Security audit

Zhihu

Security checks across malware telemetry and agentic risk

Overview

This Zhihu skill appears purpose-aligned but should be reviewed because it can publish, react, comment, and delete live Zhihu content without clear safety framing or confirmation guidance.

Install only if you intend to let an agent operate a live Zhihu account. Use a dedicated app credential if possible, store secrets outside version control with restricted permissions, and manually confirm any publish, comment, reaction, or delete action after reviewing the exact target content or comment ID.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises capabilities to publish posts, like/unlike, comment, and delete comments against a live Zhihu environment, but it does not clearly warn users that these are state-changing operations on real account/content data. In an agent-skill context, missing safety framing increases the chance of accidental misuse, unintended spam, or destructive actions by operators who assume the commands are read-only or test-safe.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The credential setup instructs users to place app_key and app_secret in a local configuration file without warning that these are sensitive secrets requiring secure storage and restricted file permissions. In shared systems or improperly protected home directories, this can lead to credential exposure and unauthorized API use against the linked Zhihu account or application.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises account-affecting and destructive operations such as publishing, liking, commenting, and deleting without any caution about side effects, authorization, or confirmation. In an agent setting, this increases the chance of unintended actions against a live Zhihu account because users may invoke the skill without understanding that it performs real external mutations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The credential setup instructions tell users to store app credentials in environment variables or a config file but provide no warning about secret handling, file permissions, accidental logging, or committing secrets to source control. This can lead to credential exposure and subsequent unauthorized use of the Zhihu API on behalf of the user or application.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The delete-comment command performs an irreversible content-deletion action but the documentation includes no warning to verify the target comment ID or confirm intent before execution. In an automated agent workflow, a mistaken ID, prompt injection, or user misunderstanding could cause unintended deletion of live content with limited recovery options.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.