Security audit

Clawhub Skill Toutiao Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it says, but it needs Review because it can automatically publish live posts using session cookies and schedule repeated posting with weak safety controls.

Install only after reviewing the automation risk: this skill can act as a logged-in Toutiao account and publish publicly. Use a dedicated account, keep cookie and Feishu config files out of repos and backups, restrict file permissions on cookies and logs, test with non-publishing modes first, avoid unattended scheduling until you add confirmation controls, and run the browser in an isolated unprivileged environment with the sandbox enabled where possible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: core/playwright_publisher.py:59
Finding: Chromium Sandbox Disabled During Authenticated Web Automation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: core/image_generator.py:83
Finding: Path Traversal in Placeholder Image Filename Allows Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: core/cookie_manager.py:98
Finding: Sensitive Session Cookies and Authenticated Screenshots Lack Filesystem Protection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: core/playwright_publisher.py:995
Finding: Unknown or Failed Publication States Are Reported as Successful
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependencies Use Open-Ended Version Ranges Without Integrity Verification
Content: View full analysis
=1.40.0 requests>=2.28.0 schedule>=1.2.0 Pillow>=9.0.0 ``` The documented installation process installs these packages without a lockfile or hashes: ```bash pip install playwright playwright install chromium pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended lower bound. A future installation can therefore resolve to package releases that did not exist when the Skill was reviewed. No lockfile, package hashes, or approved package index is specified. The named packages are mainstream packages, and the audit found no typosquatted package names or suspicious package repository. The risk is instead that future upstream compromise, malicious release, or incompatible update could change installation-time or runtime behavior without a corresponding Skill code change. Python packages and installation hooks execute with the privileges of the installer. Playwright additionally downloads browser binaries, increasing the external supply-chain surface. ### Attack Path 1. A dependency account, distribution channel, or future release is compromised. 2. An operator installs the Skill after the compromised release becomes the newest compatible version. 3. The open-ended constraint resolves to that unreviewed release. 4. Package installation or import executes the changed code. 5. The malicious dependency receives the permissions and data available to the Skill process. No current malicious dependency was identified; this is a preventive supply-chain finding. ### Impact Assessment A compromised dependency could execute code under the installer or runtime account, access Toutiao cookies and Feishu credentials, alter generated content, intercept publishing operations, or transmit local data. ...[truncated 76 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description omits Feishu credential use and outbound notification behavior, yet the documented configuration includes app credentials and message recipients. Undisclosed third-party network communication and secret handling reduce informed consent and can cause unintended data disclosure to external services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description omits Feishu credential use and outbound notification behavior, yet the documented configuration includes app credentials and message recipients. Undisclosed third-party network communication and secret handling reduce informed consent and can cause unintended data disclosure to external services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill description omits Feishu credential use and outbound notification behavior, yet the documented configuration includes app credentials and message recipients. Undisclosed third-party network communication and secret handling reduce informed consent and can cause unintended data disclosure to external services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill description omits Feishu credential use and outbound notification behavior, yet the documented configuration includes app credentials and message recipients. Undisclosed third-party network communication and secret handling reduce informed consent and can cause unintended data disclosure to external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is designed to automatically publish external content and even schedule recurring publication, but the documentation does not present a strong, front-loaded warning that these actions can post publicly on behalf of the user. In this context, silent or insufficiently emphasized publication risk is serious because misuse or accidental triggering can cause reputational damage, policy violations, spam, or account penalties.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation instructs users to export and inject full account cookies for login, but it does not prominently warn that cookies are equivalent to live session credentials and can enable account takeover if exposed. Because the skill automates browser sessions and reads cookie files from disk, mishandling these credentials materially increases the risk of unauthorized account access.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · core/image_generator.py (reported line 68)May include surrounding context.
python
style_keyword = random.choice(self.style_keywords) prompt = f"{base_prompt}，{style_keyword}" return prompt def generate_image_prompt_for_topic(self, article_topic): """

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documents capabilities that clearly require file access, network access, and local automation, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can cause over-broad execution authority, making accidental or unauthorized reads, writes, and outbound requests harder to constrain or audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language triggers are very broad and action-oriented, and the skill performs real-world posting actions. In an agent setting, vague trigger phrases increase the risk of accidental invocation from ordinary conversation, potentially causing unintended content generation, login automation, or publication.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-level docstring defines the skill entirely in Chinese and frames it as generating a specific Chinese-language article style, with no indication that users can choose another language or locale. The policy requires flagging language/locale constraints when they are imposed without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code saves cookies to a file via json.dump, which persists authentication/session data that is typically sensitive. Although there is a success print after saving, there is no prior warning, confirmation, or explanatory disclosure that the operation stores credential-like data on disk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · core/feishu_notifier.py (reported line 54)May include surrounding context.
python
} try: response = requests.post(url, json=payload) data = response.json() if data.get("code") == 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · core/publisher.py (reported line 119)May include surrounding context.
python
} try: response = requests.post(url, json=payload) data = response.json() if data.get("code") == 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · core/feishu_notifier.py (reported line 106)May include surrounding context.
python
} try: response = requests.post(url, headers=headers, json=payload) data = response.json() if data.get("code") == 0:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The code loads cookie data from disk and injects it directly into the browser context, enabling account access without interactive authentication or user warning. In an auto-publishing skill, this increases the blast radius of local file compromise, misconfiguration, or misuse by allowing immediate authenticated actions against the user’s publishing account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code performs the final publication flow automatically, including clicking publish and confirming dialogs, without any explicit human approval gate at the point of no return. In this skill’s context—automated posting to a real Toutiao account using persisted authentication—mistakes, prompt abuse, or upstream content generation errors can immediately cause unauthorized or harmful public posts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring, user-facing print messages, and notification text are all hard-coded in Chinese, indicating a fixed language experience. The file does not offer locale selection or explain that the skill is intentionally limited to a Chinese-language/regional context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The method writes JSON data to the caller-supplied path, which can create or overwrite files on disk. Although the function prints after saving, there is no prior warning, confirmation, or docstring disclosure that it performs a filesystem write with potential overwrite impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script automatically clicks the publish button and performs a real content publication without any interactive confirmation, dry-run safeguard, or final review gate. In this skill’s context of fully automated account posting using stored cookies, a mistake in generated content, account targeting, or page state can lead to unintended public posting on a real platform account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script loads authentication cookies from disk and injects them directly into a browser session, enabling account actions without any interactive login or user warning. If the cookie file is stolen, replaced, or used unexpectedly, the automation can act as the authenticated user and publish content under that account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs a real publication action by clicking the platform's publish button with no confirmation prompt, dry-run mode, or explicit operator acknowledgement. In an automation skill whose purpose is unattended posting, this creates a meaningful risk of accidental or unauthorized content publication if the generated text is wrong, manipulated, or triggered unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Feishu notification sends part of the published content, the topic, and account metadata to an external service without explicit disclosure or consent at send time. This can leak sensitive or private operational data to a third party, especially if the content, topic selection, or account identity is confidential.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: When invoked with --now, the script immediately generates and publishes content to an external platform using stored account credentials, with only a minimal console message and no confirmation gate, dry-run mode, or explicit warning about the external side effect. In the context of an automation skill whose purpose is unattended posting, this creates a real risk of accidental or unintended publication if the script is run by mistake, triggered by another tool, or executed with stale configuration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module description is written only in Chinese ("头条全自动发布 - 核心模块"), which indicates a fixed language choice in user-facing natural language. The file does not provide any indication of language selection, opt-in, or justification for a Chinese-only locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module docstrings, method docstrings, and user-visible print messages are all presented in Chinese with no option for other languages. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.