ClawHub
Back to skill

Security audit

百家号发布器

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can post or save content to a real Baijiahao account using stored login data without a strong confirmation or reliable success check.

Install only if you are comfortable giving the skill access to a Baijiahao login state and letting it operate a real publishing page. Use draft or open-only flows first, keep the browser visible when possible, require explicit human confirmation before any publish, and avoid passing broad or sensitive local file paths as auth or content inputs. Pin dependencies or install in an isolated environment if supply-chain reproducibility matters.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
package.json:8
Finding

Unpinned Executable Dependencies Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: package.json:8; additional declarations in requirements.txt:2-3 and SKILL.md:145
Vulnerability Type: Unpinned third-party dependencies and use of a mutable latest release
Risk Level: Medium

Vulnerable Code

json
"install-deps": "pip install -r requirements.txt && playwright install chromium"

The associated Python dependency declarations are:

text
playwright>=1.40.0
markdown>=3.5.0

The installation documentation also recommends:

bash
npx clawhub@latest install baijiahao-publish

Technical Analysis

The project installs executable third-party components without exact version or artifact-integrity constraints. The lower-bound specifiers permit package managers to select any later release, while clawhub@latest explicitly resolves to a mutable release at installation time.

Package installation and Playwright browser setup can execute package-controlled installation logic with the privileges of the user performing the installation. Consequently, the effective installed code can change after this skill has been audited. This is a supply-chain weakness rather than evidence that the currently named dependencies are malicious.

Attack Path

  1. An upstream package, maintainer account, distribution channel, or newly published dependency version is compromised.
  2. The attacker publishes a malicious version that satisfies the >= constraint or controls the release resolved by @latest.
  3. A user follows the documented installation procedure.
  4. The package manager downloads the unreviewed release and executes its installation or runtime code.
  5. The malicious component runs under the installing user's account and can access data and resources available to that account.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user installing or invok ...[truncated 317 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every Python dependency to an exact, reviewed version rather than using lower-bound constraints.
  • Generate and commit a reproducible lock file containing cryptographic hashes for all direct and transitive dependencies.
  • Install dependencies with hash verification enabled, such as pip install --require-hashes.
  • Replace clawhub@latest with an explicitly reviewed version.
  • Document the expected package registries and reject untrusted mirrors or extra indexes.
  • Add automated dependency scanning and require review before updating lock files.
  • Where possible, install and run the skill in an isolated environment with minimal filesystem and credential access.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/open_baijiahao_edit.py:430
Finding

Publish and Draft Failures Are Incorrectly Reported as Successful

Content
View full analysis

Vulnerability Details

File Location: scripts/open_baijiahao_edit.py:430-466
Vulnerability Type: Fail-open error handling and missing post-action verification
Risk Level: Medium

Vulnerable Code

python
if click_draft:
    draft_btn = page.get_by_text("存草稿", exact=True).first
    if draft_btn.count() > 0:
        draft_btn.click(timeout=3000)
        print("[*] 已点击「存草稿」。")
    else:
        print("[!] 未找到「存草稿」按钮。")
else:
    publish_btn = page.get_by_text("发布", exact=True).first
    if publish_btn.count() > 0:
        publish_btn.click(timeout=3000)
        print("[*] 已点击「发布」按钮。")
    else:
        print("[!] 未找到「发布」按钮。")
except Exception as e:
    print(f"[!] 流程异常: {e!r}")

print("[+] 百家号发布页操作已完成。")
if keep_open and not headless:
    input("确认后按回车关闭浏览器...")
browser.close()
print("[RESULT] success")
return True

Technical Analysis

Missing action buttons and exceptions during the publish or draft workflow are treated only as warnings. Control flow continues to the unconditional success result, returning True, printing [RESULT] success, and causing the caller to receive exit status zero.

The code also does not verify an authoritative postcondition, such as a publication confirmation, draft identifier, success notification, or expected navigation. A successful click therefore does not establish that Baijiahao accepted the operation.

This violates the documented result contract and creates a fail-open automation condition. Systems relying on the result line or exit code cannot distinguish a completed publication from a missing button, intercepted click, changed page layout, validation failure, or unexpected overlay.

Attack Path

  1. A caller invokes the skill with --publish or --draft.
  2. The expected button is absent, the page structure changes, an overlay intercepts the click, or Playwright raises an exception.
  3. The script prints a warning ...[truncated 878 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat a missing required button, click timeout, or workflow exception as a hard failure.
  • Return False, print [RESULT] failed, and produce a nonzero exit status whenever the requested action cannot be completed.
  • Track the outcome explicitly rather than relying on unconditional success at the end of the function.
  • After clicking, wait for and validate an authoritative success condition, such as a server-confirmed notification, draft identifier, publication status, or expected URL transition.
  • Distinguish page loading, form filling, cover selection, draft saving, and publication as separate checked stages.
  • Capture diagnostic evidence such as the current URL, sanitized page state, and a screenshot on failure without exposing cookies or authentication tokens.
  • Add automated tests covering missing controls, click exceptions, validation errors, and server-side rejection.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
aijiahao-publish --name "百家号发布器" --version 1.0.0`（需先配置 ClawHub 账号）。发布前请确保目录内包含 `SKILL.md`、`package.json`、`_meta.json`、`scripts/open_baijiahao_edit.py`、`requirem

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill reads local files such as auth.json, cookie .txt files, and optional content files, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this can lead to over-broad file access assumptions and make it easier for the skill to be invoked with sensitive local paths beyond the intended auth/content inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly supports automatic draft saving and publication to a user account, but the description lacks a clear warning that these are account-impacting submission actions. In this context, the absence of a prominent warning and confirmation model is dangerous because it normalizes automated posting using stored auth/cookies, increasing the chance of accidental or unauthorized publication.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language invocation examples allow the assistant to infer and trigger publish or draft actions from broad user phrasing, but the skill does not define strict confirmation requirements or narrow triggering conditions. Because this skill performs account-impacting actions on a live publishing platform, ambiguous invocation increases the risk of unintended posting, drafts, or use of the wrong local auth/content files.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The documentation recommends using npx clawhub@latest install and references npx clawhub for publish/install flows without pinning a specific version. Using floating latest versions in security-sensitive tooling can introduce supply-chain risk, where a compromised or breaking upstream release changes behavior unexpectedly for users installing or publishing the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script can automatically perform the final '发布' action when invoked with --publish, without a last-moment confirmation, dry-run safeguard, or interactive review step. In this skill’s context, that means any caller with access to valid Baijiahao auth can cause unintended public publication, making accidental or unauthorized content release materially easier.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language comment "百家号发布 Skill 依赖" indicates the skill is specifically framed for a Chinese platform/language context, but this file provides no user choice, opt-in, or justification for that locale restriction. Under the policy, locale-specific behavior should be optional or clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

Using open-ended version specifiers like 'playwright>=1.40.0' allows future, unreviewed releases to be installed, which can introduce breaking changes or newly disclosed vulnerabilities into the automation environment. Because this skill handles authenticated browser sessions and publishing actions, dependency drift increases supply-chain and operational risk more than it would in a non-privileged utility.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
# 百家号发布 Skill 依赖
playwright>=1.40.0
markdown>=3.5.0   # 必选：--content-file 使用 .md 时用其转为富文本 HTML

Unverifiable Dependency: markdown has 2 known advisory(ies) (CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The 'markdown' dependency is not pinned, so installations may resolve to a version affected by known advisories, and the skill explicitly uses it to convert user-supplied .md content into HTML. Since this conversion path touches untrusted content and feeds rich text into a publishing workflow, unresolved dependency selection can expose the system to parser crashes or other vulnerable behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.