Clawhub Skill Toutiao Publisher

• Outcome: Review
• Latest audit: May 28, 2026 · 11:43 AM UTC
• Version: 2.0.0

Overview

This skill is a coherent Toutiao publishing automation tool, but it can use raw account cookies to publish and schedule live public posts without a clear final approval gate.

Install only if you intentionally want an agent to operate a live Toutiao account. Keep cookie files private and out of repositories, use a dedicated browser/profile, test with --no-publish where available, avoid enabling the scheduler until you have monitoring and a stop procedure, and treat Feishu notifications as sending publication metadata to a third party.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents capabilities to read local files (config and cookie files), write files/logs, and access the network, but does not declare permissions or prominently scope those actions. This is dangerous because an agent may be granted broader implicit access than a user realizes, especially when handling session cookies and external notification endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose centers on Toutiao publishing, but the skill also reads sensitive local configuration and cookie files and sends Feishu notifications to external services, while understating those behaviors. This mismatch prevents informed consent and can lead to unexpected data exposure or account actions, particularly because session credentials and publishing automation affect real external accounts.

Description-Behavior Mismatch

Low

• Confidence: 93% confidence
• Finding: The script sends publication details to Feishu after posting, which is outside the core function of publishing to Toutiao and is not clearly disclosed at the point of use. Although the data sent appears limited to content preview, topic, and account name, it still creates an unexpected outbound data flow to a third-party service.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The invocation examples use broad natural-language commands such as asking the agent to publish content or enable hourly posting, without requiring explicit confirmation or constrained parameters. In an agent setting, this increases the chance of unintended activation that can modify external account content or enable persistent automation from a casual prompt.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The description emphasizes convenience and full automation but does not prominently warn that the skill can publish directly to a user's external Toutiao account and create scheduled recurring posts. Without a clear warning, users may invoke the skill without understanding that it performs live account modifications rather than draft-only assistance.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The cookie-based login instructions tell users to export and inject full account session cookies, but they do not strongly warn that these cookies are effectively account credentials. If mishandled, leaked, or reused by the skill or surrounding agent environment, an attacker could gain unauthorized access to the user's Toutiao account and act as that user.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This code persists authentication cookies directly to disk in plaintext JSON without any access controls, encryption, permission hardening, or user-facing warning about storing sensitive session material. In the context of an automation skill that logs into a Toutiao account via cookies, theft of this file could enable account takeover or unauthorized posting until the session expires.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads session cookies from disk and injects them into a browser context, enabling authenticated access without any explicit safety controls, origin restrictions, or user confirmation. In a skill whose purpose is full automation of account posting, this increases the risk of account takeover or misuse if the cookie file is stolen, replaced, or sourced from an untrusted location.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The code automatically clicks publish and follow-up confirmation buttons based on generic text matching, with no explicit human approval step before final submission. In the context of a fully automated publisher, this can cause unauthorized or accidental public posting, reputational damage, policy violations, and misuse if upstream content generation or page state is manipulated.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script performs a real publish action by clicking a detected '发布' button with no confirmation gate, dry-run default, or final operator approval. In this skill's context, the action is especially risky because it automates content generation and browser login, so a mistaken run, bad selector match, or maliciously modified content can immediately post to a live account.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script reads authentication cookies from disk and injects them directly into a browser session, effectively reusing account credentials without additional verification or prominent disclosure. In an automation skill that publishes to a real media account, this increases the blast radius of local file compromise, misconfiguration, or accidental use of the wrong account.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code transmits a snippet of the published content, the topic, and the account name to Feishu without any nearby warning, consent check, or clear disclosure. In an automation skill that already handles account cookies and publishes on behalf of the user, this hidden secondary exfiltration channel increases privacy and operational risk, especially if posts are sensitive, embargoed, or tied to a real identity.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This scheduler can automatically generate and publish content with the --now flag or on an hourly schedule without any human approval gate, dry-run mode, or explicit confirmation before sending content to the external platform. In the context of a fully automated publishing skill, this increases the risk of accidental spam, publication of harmful or policy-violating AI-generated content, or abuse if the host is misconfigured or compromised.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
requests>=2.28.0
schedule>=1.2.0
Pillow>=9.0.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only, which allows future major or minor releases to be installed without review. This weakens build reproducibility and can unintentionally pull in vulnerable or breaking versions, especially in an automation skill that performs browser-driven publishing.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
requests>=2.28.0
schedule>=1.2.0
Pillow>=9.0.0

• Confidence: 97% confidence
• Finding: Using requests>=2.28.0 permits installation of any later version, including versions with known security regressions or unresolved advisories. In this skill, HTTP requests may interact with authenticated services or cookies, so dependency drift can directly affect confidentiality and request integrity.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
requests>=2.28.0
schedule>=1.2.0
Pillow>=9.0.0

• Confidence: 89% confidence
• Finding: An unpinned schedule dependency creates supply-chain and reproducibility risk because builds may resolve to unexpected versions over time. While schedule is less security-sensitive than networking or image libraries, version drift can still introduce exploitable behavior or operational instability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
requests>=2.28.0
schedule>=1.2.0
Pillow>=9.0.0

• Confidence: 99% confidence
• Finding: Pillow is specified with only a minimum version, allowing installation of versions that may contain serious image parsing flaws. Because this skill explicitly generates or processes images for publication, unsafe dependency resolution materially increases the chance of triggering a vulnerable code path.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The requirements file allows versions of requests that are associated with multiple published security advisories, including credential leakage and verification-related issues. In a workflow that automates authenticated publishing and may handle cookies or account sessions, exploitation could expose credentials or compromise outbound request security.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The requirements file permits Pillow versions with multiple severe advisories, including image parsing issues and reported arbitrary code execution risks. This is especially dangerous here because the skill's stated functionality includes image generation and mixed media publishing, making image handling a core attack surface rather than an incidental one.

Static analysis

No suspicious patterns detected.