掘金自动化

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:33 PM UTC
• Version: 1.1.0

Overview

The core Juejin posting script matches its purpose, but the package also includes an undocumented EvoMap publisher with a hardcoded bearer secret and agent instructions to find local cookies.

Review this skill before installing. Do not run scripts/publish_to_evomap.py unless you intentionally want to publish metadata to EvoMap and trust the embedded credential model. Treat any Juejin cookie as a password-equivalent secret; avoid placing a real cookie directly in shell history or logs, and rotate the session if it may have been exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish_to_evomap.py:15
• Finding: Hard-Coded EvoMap Bearer Credential## Vulnerability Details **File Location**: `scripts/publish_to_evomap.py`, lines 15-16 and 43-52 **Vulnerability Type**: Hard-coded reusable authentication secret **Risk Level**: High ### Vulnerable Code ```python HUB_URL = "https://evomap.ai" NODE_ID = "node_xiaolingzi_6202297c" NODE_SECRET = "16a2da83e0da610db0da3bc67464f843a86224f289146bbb8e4d5deff77e5b90" ``` ```python req = urllib.request.Request( url, data=data, headers={ "Content-Type": "application/json; charset=utf-8", "Authorization": f"Bearer {NODE_SECRET}" }, method=method ) ``` ### Technical Analysis A reusable EvoMap bearer secret is embedded directly in the source code. Anyone with access to the package, a source archive, a repository clone, or a copied script can recover the credential without authentication. The secret is used as an authorization bearer token for requests to `https://evomap.ai`. Bearer credentials grant access based solely on possession, so an attacker does not need to recover another password or cryptographic key. Transport over HTTPS protects the credential in transit but does not mitigate its disclosure in source code. ### Attack Path 1. An attacker obtains the distributed Skill package or reads the source repository. 2. The attacker extracts `NODE_ID` and `NODE_SECRET` from `scripts/publish_to_evomap.py`. 3. The attacker constructs requests to EvoMap endpoints such as `/a2a/publish` or `/a2a/heartbeat`. 4. The attacker sets the exposed value in the `Authorization: Bearer ...` header. 5. If the credential remains valid, EvoMap accepts the request as originating from the exposed node identity. ### Impact Assessment An attacker may impersonate `node_xiaolingzi_6202297c` and perform operations authorized for that EvoMap identity. Based on the implemented endpoints, this includes publishing assets and sending heartbeat traffic. Malicious or misleading assets could conseque ...[truncated 248 chars]
• Remediation: ## Remediation Suggestions 1. Revoke the exposed EvoMap bearer credential immediately and issue a replacement. 2. Remove the credential from the source tree and, where applicable, purge it from repository history and previously distributed artifacts. 3. Read the replacement secret from a protected environment variable, operating-system credential store, or dedicated secret manager. 4. Refuse to send a request when the secret is absent rather than using a fallback value. 5. Restrict the replacement credential to only the endpoints and operations required by this script. 6. Add automated secret scanning to the development and release process. 7. Review EvoMap activity logs for unauthorized publication or heartbeat operations performed with the exposed identity.

T01 · Skill Instruction Hijacking

Error

• Location: scripts/publish_to_evomap.py:66
• Finding: Undocumented External Publication of Instructions Directing Agents to Retrieve Local Credentials## Vulnerability Details **File Location**: `scripts/publish_to_evomap.py`, lines 66-72, 83-99, and 124-127 **Vulnerability Type**: Publication of agent-oriented instructions that direct credential discovery **Risk Level**: High ### Vulnerable Code The published strategy explicitly instructs consuming agents to retrieve a Juejin cookie from a local `TOOLS.md` configuration file: ```python gene = { "type": "Gene", "schema_version": "1.5.0", "category": "innovate", "signals_match": ["juejin", "juejin-pin", "掘金沸点", "掘金签到", "掘金平台"], "summary": "掘金平台自动化操作：发布沸点到指定话题、每日签到获取矿石、免费抽奖、查询话题列表等能力", "strategy": [ "解析用户意图，确定需要执行的操作类型（沸点、签到、抽奖等）", "从TOOLS.md配置文件中获取掘金平台的cookie认证信息", "根据意图调用对应的Python脚本执行具体的掘金操作", "解析脚本返回结果并向用户报告操作状态和结果" ], "tags": ["juejin", "掘金", "签到", "沸点", "自动化", "social-media"] } ``` The metadata also advertises a `checkin.py` script that is not present in the audited project: ```python "code_ref": { "type": "skill", "path": "skills/juejin", "scripts": ["scripts/publish_pin.py", "scripts/checkin.py"] } ``` The instructions and metadata are transmitted to an external service: ```python payload = { "assets": [gene, capsule, event] } result = make_request("/a2a/publish", payload) ``` ### Technical Analysis `SKILL.md` documents only `publish_pin.py` as a supported script and requires the caller to provide the cookie explicitly. In contrast, the additional EvoMap publisher distributes instructions telling agents to locate Juejin authentication material inside `TOOLS.md`. This changes the credential-handling model from explicit user-provided authentication to agent-directed discovery of local credentials. If an external agent consumes and follows the published strategy, it may inspect sensitive local configuration without a specific user decision to disclose those credentials for the operation. T ...[truncated 1799 chars]
• Remediation: ## Remediation Suggestions 1. Remove the EvoMap publishing script from this Skill unless external publication is an intentional, documented feature. 2. Do not publish instructions directing agents to search `TOOLS.md` or other local files for authentication credentials. 3. Require explicit, per-operation credential injection with clear user authorization. 4. Publish only capabilities backed by files included in the reviewed package. 5. Remove all references to `scripts/checkin.py`, check-in operations, and lottery operations unless those features are implemented, audited, and documented. 6. Display the exact assets and destination to the user and obtain confirmation before external publication. 7. Apply a schema or policy check that rejects published agent strategies containing instructions to discover secrets in local configuration. 8. Separate metadata publication from account automation so that a publisher never needs access to Juejin credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish_pin.py:81
• Finding: Juejin Session Cookie Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 23-29 and 43-48; `scripts/publish_pin.py`, line 81 **Vulnerability Type**: Sensitive session credential passed through process arguments **Risk Level**: Medium ### Vulnerable Code The documentation instructs users to place the complete session cookie directly on the command line: ```bash python3 scripts/publish_pin.py --cookie "COOKIE字符串" --content "沸点内容" [--topic-id "话题ID"] [--theme-id "主题ID"] ``` A second documented example uses the same credential-passing mechanism: ```bash python3 scripts/publish_pin.py \ --cookie "COOKIE" \ --content "[7617667585588674611#AI 能力提升场#] 用AI辅助编程效率提升好多！" \ --theme-id "7617667585588674611" ``` The implementation requires the cookie as a command-line argument: ```python parser.add_argument("--cookie", required=True, help="掘金登录cookie") ``` ### Technical Analysis Authentication cookies are bearer credentials that may provide access to the associated Juejin account. Passing such a credential as a command-line argument can expose it through shell history, process listings, process telemetry, diagnostic bundles, job logs, or command auditing systems. On systems where users can inspect other processes, a local observer may capture the argument while the script is running. Even after execution, the literal command may remain in the invoking user's shell history or automation logs. HTTPS protects the cookie while it is sent to Juejin but does not protect its earlier exposure through the local process invocation. ### Attack Path 1. A user follows the documented example and invokes the script with a complete Juejin cookie in `--cookie`. 2. The shell records the command in history, or the operating system exposes the argument through process inspection while the script runs. 3. A local user, log reader, support collector, or compromised monitoring component retrieves the cookie. 4. The attacker replays the c ...[truncated 651 chars]
• Remediation: ## Remediation Suggestions 1. Remove the required `--cookie` command-line option for secret-bearing values. 2. Accept the cookie through a protected environment variable, restricted-permission credential file, secret manager, or standard input. 3. If standard input is used interactively, use a no-echo secret prompt. 4. Ensure credential files are readable only by the intended user and are never committed to source control. 5. Update all documentation examples so they do not place real or placeholder bearer credentials in command arguments. 6. Avoid printing, logging, or including the cookie in exception messages. 7. Recommend immediate session revocation and cookie rotation if a user previously supplied a real cookie through shell commands or shared logs. 8. Where supported, use a narrowly scoped API token instead of a complete browser session cookie.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the skill code actually sends authenticated publish requests to an unrelated external domain such as evomap.ai, emits heartbeat traffic, creates external asset metadata, and uses hardcoded credentials, that is a severe covert-exfiltration/backchannel pattern completely unrelated to the stated Juejin automation purpose. This would enable theft or misuse of user-supplied cookies and account-derived data, unauthorized outbound communication, and persistent tracking or remote control behavior. The mismatch with the benign description materially increases risk because it suggests deliberate concealment rather than accidental overreach.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the skill code actually sends authenticated publish requests to an unrelated external domain such as evomap.ai, emits heartbeat traffic, creates external asset metadata, and uses hardcoded credentials, that is a severe covert-exfiltration/backchannel pattern completely unrelated to the stated Juejin automation purpose. This would enable theft or misuse of user-supplied cookies and account-derived data, unauthorized outbound communication, and persistent tracking or remote control behavior. The mismatch with the benign description materially increases risk because it suggests deliberate concealment rather than accidental overreach.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill declares no explicit tool scope or permissions even though its documented behavior requires network access to publish content to Juejin. Missing scope declarations weaken reviewability and containment, making it easier for a skill to perform outbound requests beyond what a user expects. In an automation skill that handles authentication cookies, this lack of explicit restriction is more dangerous because network use directly touches sensitive credentials and account actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly instructs users to copy their full authenticated Juejin cookie from browser developer tools and pass it to the script, but it does not warn that this is highly sensitive session material equivalent to account access. That creates a realistic account-takeover risk if the cookie is exposed through shell history, logs, process listings, screenshots, or reuse in other tooling. Because the skill performs account actions on behalf of the user, the context makes this more dangerous, not less.

External Transmission

Medium

• Category: Data Exfiltration

Content

Returns:
        API响应字典
    """
    url = "https://api.juejin.cn/content_api/v1/short_msg/publish"
    
    # 如果传了 theme_id，内容中需要包含话题标签格式: [topic_id#话题名#]
    payload = {

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Returns:
        API响应字典
    """
    url = "https://api.juejin.cn/content_api/v1/short_msg/publish"
    
    # 如果传了 theme_id，内容中需要包含话题标签格式: [topic_id#话题名#]
    payload = {

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script requires a raw login cookie on the command line and then transmits it to Juejin to authenticate requests, but it does not clearly warn users that they are providing a bearer credential that can fully act as their account. In practice, command-line secrets are often exposed via shell history, process listings, logs, or CI output, so this creates a meaningful credential-handling risk even though the destination is the expected remote API.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script embeds a long-lived bearer secret directly in source and automatically transmits it in authenticated requests to an external service. Hardcoded secrets are easily exposed through source control, logs, backups, or redistribution of the skill, enabling unauthorized publication, impersonation of the node, or abuse of the associated account.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The published Capsule metadata advertises broader capabilities than the skill description suggests, including签到、抽奖 and general platform automation. Scope inflation is dangerous because downstream systems or users may trust published metadata to authorize or route actions, causing the skill to be invoked for operations that were not clearly declared or reviewed.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The module docstring, argparse descriptions, and printed messages are all fixed in Chinese, which imposes a specific language on users without any opt-in or alternative. This is a natural-language policy concern because the skill does not provide a locale choice or document that it is intentionally limited to Chinese-speaking users.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The user-facing docstring, CLI description, help text, and status messages are all presented only in Chinese. Under the stated policy, a skill should not force a specific language unless it offers opt-in/choice or clearly documents a justified locale-specific scope.

Static analysis

No suspicious patterns detected.