ZeeLin 知乎自动发布

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:26 AM UTC
• Version: 0.1.0

Overview

This skill is mostly aligned with posting Zhihu articles, but it gives an agent live publishing power with weak destination checks and token handling safeguards.

Install only if you are comfortable letting the agent publish to your live Zhihu account. Review the full article before replying with the publish confirmation, avoid setting ZHIHU_API_BASE or ZHIHU_BASE, use a narrowly scoped short-lived Zhihu token if using API mode, and ensure Browser Relay is attached only to the real Zhihu editor tab.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish_via_api.sh:17

Finding

OAuth Token and Unpublished Article Disclosure Through an Unrestricted API Endpoint Override

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` 3. Reject non-HTTPS URLs, embedded credentials, unexpected ports, IP-address forms, subdomain lookalikes, and trailing path components. 4. Configure `curl` to fail safely and avoid cross-origin credential forwarding. Do not enable unrestricted redirect following. If redirects are required, verify that every redirect remains on the approved HTTPS origin. 5. Use narrowly scoped, short-lived OAuth tokens and document the minimum scopes required for article publication. 6. Avoid inheriting security-sensitive endpoint variables from untrusted wrappers or service configurations. Clear or explicitly set the execution environment before invoking the script. 7. Revoke and rotate any token suspected of having been exposed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish_article.sh:16

Finding

Unvalidated Browser Destination Combined With Broad Form and Submission Element Matching

Content

View full analysis

/dev/null || $CLI open "${ZHIHU_BASE}" 2>/dev/null ``` The script then selects broad textbox or editing references and types the draft: ```bash SNAP=$($CLI snapshot 2>/dev/null) TITLE_REF=$(echo "$SNAP" | grep -E 'textbox|input|title|placeholder.*title' | grep -oE 'ref=e[0-9]+' | head -1 | sed 's/ref=//') if [ -n "$TITLE_REF" ]; then $CLI type "$TITLE_REF" "$TITLE" 2>/dev/null fi BODY_REF=$(echo "$SNAP" | grep -E 'textbox|contenteditable|body|edit' | grep -oE 'ref=e[0-9]+' | head -1 | sed 's/ref=//') if [ -n "$BODY_REF" ]; then BODY_SHORT=$(echo "$BODY" | head -c 8000) $CLI type "$BODY_REF" "$BODY_SHORT" 2>/dev/null fi ``` It also searches for generic publication or submission controls and clicks the first matching reference: ```bash PUBLISH_REF=$(echo "$SNAP" | grep -E 'publish|post|submit|Publish' | grep -oE 'ref=e[0-9]+' | head -1 | sed 's/ref=//') if [ -n "$PUBLISH_REF" ]; then $CLI click "$PUBLISH_REF" 2>/dev/null ``` The original implementation uses Chinese Zhihu interface labels in addition to the English `Publish` keyword. The translated comments and matching terms above describe the same audited behavior. ### Technical Analysis `ZHIHU_BASE` is controlled by an environment variable and is used as the browser destination without validating the URL's scheme, hostname, port, or current browser origin. After opening the destination, the script relies on broad textual matches such as `textbox`, `input`, `contenteditable`, `Publish`, and generic submission labels. A m ...[truncated 2598 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The API-based path further widens the description-behavior gap: the skill claims browser-side confirmed publishing after drafting, but also allows token-based direct posting without enforcing those steps. When a skill can post directly to a user's account, inaccurate descriptions undermine informed consent and can bypass expected manual review moments.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The API-based path further widens the description-behavior gap: the skill claims browser-side confirmed publishing after drafting, but also allows token-based direct posting without enforcing those steps. When a skill can post directly to a user's account, inaccurate descriptions undermine informed consent and can bypass expected manual review moments.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script automatically clicks the Zhihu publish button, and if that is not found, it falls back to publication hotkeys, without an in-script user confirmation step immediately before the irreversible action. In this skill’s context, the whole purpose is to draft and post content on a logged-in user account, so a parsing mistake, wrong browser tab/editor state, or unintended invocation can directly cause unauthorized or accidental publication under the user’s identity.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs use of shell/exec and file writes but declares no explicit tool scope or permissions boundary. In an agent environment, this increases the chance the skill can invoke broader capabilities than users or reviewers expect, especially when it can automate posting actions on a live account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill performs live publication to a user's Zhihu account, which is an external side effect that may be difficult or impossible to fully undo after posting. Failing to clearly warn about irreversibility and live-account impact can cause users to authorize actions without understanding the consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

## 知乎 API 在哪调

- **开放平台**：https://dev.zhihu.com/ — 注册应用、OAuth 2.0 获取 `access_token`。**注意**：知乎发布 API 目前仅对内侧用户开放，多数用户无法使用。
- **发布文章接口**（内侧）：一般为 `POST https://api.zhihu.com/v4/articles`。未开放前请用下方「网页端直接发布」。
- **本 skill 发布方式**：
  1. **API 发布**（仅内侧可用）：若环境变量已设置 `ZHIHU_ACCESS_TOKEN`，使用 `scripts/publish_via_api.sh`。
  2. **网页端直接发布（推荐）**：使用 `scripts/publish_article.sh`，在**已打开的知乎写文章页**上填表并点击发布；配合 **Browser Relay** 可大幅缩短耗时、降低 request timed out（见下）。

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script explicitly enables article publishing via API without the browser-based login and post-confirmation flow described in the skill metadata. That creates a trust-boundary mismatch: users may expect a final in-browser confirmation step, but with a valid token the script can publish directly, increasing the risk of unintended or unauthorized posting if invoked by the agent or another component.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file comments and usage guidance advertise browser-free publishing, which contradicts the stated workflow that requires the user to log in and click confirm in the browser. This discrepancy can mislead reviewers and users about how much control they retain over publication, making accidental or opaque publication more likely in a content-posting skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script includes natural-language instructions, comments, and runtime messages exclusively in Chinese, such as the usage guidance and token setup text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_via_api.sh (reported line 58)May include surrounding context.

sh

echo "正文长度: $(wc -c < "$TMP_BODY") 字符"
echo ""

RESP=$(curl -s -w "\n%{http_code}" -X POST "${ZHIHU_API_BASE}/v4/articles" \
  -H "Authorization: Bearer ${ZHIHU_ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs the user to respond with specific Chinese phrases such as "确定" or "发布" to proceed, and the overall interaction model is written as if Chinese-only behavior is required. There is no opt-in or explanation that the skill is intentionally limited to Chinese-language use, which can violate language/locale flexibility policy.

Content

No source excerpt is available for this finding.