ClawHub
Back to skill

Security audit

CSDN GEO Draft Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a CSDN draft-writing helper, but its browser script automatically clicks a publish-labeled control and hides automation indicators, so it needs careful review before use.

Install only if you are comfortable running a local Playwright browser while logged into CSDN. Before use, remove the automation-suppression Chromium flag and change the workflow so any publish/settings button click requires your explicit confirmation, or fill the summary manually. Keep final save or publish actions manual and review generated content for accuracy and compliance.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/draft_to_csdn.example.py:72
Finding

Playwright Launch Configuration Suppresses Browser Automation Indicators

Content
View full analysis

Vulnerability Details

File Location: scripts/draft_to_csdn.example.py:72
Vulnerability Type: Browser automation detection evasion
Risk Level: Medium

python
browser = p.chromium.launch(headless=False, args=['--disable-blink-features=AutomationControlled'])

Technical Analysis

The Chromium argument --disable-blink-features=AutomationControlled suppresses browser indicators commonly used by websites to identify automated sessions. This capability is unnecessary for the stated purpose of visible, user-supervised draft filling and conflicts with the project's stated emphasis on transparent, non-evasive automation.

Although this option does not directly compromise the local system, it weakens platform-side automation controls. It could also make future prohibited automation less visible if the script is modified to perform additional actions.

Attack Path

  1. The user executes the supplied Playwright script.
  2. Chromium starts with automation-identification behavior suppressed.
  3. CSDN receives a browser session that is less readily identifiable as automated.
  4. If the script is subsequently extended with prohibited actions, those actions may be more difficult for platform controls to detect.
  5. The account may consequently be exposed to enforcement, suspension, or unauthorized automated activity.

Impact Assessment

The issue does not grant operating-system privileges, access credentials, or direct access to other accounts. Its scope is limited to the browser session launched by the script. However, it may facilitate evasion of platform automation controls and increase the risk of account sanctions or abuse by modified versions of the workflow.

Remediation
View remediation

Remediation Suggestions

Remove the automation-suppression argument and launch the visible browser with its default automation indicators:

python
browser = p.chromium.launch(headless=False)

In addition:

  1. Reject future changes that add browser-fingerprint spoofing or anti-detection options.
  2. Document that platform automation controls must not be bypassed.
  3. Add a static check that rejects Chromium arguments associated with fingerprint manipulation or automation concealment.
  4. Continue requiring a visible browser and direct user supervision.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/draft_to_csdn.example.py:108
Finding

Fragile Publish-Control Selector Could Trigger an Unintended State-Changing Action

Content
View full analysis

Vulnerability Details

File Location: scripts/draft_to_csdn.example.py:108-110
Vulnerability Type: Unsafe browser UI automation
Risk Level: Medium

python
publish_btn = page.locator("button.btn-publish")
if publish_btn.count() > 0:
    publish_btn.click()

Technical Analysis

The script states that final publication must always require manual user action, but it programmatically clicks a broadly selected control named btn-publish. The current intention is to open a publishing-properties panel so that the summary can be filled. However, the safety guarantee depends on the current CSDN interface retaining a separate final confirmation step.

CSS class names and publication workflows are controlled by the remote platform and can change without corresponding changes to this project. If CSDN reassigns this selector to a final submission control, removes the confirmation step, or renders a different matching element, the script could trigger an unintended state-changing action.

The count() check verifies only that a matching element exists. It does not verify the control's accessible name, role, surrounding dialog state, expected destination, or post-click behavior.

Attack Path

  1. CSDN modifies its editor interface or reuses button.btn-publish for a different publication action.
  2. The user runs the unchanged local script while authenticated.
  3. The script locates the changed control using the broad CSS selector.
  4. It clicks the control without explicit user confirmation or semantic validation.
  5. The click may submit content, advance publication, or perform another unintended account-level action.
  6. This violates the promised human-in-the-loop boundary and may expose the user to accidental publication or platform enforcement.

Impact Assessment

The script acts only within the currently authenticated CSDN browser session and does not obtain additional operating-system privilege ...[truncated 221 chars]

Remediation
View remediation

Remediation Suggestions

The safest remediation is to avoid clicking any publish-labeled control. Restrict automation to filling the title and article body, then require the user to open publishing settings and enter the summary manually.

If opening the panel remains necessary:

  1. Require explicit, immediate user confirmation before the click.
  2. Use stable semantic attributes such as role, accessible name, and expected container state rather than a single CSS class.
  3. Verify that the control opens a settings dialog and cannot directly submit content.
  4. Assert the expected post-click state and stop immediately if it is not observed.
  5. Add automated interface tests that fail closed when selectors or workflow states change.
  6. Maintain an explicit denylist for controls that can save, submit, schedule, or publish content.
  7. Prefer a preview-only workflow that performs no irreversible or externally visible action.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document explicitly presents the skill name and primary description in Chinese and labels the skill as a Chinese-language CSDN publishing assistant, but it does not state that language choice is optional or limited to a region-specific deployment. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file presents all user-facing content in Chinese and does not indicate that the language is optional or limited to a China-specific audience. Under the natural-language policy rule, forcing a specific language without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire skill file is written in Chinese and presents keywords exclusively in that language, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-language or region-specific context. Under the policy rule for natural-language constraints, this can be a locale/language policy violation when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire FAQ is presented only in Chinese, with no indication that language selection is optional or that the content is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in can constitute a locale or language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The required article structure mandates Chinese title and section conventions such as "如何设计...", "背景", "问题定义", and "常见问题", which constrains the generated output to a specific language/locale. The file does not indicate that this language choice is optional or based on user preference, so it creates a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The required checklist template is entirely in Chinese and is marked as required output, which effectively forces a specific language for this skill's output. The file does not offer a user opt-in or language choice, nor does it clearly justify the locale restriction as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The prompt requires outputs tailored to CSDN and provides only Chinese-language title patterns such as '手把手教你' and '一文看懂', which effectively steers the skill toward a specific language/locale. Because the file does not explicitly state that Chinese output is required by the user or that this is a justified region-specific constraint, it can violate the language/locale policy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring explicitly states '绝不点击最终“发布”按钮' as a safety boundary. However, the implementation locates button.btn-publish and clicks it at L108-L110. Even if the apparent intent is only to open a metadata panel rather than complete publication, this directly conflicts with the stated guarantee not to click the publish button.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/draft_to_csdn.example.py (reported line 131)May include surrounding context.

python
print("--------------------------------------------------")
            
            # 挂起脚本，直到用户手动关闭浏览器
            page.wait_for_event("close", timeout=0)

        except Exception as e:
            print(f"[-] 执行过程中出现异常/超时: {e}")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire template content is written only in Chinese, which implies the skill may generate output in a specific language by default. Under the policy, forcing a language or locale without offering user choice or documenting a justified locale restriction is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents the skill content exclusively in Chinese and does not indicate that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

Line L64 states the Playwright automation '只做填写动作' ('only' performs filling actions), yet the document as a whole describes a pipeline that reads multiple input files, rewrites content, formats Markdown, performs quality checks, and produces several output files before draft filling. This is not a code-level contradiction, but it is an intent statement that narrows behavior more than the surrounding implementation description supports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The entire skill description is written in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language or region-specific audience. Under the language/locale policy rule, a forced language without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.