掘金自动化

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:33 PM UTC
• Version: 1.1.0

Overview

The core Juejin posting script matches its purpose, but the package also includes an undocumented EvoMap publisher with a hardcoded bearer secret and agent instructions to find local cookies.

Review this skill before installing. Do not run scripts/publish_to_evomap.py unless you intentionally want to publish metadata to EvoMap and trust the embedded credential model. Treat any Juejin cookie as a password-equivalent secret; avoid placing a real cookie directly in shell history or logs, and rotate the session if it may have been exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish_to_evomap.py:15

Finding

Hard-Coded EvoMap Bearer Credential

Content

View full analysis

Vulnerability Details

File Location: scripts/publish_to_evomap.py, lines 15-16 and 43-52
Vulnerability Type: Hard-coded reusable authentication secret
Risk Level: High

Vulnerable Code

python

HUB_URL = "https://evomap.ai"
NODE_ID = "node_xiaolingzi_6202297c"
NODE_SECRET = "16a2da83e0da610db0da3bc67464f843a86224f289146bbb8e4d5deff77e5b90"

python

req = urllib.request.Request(
    url,
    data=data,
    headers={
        "Content-Type": "application/json; charset=utf-8",
        "Authorization": f"Bearer {NODE_SECRET}"
    },
    method=method
)

Technical Analysis

A reusable EvoMap bearer secret is embedded directly in the source code. Anyone with access to the package, a source archive, a repository clone, or a copied script can recover the credential without authentication.

The secret is used as an authorization bearer token for requests to https://evomap.ai. Bearer credentials grant access based solely on possession, so an attacker does not need to recover another password or cryptographic key. Transport over HTTPS protects the credential in transit but does not mitigate its disclosure in source code.

Attack Path

1. An attacker obtains the distributed Skill package or reads the source repository.
2. The attacker extracts NODE_ID and NODE_SECRET from scripts/publish_to_evomap.py.
3. The attacker constructs requests to EvoMap endpoints such as /a2a/publish or /a2a/heartbeat.
4. The attacker sets the exposed value in the Authorization: Bearer ... header.
5. If the credential remains valid, EvoMap accepts the request as originating from the exposed node identity.

Impact Assessment

An attacker may impersonate node_xiaolingzi_6202297c and perform operations authorized for that EvoMap identity. Based on the implemented endpoints, this includes publishing assets and sending heartbeat traffic. Malicious or misleading assets could conseque ...[truncated 248 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke the exposed EvoMap bearer credential immediately and issue a replacement.
2. Remove the credential from the source tree and, where applicable, purge it from repository history and previously distributed artifacts.
3. Read the replacement secret from a protected environment variable, operating-system credential store, or dedicated secret manager.
4. Refuse to send a request when the secret is absent rather than using a fallback value.
5. Restrict the replacement credential to only the endpoints and operations required by this script.
6. Add automated secret scanning to the development and release process.
7. Review EvoMap activity logs for unauthorized publication or heartbeat operations performed with the exposed identity.

T01 · Skill Instruction Hijacking

Error

• Location: scripts/publish_to_evomap.py:66

Finding

Undocumented External Publication of Instructions Directing Agents to Retrieve Local Credentials

Content

View full analysis

Vulnerability Details

File Location: scripts/publish_to_evomap.py, lines 66-72, 83-99, and 124-127
Vulnerability Type: Publication of agent-oriented instructions that direct credential discovery
Risk Level: High

Vulnerable Code

The published strategy explicitly instructs consuming agents to retrieve a Juejin cookie from a local TOOLS.md configuration file:

python

gene = {
    "type": "Gene",
    "schema_version": "1.5.0",
    "category": "innovate",
    "signals_match": ["juejin", "juejin-pin", "掘金沸点", "掘金签到", "掘金平台"],
    "summary": "掘金平台自动化操作：发布沸点到指定话题、每日签到获取矿石、免费抽奖、查询话题列表等能力",
    "strategy": [
        "解析用户意图，确定需要执行的操作类型（沸点、签到、抽奖等）",
        "从TOOLS.md配置文件中获取掘金平台的cookie认证信息",
        "根据意图调用对应的Python脚本执行具体的掘金操作",
        "解析脚本返回结果并向用户报告操作状态和结果"
    ],
    "tags": ["juejin", "掘金", "签到", "沸点", "自动化", "social-media"]
}

The metadata also advertises a checkin.py script that is not present in the audited project:

python

"code_ref": {
    "type": "skill",
    "path": "skills/juejin",
    "scripts": ["scripts/publish_pin.py", "scripts/checkin.py"]
}

The instructions and metadata are transmitted to an external service:

python

payload = {
    "assets": [gene, capsule, event]
}

result = make_request("/a2a/publish", payload)

Technical Analysis

SKILL.md documents only publish_pin.py as a supported script and requires the caller to provide the cookie explicitly. In contrast, the additional EvoMap publisher distributes instructions telling agents to locate Juejin authentication material inside TOOLS.md.

This changes the credential-handling model from explicit user-provided authentication to agent-directed discovery of local credentials. If an external agent consumes and follows the published strategy, it may inspect sensitive local configuration without a specific user decision to disclose those credentials for the operation.

T ...[truncated 1799 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the EvoMap publishing script from this Skill unless external publication is an intentional, documented feature.
2. Do not publish instructions directing agents to search TOOLS.md or other local files for authentication credentials.
3. Require explicit, per-operation credential injection with clear user authorization.
4. Publish only capabilities backed by files included in the reviewed package.
5. Remove all references to scripts/checkin.py, check-in operations, and lottery operations unless those features are implemented, audited, and documented.
6. Display the exact assets and destination to the user and obtain confirmation before external publication.
7. Apply a schema or policy check that rejects published agent strategies containing instructions to discover secrets in local configuration.
8. Separate metadata publication from account automation so that a publisher never needs access to Juejin credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish_pin.py:81

Finding

Juejin Session Cookie Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-29 and 43-48; scripts/publish_pin.py, line 81
Vulnerability Type: Sensitive session credential passed through process arguments
Risk Level: Medium

Vulnerable Code

The documentation instructs users to place the complete session cookie directly on the command line:

bash

python3 scripts/publish_pin.py --cookie "COOKIE字符串" --content "沸点内容" [--topic-id "话题ID"] [--theme-id "主题ID"]

A second documented example uses the same credential-passing mechanism:

bash

python3 scripts/publish_pin.py \
  --cookie "COOKIE" \
  --content "[7617667585588674611#AI 能力提升场#] 用AI辅助编程效率提升好多！" \
  --theme-id "7617667585588674611"

The implementation requires the cookie as a command-line argument:

python

parser.add_argument("--cookie", required=True, help="掘金登录cookie")

Technical Analysis

Authentication cookies are bearer credentials that may provide access to the associated Juejin account. Passing such a credential as a command-line argument can expose it through shell history, process listings, process telemetry, diagnostic bundles, job logs, or command auditing systems.

On systems where users can inspect other processes, a local observer may capture the argument while the script is running. Even after execution, the literal command may remain in the invoking user's shell history or automation logs.

HTTPS protects the cookie while it is sent to Juejin but does not protect its earlier exposure through the local process invocation.

Attack Path

1. A user follows the documented example and invokes the script with a complete Juejin cookie in --cookie.
2. The shell records the command in history, or the operating system exposes the argument through process inspection while the script runs.
3. A local user, log reader, support collector, or compromised monitoring component retrieves the cookie.
4. The attacker replays the c ...[truncated 651 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the required --cookie command-line option for secret-bearing values.
2. Accept the cookie through a protected environment variable, restricted-permission credential file, secret manager, or standard input.
3. If standard input is used interactively, use a no-echo secret prompt.
4. Ensure credential files are readable only by the intended user and are never committed to source control.
5. Update all documentation examples so they do not place real or placeholder bearer credentials in command arguments.
6. Avoid printing, logging, or including the cookie in exception messages.
7. Recommend immediate session revocation and cookie rotation if a user previously supplied a real cookie through shell commands or shared logs.
8. Where supported, use a narrowly scoped API token instead of a complete browser session cookie.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill code actually sends authenticated publish requests to an unrelated external domain such as evomap.ai, emits heartbeat traffic, creates external asset metadata, and uses hardcoded credentials, that is a severe covert-exfiltration/backchannel pattern completely unrelated to the stated Juejin automation purpose. This would enable theft or misuse of user-supplied cookies and account-derived data, unauthorized outbound communication, and persistent tracking or remote control behavior. The mismatch with the benign description materially increases risk because it suggests deliberate concealment rather than accidental overreach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill code actually sends authenticated publish requests to an unrelated external domain such as evomap.ai, emits heartbeat traffic, creates external asset metadata, and uses hardcoded credentials, that is a severe covert-exfiltration/backchannel pattern completely unrelated to the stated Juejin automation purpose. This would enable theft or misuse of user-supplied cookies and account-derived data, unauthorized outbound communication, and persistent tracking or remote control behavior. The mismatch with the benign description materially increases risk because it suggests deliberate concealment rather than accidental overreach.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill declares no explicit tool scope or permissions even though its documented behavior requires network access to publish content to Juejin. Missing scope declarations weaken reviewability and containment, making it easier for a skill to perform outbound requests beyond what a user expects. In an automation skill that handles authentication cookies, this lack of explicit restriction is more dangerous because network use directly touches sensitive credentials and account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly instructs users to copy their full authenticated Juejin cookie from browser developer tools and pass it to the script, but it does not warn that this is highly sensitive session material equivalent to account access. That creates a realistic account-takeover risk if the cookie is exposed through shell history, logs, process listings, screenshots, or reuse in other tooling. Because the skill performs account actions on behalf of the user, the context makes this more dangerous, not less.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_pin.py (reported line 27)May include surrounding context.

python

Returns:
        API响应字典
    """
    url = "https://api.juejin.cn/content_api/v1/short_msg/publish"
    
    # 如果传了 theme_id，内容中需要包含话题标签格式: [topic_id#话题名#]
    payload = {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_pin.py (reported line 63)May include surrounding context.

python

Returns:
        API响应字典
    """
    url = "https://api.juejin.cn/content_api/v1/short_msg/publish"
    
    # 如果传了 theme_id，内容中需要包含话题标签格式: [topic_id#话题名#]
    payload = {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script requires a raw login cookie on the command line and then transmits it to Juejin to authenticate requests, but it does not clearly warn users that they are providing a bearer credential that can fully act as their account. In practice, command-line secrets are often exposed via shell history, process listings, logs, or CI output, so this creates a meaningful credential-handling risk even though the destination is the expected remote API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script embeds a long-lived bearer secret directly in source and automatically transmits it in authenticated requests to an external service. Hardcoded secrets are easily exposed through source control, logs, backups, or redistribution of the skill, enabling unauthorized publication, impersonation of the node, or abuse of the associated account.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The published Capsule metadata advertises broader capabilities than the skill description suggests, including签到、抽奖 and general platform automation. Scope inflation is dangerous because downstream systems or users may trust published metadata to authorize or route actions, causing the skill to be invoked for operations that were not clearly declared or reviewed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring, argparse descriptions, and printed messages are all fixed in Chinese, which imposes a specific language on users without any opt-in or alternative. This is a natural-language policy concern because the skill does not provide a locale choice or document that it is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The user-facing docstring, CLI description, help text, and status messages are all presented only in Chinese. Under the stated policy, a skill should not force a specific language unless it offers opt-in/choice or clearly documents a justified locale-specific scope.

Content

No source excerpt is available for this finding.