T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:21- Finding
Authentication Cookies Exposed Through Credential Checks
- Content
View full analysis
- Remediation
View remediation
Security audit
Blog Auto Poster Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to publish blog posts, but it handles account cookies and shell commands in ways that could expose credentials or execute unintended commands.
Review before installing. This skill should not be used with real platform cookies until credential checks are changed to never print secrets, publishing commands avoid shell interpolation of user content, and the missing scripts/templates/references are supplied and reviewed. Confirm each target platform before any live post.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:69- Finding
Shell Command Injection Through User-Controlled Publishing Fields
- Content
View full analysis
" \ --file ./temp/publish.md \ --format markdown \ --tags "标签1,标签2" \ --categories "分类名" \ --publish ``` Equivalent unsafe interpolation patterns are documented for the other platforms: ```bash python scripts/51cto_poster.py post \ --title "<标题>" \ --file ./temp/publish.md \ --tags "标签1,标签2" ``` ```bash python scripts/cnblogs_poster.py post \ --title "<标题>" \ --file ./temp/publish.md \ --tags "标签1,标签2" ``` ```bash python scripts/juejin_poster.py post \ --title "<标题>" \ --file ./temp/publish.md \ --brief "摘要（50-100 字）" ``` ### Technical Analysis The Skill directs the Agent to place user-provided titles, tags, categories, and summaries into Bash command templates. The documented double quotes do not make direct textual insertion safe. Shell constructs such as command substitutions remain active inside double-quoted command text, and an embedded quotation mark can terminate the intended argument and introduce additional shell syntax. For example, if an Agent directly substitutes a crafted title containing `$(attacker-controlled-command)` into the quoted placeholder, Bash evaluates the command substitution before invoking the Python script. A payload containing a closing quote followed by shell operators may similarly introduce a separate command. The risk applies when the Agent constructs a shell command by directly replacing the displayed placeholders, which is the execution model prescribed by the Skill. The absent posting scripts do not remove the injection risk because shell evaluation occurs before Python receives the arguments. ### Attack Path 1. An attacker supplies a malicious article title, tag, category, or summary. 2 ...[truncated 1454 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill does not clearly warn users that it will send article contents to external platforms and rely on locally stored authentication cookies to act on their behalf. Without an up-front disclosure, users may not understand the privacy and account-risk implications of using the skill, especially because publication is an irreversible external action.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to inspect a local .env file for platform cookies, which is credential material. Even though the immediate commands only check for key presence, directing an automated agent toward secret stores increases the risk of accidental disclosure, logging, or later misuse of account-authentication data.
- Content
检查
.env是否存在且包含目标平台的配置项，如有缺失则引导用户配置。bash ls -la .env grep "CSDN_COOKIES=" .env grep "51CTO_COOKIES=" .env grep "CNBLOGS_COOKIES=" .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This command targets .env to search for CSDN cookie configuration, causing the agent to access a file expected to contain authentication secrets. Accessing secret stores within a loosely constrained shell workflow creates unnecessary exposure risk through command history, tool logs, or accidental value output.
- Content
bash ls -la .env grep "CSDN_COOKIES=" .env grep "51CTO_COOKIES=" .env grep "CNBLOGS_COOKIES=" .env grep "JUEJIN_COOKIES=" .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This step instructs checking .env for 51CTO cookie configuration, again leading the agent to interact with stored authentication material. Repeated direct secret-file access across platforms compounds the chance that sensitive cookies are exposed or mishandled during execution or debugging.
- Content
bash ls -la .env grep "CSDN_COOKIES=" .env grep "51CTO_COOKIES=" .env grep "CNBLOGS_COOKIES=" .env grep "JUEJIN_COOKIES=" .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The command checks .env for CNBLOGS cookie data, which is sensitive account-authentication information. A skill that operationalizes repeated access to local secret files without strong safeguards normalizes unsafe credential handling and increases the blast radius if outputs are captured.
- Content
ls -la .env grep "CSDN_COOKIES=" .env grep "51CTO_COOKIES=" .env grep "CNBLOGS_COOKIES=" .env grep "JUEJIN_COOKIES=" .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This line directs inspection of .env for JUEJIN cookie configuration, exposing another authentication secret source to the agent. In the context of a skill that can immediately publish to external sites, access to these cookies materially enables account actions and raises the consequences of any leakage.
- Content
grep "CSDN_COOKIES=" .env grep "51CTO_COOKIES=" .env grep "CNBLOGS_COOKIES=" .env grep "JUEJIN_COOKIES=" .env
text 各平台凭证获取方式见 `references/<平台>.md`。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests to post or sync content, increasing the chance the skill activates without a clear, informed user decision about cross-platform publication. In a skill that transmits content to multiple third-party services using stored cookies, overbroad activation can lead to unintended external posting.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The Juejin authentication guidance is internally inconsistent: one section says only cookies are required and no CSRF header is needed, while the notes later require cookie/CSRF token pairing. Conflicting security instructions can cause operators to mishandle credentials, weaken authentication assumptions, or troubleshoot by exposing additional secrets unnecessarily.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language instructions, trigger phrases, and workflow are presented only in Chinese, which can amount to a language policy issue when no user opt-in or locale justification is provided. There is no statement that the skill is intended only for Chinese-speaking users or China-specific environments.
- Content
Static analysis
No suspicious patterns detected.