Juejin Geo Draft Generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:16 AM UTC
• Version: 1.0.0

Overview

This is a Juejin draft-writing and browser-fill assistant with disclosed local file use and human review, though users should note dependency and clipboard/data-handling caveats.

Install in a virtual environment, pin Playwright before operational use, and review generated content before saving or publishing. Treat brand inputs as potentially sensitive and confirm your model/runtime privacy settings; also expect the example automation to use your visible browser and possibly overwrite clipboard contents with article text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:18

Finding

Unpinned Playwright Dependency and Browser Binary Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 18
Vulnerability Type: Unpinned third-party dependency and executable browser download
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. 安装依赖：`pip install playwright && playwright install`

Technical Analysis

The documented installation command installs the latest version of the playwright Python package available from the user's configured package index. The project does not provide a pinned dependency version, lockfile, package hashes, or an integrity-verification policy.

The subsequent playwright install command downloads executable browser components. Consequently, the effective software executed by users can change after this project has been reviewed. Although Playwright is appropriate for the declared browser-automation functionality and there is no evidence that the project intentionally references a malicious package, the mutable dependency and browser binary supply chain remains outside the audited repository.

Exploitation would require compromise or manipulation of a package repository, dependency-resolution source, Playwright release, browser artifact delivery channel, or the user's package-index configuration.

Attack Path

1. A user follows the installation instructions in README.md.
2. pip resolves an unspecified Playwright version from the configured package index.
3. The selected package and its installation behavior execute with the user's local privileges.
4. playwright install contacts the configured upstream delivery infrastructure and downloads executable browser binaries.
5. If either distribution channel or a resolved artifact is compromised, attacker-controlled code could execute during installation or when the browser automation is subsequently launched.

Impact Assessment

A successful supply-chain compromise could execute arbitrary code with the privileges of the user performi ...[truncated 512 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Playwright to a specifically reviewed version in a dependency file rather than installing an unconstrained latest release.

2. Generate and commit a lockfile containing cryptographic hashes, such as a hash-locked requirements.txt.

3. Install dependencies with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Document the expected package index and discourage installation from untrusted mirrors or additional package sources.

5. Pin the expected browser revision and document how its downloaded artifacts are authenticated or verified.

6. Run installation inside a dedicated virtual environment or isolated container under a non-privileged account.

7. Add dependency update review and automated supply-chain scanning so package and browser revisions are deliberately approved before release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file consists entirely of Chinese-language quoted content, with no indication that the language is optional or tied to a justified region-specific use case. Under the policy, language-specific behavior without user opt-in or clear justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The described workflow takes user-uploaded brand materials and sends the extracted content into LLM generation steps, but the article provides no privacy, consent, or data-handling warning. In an enterprise branding context, source materials may contain unpublished product details, customer data, or confidential business information, so transmitting them to external model services can create data leakage and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file consists entirely of Chinese title text, which indicates a language-specific output format. There is no accompanying natural-language note offering localization choice or explaining that the skill is intentionally region- or audience-specific, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The required article structure is specified entirely in Chinese and presented as mandatory output sections, which effectively constrains the skill to a specific language/locale. The file does not indicate that the user can choose another language or that this locale restriction is optional or justified as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt mixes English framing with a required Chinese working style and Chinese-only checklist items, indicating the skill is intended to operate in Chinese without any user opt-in or language choice. This is a natural-language policy concern because the file imposes a locale/language constraint rather than offering alternatives or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The template hardcodes Chinese section headings and body labels such as '摘要', '背景与痛点', and '总结', which imposes a specific language/locale in the generated content. There is no indication that the user can choose another language or that the Chinese-only format is required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The entire template is written in Chinese and provides no indication that language selection is optional or configurable. This can violate language/locale policy requirements when a skill should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all FAQ content in Chinese, which can be interpreted as forcing a specific language on users without opt-in. The policy allows locale constraints when they are clearly documented and justified, but no such justification or alternative language option is provided here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file states that the workflow's output node will persist generated assets to disk, which can affect user data or the local filesystem. Under the markdown-specific warning rule, the description should disclose file-writing behavior and any overwrite implications, but no such warning is present nearby or elsewhere in the document.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions require titles to follow Juejin examples written in Chinese, such as "我做了一个..." and "从0到1实现...", which effectively imposes a specific language/locale style. There is no indication that the user can choose another language or opt into this constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The comment at L010 states the script only reads files from '/output/juejin/', which communicates a specific constrained data source. However, the actual code constructs its base path as '../examples/output/juejin' at L017, so the documented location and the implemented location do not match.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The safety declaration and surrounding comments emphasize a limited browser-assist flow focused on manual user handling for login and security prompts. But the implementation at L076 actively uses the browser clipboard API to copy article content, which is a meaningful side effect not reflected in the declared safety behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, which can impose a language constraint on users without explicit opt-in. Under the policy, forcing a specific language without offering a choice may be a natural-language policy violation unless the locale restriction is justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.