Security audit

zhihu-helper

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly purpose-aligned for Zhihu automation, but it can use persistent Zhihu session cookies to publish or interact publicly, and that high-impact account authority is not fully reflected in the registry metadata or enforced consistently in code.

Only install this if you are comfortable giving it persistent logged-in access to your Zhihu account. Use a test account or sandbox mode first, protect the `.env` file and `ZHIHU_COOKIE_KEY`, and require the agent to show the exact post/comment/follow action for explicit approval before anything is published or changed.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.js:50

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/zhihu-bridge.js:44