Security audit

Toutiao Publish.Skill

Security checks for vulnerabilities and agentic risk

Overview

This Toutiao auto-publishing skill is purpose-aligned but needs review because it can log into an account and publish publicly without strong consent and credential-safety boundaries.

Review before installing. Use it only in a supervised session, provide credentials only when needed, verify the generated article and cover image yourself, avoid sending sensitive topics to third-party image generation, and require an explicit final confirmation before any Toutiao post is published.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to fetch cover images from Pollinations.AI, an external third-party service unrelated to Toutiao publishing, expanding the data-flow surface beyond the stated purpose. This can leak article topics, prompts, or metadata to an undeclared service and introduces supply-chain and content-origin risk if the external service is unavailable, compromised, or returns unsafe content.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The rules instruct execution of local Node/PowerShell scripts and filesystem operations for navigation and uploads, which exceeds a narrowly scoped browser-based publishing capability. Broadening the operational surface to local script execution increases the risk of unintended system access, unsafe file handling, and abuse if later combined with untrusted inputs.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger conditions are broad enough to match ordinary user requests about writing or publishing content, which can cause the skill to activate unexpectedly. In this skill's context, unintended activation is more dangerous because it can initiate account login, content generation, and real publication actions on a third-party platform.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs automated credential entry for account login without warning about password handling, account compromise risk, or the sensitivity of using stored credentials in browser automation. This is especially risky because the skill performs real authenticated actions against a publishing account, so accidental misuse or prompt injection elsewhere could directly affect the user's account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to fetch an image from an external service, save it locally, and then upload it to Toutiao, but does not disclose the privacy, compliance, and supply-chain risks of third-party network access and local file handling. In context, this is more dangerous because it creates a data flow across external services and the local filesystem, increasing the chance of unreviewed content, malicious files, or unintended disclosure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs entry of phone numbers and passwords directly into an automated workflow without any credential-handling, storage, masking, or consent guidance. In a browser automation context, credentials are highly sensitive and may be exposed through logs, screenshots, script files, browser state, or downstream tooling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guidance recommends generating/downloading cover images from an external service without disclosing that prompts or article-related metadata may be sent to a third party. This creates an avoidable privacy and transparency issue, especially if user-provided topics contain proprietary, personal, or unpublished information.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The cleanup instruction to delete workspace screenshots and temporary files lacks scope restrictions and safety checks, creating a risk of unintended data loss. In automation environments, vague deletion guidance can remove useful audit artifacts or broader files if implemented carelessly.

Static analysis

No suspicious patterns detected.