Security audit

zeelin-social-autopublisher

Security checks for vulnerabilities and agentic risk

Overview

This skill can post and reply from logged-in social accounts, and its live defaults, browser-control setup, scheduled modes, and weak scoping warrant Review before installation.

Install only if you are comfortable giving the skill control of logged-in social-media browser sessions. Use review or dry-run modes first, avoid production accounts for testing, do not enable QWEN_INSECURE_SSL, keep API keys low-privilege, and do not run the cron, growth-reply, smoke-test, or continuous scripts unless you explicitly want live public account actions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wechat_post.py:25
Finding: JavaScript Injection Through Social-Media Content
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/_thuqx_cdp_common.sh:18
Finding: Authenticated Chrome Profile Exposed Through Overly Permissive CDP Configuration
Content: View full analysis
/dev/null 2>&1; then open -na "Google Chrome" --args \ --remote-debugging-port="${port}" \ --user-data-dir="${HOME}/chrome-cdp-profile" \ --remote-allow-origins="*" \ --no-first-run \ "https://x.com" \ "https://weibo.com" \ "https://creator.xiaohongshu.com/publish/publish?source=official&from=menu&target=article" \ "https://mp.weixin.qq.com" 2>/dev/null || true elif command -v google-chrome >/dev/null 2>&1; then google-chrome --remote-debugging-port="${port}" \ --user-data-dir="${HOME}/chrome-cdp-profile" \ --remote-allow-origins="*" \ --no-first-run \ "https://x.com" "https://weibo.com" \ "https://creator.xiaohongshu.com/publish/publish?source=official&from=menu&target=article" \ "https://mp.weixin.qq.com" 2>/dev/null & elif command -v chromium >/dev/null 2>&1; then chromium --remote-debugging-port="${port}" \ --user-data-dir="${HOME}/chrome-cdp-profile" \ --remote-allow-origins="*" \ --no-first-run \ "https://x.com" "https://weibo.com" \ "https://creator.xiaohongshu.com/publish/publish?source=official&from=menu&target=article" \ "https://mp.weixin.qq.com" 2>/dev/null & ``` ### Technical Analysis The script starts Chrome with a persistent user-data directory, remote debugging, and `--remote-allow-origins="*"`. The browser profile is intended to contain logged-in sessions for multiple social platforms. CDP provides broad control over browser targets, including JavaScript evaluation, navigation, DOM access, and network inspection. Permitting every WebSocket origin is broader than necessary for a local publishing workflow and weakens browser-side restrictions intended to limit which origins can es ...[truncated 1505 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/run_social_ops_v5.sh:335
Finding: Execution of Unverified Scripts From an Environment-Controlled Skills Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_content.py:65
Finding: API Credential Can Be Sent to an Arbitrary Endpoint With Optional TLS Verification Disabled
Content: View full analysis
dict | None: if not DASHSCOPE_API_KEY: return None url = f"{QWEN_API_BASE}/chat/completions" user_block = f"""用户主题：{topic} {materials_text if materials_text else "（当前无可用网页摘要：请仅根据主题做合理、克制的推断，避免捏造具体事实；人物性别不明时请用中性称呼。）"} {feedback if feedback else ""} 请严格按 system 规则，为主题生成六个平台稿件，输出单个 JSON 对象（仅该对象，无其它字符）。""" payload = json.dumps( { "model": QWEN_MODEL, "messages": [ {"role": "system", "content": _build_system ...[truncated 2595 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run_four_platform_test.sh:13
Finding: Smoke-Test Script Performs Real Actions on Authenticated Social-Media Accounts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run_autoops_engine.sh:7
Finding: Unbounded Continuous Workflows Repeatedly Publish Without Per-Cycle Approval
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (49)

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/generate_content.py (reported line 86)May include surrounding context.
python
return ssl.create_default_context() try: return urllib.request.urlopen(req, timeout=timeout, context=ctx_default()) except urllib.error.URLError as e: reason = getattr(e, "reason", e) ssl_bad = isinstance(reason, ssl.SSLError) and (

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 98% confidence
Finding: When QWEN_INSECURE_SSL is enabled, the script falls back to ssl._create_unverified_context(), disabling certificate verification for the LLM API call. That allows a man-in-the-middle attacker on the network to intercept or modify prompts, returned content, and API credentials sent in the Authorization header.
Content: Scanner excerpt · scripts/generate_content.py (reported line 95)May include surrounding context.
python
) if ssl_bad and QWEN_INSECURE_SSL: ctx = ssl._create_unverified_context() return urllib.request.urlopen(req, timeout=timeout, context=ctx) if ssl_bad and not QWEN_INSECURE_SSL: print( "[generate_content] SSL 证书校验失败，已回退模板。"

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/generate_content.py (reported line 121)May include surrounding context.
python
"(KHTML, like Gecko) Chrome/122.0 Safari/537.36" }, ) with urllib.request.urlopen(req, timeout=8) as r: html = r.read().decode("utf-8", errors="ignore") items: list[dict] = []

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a general four-platform publishing tool, but it also advertises X-specific search-and-reply growth automation using follow-back and mutual-follow queries. That undeclared behavioral expansion is dangerous because engagement automation can be used for platform manipulation, spam, or reputation farming, which is riskier than straightforward user-directed publishing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill presents itself as a general four-platform publishing tool, but it also advertises X-specific search-and-reply growth automation using follow-back and mutual-follow queries. That undeclared behavioral expansion is dangerous because engagement automation can be used for platform manipulation, spam, or reputation farming, which is riskier than straightforward user-directed publishing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill presents itself as a general four-platform publishing tool, but it also advertises X-specific search-and-reply growth automation using follow-back and mutual-follow queries. That undeclared behavioral expansion is dangerous because engagement automation can be used for platform manipulation, spam, or reputation farming, which is riskier than straightforward user-directed publishing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill presents itself as a general four-platform publishing tool, but it also advertises X-specific search-and-reply growth automation using follow-back and mutual-follow queries. That undeclared behavioral expansion is dangerous because engagement automation can be used for platform manipulation, spam, or reputation farming, which is riskier than straightforward user-directed publishing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a general four-platform publishing tool, but it also advertises X-specific search-and-reply growth automation using follow-back and mutual-follow queries. That undeclared behavioral expansion is dangerous because engagement automation can be used for platform manipulation, spam, or reputation farming, which is riskier than straightforward user-directed publishing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill presents itself as a general four-platform publishing tool, but it also advertises X-specific search-and-reply growth automation using follow-back and mutual-follow queries. That undeclared behavioral expansion is dangerous because engagement automation can be used for platform manipulation, spam, or reputation farming, which is riskier than straightforward user-directed publishing.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
1. `generate_content.py` 根据主题输出 **JSON**（twitter / weibo / xhs_title / xhs_body / wechat_title / wechat_body），并可通过 `--output` 落盘；同目录的 **`四大平台内容生产提示词手册.md`** 会被读

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares broad operational behavior involving shell execution, network access, file I/O, environment variables, and browser automation, but it does not declare any explicit tool scope or permission boundaries. That omission increases the chance an orchestrator or user will invoke it with overly broad authority, making unintended publication, file writes, or environment misuse harder to constrain and audit.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented X workflow explicitly automates reciprocal-follow outreach, caps batches to avoid detection, and advises slight variation between replies, which are classic indicators of engagement manipulation and anti-abuse evasion. In context, this is more dangerous than generic social posting because it operationalizes deceptive growth tactics against a live platform through logged-in user accounts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Mandating English replies for X/Twitter interaction without user opt-in or clear business justification can cause deceptive or inauthentic automated outreach, especially when paired with growth queries targeting follow-back behavior. It increases the likelihood of impersonation-like messaging, user confusion, and policy-violating spam in contexts where the operator may not realize language choice is fixed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document presents its operational instructions in Chinese only, which can constitute a language/locale policy violation when no user opt-in or alternative language option is provided. Nothing in the file indicates that the skill is region-specific or that Chinese is a justified mandatory locale.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The operator prompt expands the skill’s effective behavior beyond autopublishing by instructing the agent to gather current AI news from the web or browser before running the wrapper. This creates a scope mismatch: an agent invoking the skill may perform unbounded external browsing and ingest untrusted content, increasing prompt-injection and data-flow risk that is not reflected in the skill’s stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The prompt expands the skill from publishing/draft assistance into active growth engagement by searching for follow-back posts and replying to users. That creates a materially different capability from the declared scope and can trigger unsolicited account actions, platform-policy violations, or reputation harm when an operator expects only content publishing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Mandating local Chrome/CDP-based automation introduces a powerful undeclared capability to drive a logged-in browser session and perform account actions outside official APIs. That increases the chance of opaque automated behavior, accidental misuse of authenticated sessions, and bypass of platform controls or user expectations about what the skill can access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs automated browser-driven replies and shell-script execution against a logged-in X account without an upfront warning or strong consent flow for automated account actions. In context, this is dangerous because it can send public replies from a real user profile, creating account, compliance, and reputational risk if the operator does not fully understand the automation scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a four-platform social autopublisher that orchestrates browser-based posting and draft creation. In this helper, the code sources ${HOME}/.openclaw/zeelin-qwen.env for generate_content.py, introducing credential/config loading for an external LLM provider inside a CDP startup script; that capability is not necessary to ensure Chrome remote debugging is available.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script starts Chrome with the DevTools remote debugging port enabled and a persistent user-data-dir, then opens already-authenticated social-media sites automatically. Any local process able to reach 127.0.0.1:9222 can use the DevTools protocol to inspect pages, extract cookies/session data, and drive actions on those logged-in accounts, which is especially risky in an autopublishing skill handling multiple platforms.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This shell script presents its usage and option descriptions only in Chinese, which forces a specific language on users without opt-in or justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language requirement 'Reply in English only' imposes a fixed language policy in the generated cron task. This file does not offer a user choice of language or explain a region-specific need, so it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script performs automatic web searches for reference materials even though its stated purpose is generating social copy. This expands the skill's external data flows and attack surface, and can leak sensitive or proprietary topics to a third-party search engine without the operator realizing it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Fetching third-party content unrelated to direct publishing requirements introduces unnecessary dependency on untrusted external data. This can taint generated outputs with manipulated, inaccurate, or adversarial content and creates additional privacy and reliability risks beyond the core function of drafting posts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script sends the user-provided topic to DuckDuckGo search without a clear user-facing warning or consent mechanism. If topics contain confidential campaign plans, customer names, internal projects, or embargoed events, that information is disclosed to an external provider and may be logged or profiled.
Content: No source excerpt is available for this finding.