cookie "" --validate ``` ``` ```markdown Run the fetch script to get all authors across all pages: ```bash python "/scripts/fetch_xingtu_authors.py" --task-id "" --cookie "" ``` ``` ### Technical Analysis The Skill instructs the Agent to interpolate user-controlled `task_id` and `cookie` values directly into textual shell commands. Double quotes do not safely neutralize all shell syntax. In particular, a value containing a double quote can terminate the intended argument, while command substitutions such as `$()` and backticks may be evaluated even inside double quotes. If the Agent executes the documented command through a shell, a malicious value can alter the command structure. Quoting the substituted value in the template is therefore not equivalent to passing it as a discrete process argument. The risk applies especially to cookies copied from a user message because the workflow explicitly treats message content as a valid source of cookie strings. ### Attack Path 1. An attacker supplies a cookie or task ID containing shell syntax, such as a quote followed by a command separator or command substitution. 2. The Agent replaces `` or `` in the documented command with the supplied value. 3. The resulting command is passed to a shell. 4. The shell interprets the injected syntax rather than treating the entire value as data. 5. The injected command executes with the operating-system privileges of the Agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution in the Agent's environment. The attacker could read or modify ...[truncated 244 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20

Finding

Reusable Authentication Cookie Exposed Through Plaintext Storage and Process Arguments

Content

View full analysis

/scripts/fetch_xingtu_authors.py" --task-id "" --cookie "" --validate ``` ``` ```markdown 1. First, check if the user's current message contains a cookie string. If yes: - Validate it using the `--validate` command from Step 2. - If valid: write it to `~/.xingtuCookie.txt` and proceed to Step 4. ``` ```markdown 5. When the user provides the cookie string: - Save it to `~/.xingtuCookie.txt` - Validate it using the `--validate` command ``` ```markdown python "/scripts/fetch_xingtu_authors.py" --task-id "" --cookie "" ``` ```python parser.add_argument("--cookie", required=True, help="Cookie string for authentication") ``` ### Technical Analysis The workflow handles a reusable XingTu session cookie as plaintext in several insecure channels: 1. It asks the user to provide the complete cookie in the conversation. 2. It persists that cookie in `~/.xingtuCookie.txt` without prescribing restrictive file permissions. 3. It passes the cookie through the process command line. Command-line arguments may be visible in process inspection tools, execution telemetry, shell history, debugging output, or orchestration logs. A plaintext file created with default permissions may be readable by other local users or processes depending on the host's umask and access controls. Conversation records may also retain the credential beyond its intended lifetime. The cookie is used directly in the HTTP `Cooki ...[truncated 1070 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch_xingtu_authors.py:199

Finding

Spreadsheet Formula Injection in Generated Excel Workbooks

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:137

Finding

Unpinned Runtime Installation of Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directs the user to provide a full cookie string and then persist it locally for later reuse in ~/.xingtuCookie.txt. Persisting reusable session credentials on disk increases the blast radius of compromise: any local malware, other processes, backups, or unintended file exposure could recover the cookie and impersonate the user on XingTu.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs the user to copy and send their full browser Cookie string, which is an authentication secret equivalent to an active session token. It also lacks a clear warning not to share broader browser cookies or guidance to use a safer auth flow, creating a high risk of account/session hijacking and unintended disclosure of sensitive platform access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicated finding points to the same behavior: persisting a user's active XingTu session cookie for reuse. In context, the skill's purpose is to access a protected author list, so retaining the cookie creates an unnecessary long-lived authentication artifact and increases the chance of unauthorized reuse.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

1. First, check if the user's current message contains a cookie string. If yes:
   - Validate it using the `--validate` command from Step 2.
   - If valid: write it to `~/.xingtuCookie.txt` and proceed to Step 4.
   - If invalid: continue below.

2. Tell the user the login is required. Use the appropriate message:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicated finding points to the same behavior: persisting a user's active XingTu session cookie for reuse. In context, the skill's purpose is to access a protected author list, so retaining the cookie creates an unnecessary long-lived authentication artifact and increases the chance of unauthorized reuse.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

1. First, check if the user's current message contains a cookie string. If yes:
   - Validate it using the `--validate` command from Step 2.
   - If valid: write it to `~/.xingtuCookie.txt` and proceed to Step 4.
   - If invalid: continue below.

2. Tell the user the login is required. Use the appropriate message:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script accepts a raw authentication cookie and places it into the request headers for API calls, but the user-facing text only describes it as an argument and does not warn that the credential will be sent to the remote XingTu endpoint. This is a credential-handling and network transmission action that merits explicit disclosure under the missing-warning criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_xingtu_authors.py (reported line 52)May include surrounding context.

python

"page": page,
        "limit": limit,
    }
    resp = requests.post(API_URL, headers=headers, json=body, timeout=30)
    resp.encoding = "utf-8"
    return resp.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code writes a workbook containing fields such as author IDs, city, and WeChat IDs to disk, but there is no warning in the docstring, argument help, or comments that the script will persist potentially sensitive personal data locally. For code files, safety-relevant file writes and sensitive-data handling should have some visible disclosure unless already clearly warned elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.