ClawHub
Back to skill

Security audit

Zhihu Geo Draft Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent and human-controlled, but it includes prompts for disguising brand marketing so it is less likely to be treated as marketing on Zhihu.

Review carefully before installing. The browser automation is visibly scoped and does not publish automatically, but the content prompts may help produce low-disclosure promotional material that could violate Zhihu rules or damage account trust. If used, pin Playwright in an isolated environment and avoid using the no-ad prompt to hide sponsorship or marketing intent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:43
Finding

Unpinned Playwright Package and Browser Dependencies

Content
View full analysis

Vulnerability Details

File Location: README.md:43 and scripts/draft_to_zhihu.example.py:12-13
Vulnerability Type: Unpinned third-party package and browser binary installation
Risk Level: Medium

Vulnerable Code

README.md:43:

text
1. Ensure that Python and Playwright are installed (`pip install playwright` followed by `playwright install`).

scripts/draft_to_zhihu.example.py:12-13:

python
pip install playwright
playwright install

Technical Analysis

The documented setup process installs Playwright without specifying an audited version, package hash, lockfile, trusted package source, or expected browser revision. The playwright install command also downloads browser binaries associated with whichever Playwright release was resolved at installation time.

Consequently, the effective dependency set can change after the Skill has been reviewed. Users following the same instructions at different times may receive different Python packages, transitive dependencies, and browser binaries.

This does not establish that the current Playwright package is malicious. The risk arises from the mutable and unverified installation process. If the package index, package publication account, build source, dependency resolution path, or browser distribution channel were compromised, attacker-controlled artifacts could be installed under the user's account.

Attack Path

  1. An attacker compromises an upstream Playwright release, one of its resolved dependencies, its package publication process, or the browser binary distribution channel.
  2. A user follows the project instructions and runs pip install playwright without a version or hash constraint.
  3. The package manager resolves and installs the attacker-controlled release or dependency. If a source distribution is selected, its build backend may execute during installation.
  4. The user runs playwright install, causing browser arti ...[truncated 958 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Playwright to a reviewed version, for example through an exact requirement such as playwright==<reviewed-version>.
  2. Add a dependency lockfile generated from a controlled environment and commit it to the project.
  3. Use hash-verified installation, such as a requirements file containing approved SHA-256 hashes and installation with pip install --require-hashes -r requirements.txt.
  4. Document the approved package index explicitly and prevent fallback to untrusted or internal indexes where dependency confusion is possible.
  5. Pin and document the expected Playwright browser revision. Verify downloaded artifacts through the integrity mechanisms supplied by the official distribution process.
  6. Perform installation inside a dedicated virtual environment or isolated container using a non-privileged account.
  7. Replace both unpinned command examples with the same reproducible installation procedure so that the README and script documentation cannot diverge.
  8. Use an automated dependency update process that reviews and tests new versions before updating the lockfile and approved hashes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (30)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The prompt explicitly targets scenarios with 'high ban risk' or low-account trust and instructs generation of a 'clean' version to avoid being folded or classified as marketing, while preserving the persuasive substance. This is a classic moderation-evasion pattern: it helps disguise promotional content so it can bypass platform enforcement rather than comply with policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The entire skill file is written as a Chinese quote library and provides fixed Chinese-language sentences only, with no indication that language selection is optional. Under the policy, language constraints should either offer user opt-in or be clearly documented as region-specific and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file contains user-facing natural-language content exclusively in Chinese, and there is no indication that the user opted into that language or that the skill is intentionally region-specific. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill content is written entirely in Chinese and specifically instructs the agent to act as a Zhihu columnist and produce a Zhihu article, which implies a fixed language/locale behavior. The file does not offer the user a language choice or explicitly justify the locale restriction as an opt-in or region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt switches into Chinese and instructs the agent to act specifically as a Zhihu drafting assistant, which effectively constrains the skill to a single language/locale. The file does not state that this is optional, user-selected, or justified as a region-specific skill, so it matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The prompt switches into Chinese and instructs the agent in Chinese only, which implies a fixed language behavior. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This file's natural-language instructions require use of a specific language without any opt-in or alternative, which matches the language/locale policy violation category. There is no indication that the skill is region-specific or that users can choose another language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill presents itself as 'content desensitization review,' but the actual transformation preserves the article's core persuasive value, methodology, industry judgments, and knowledge structure while removing brand identifiers. That makes the content look less like advertising without materially reducing its marketing function, increasing the risk of deceptive or covert promotion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's operational instructions are written entirely in Chinese and direct the agent to act as a Zhihu auditor, which effectively forces a specific language/locale. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; this file does not explicitly provide that framing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instructions are entirely in Chinese and require generation of Zhihu questions in a Chinese-language style, but they do not state that this locale restriction is optional or user-selected. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The prompt is entirely written in Chinese and instructs the assistant to act specifically for the Zhihu platform, with no indication that the user can choose another language or locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified and documented as a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The prompt instructs the model to rewrite content specifically in the style of Zhihu and the entire instruction set is written as mandatory Chinese-language output behavior. This imposes a language/locale constraint without any user opt-in or explicit justification that the skill is limited to a Chinese-only regional workflow.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/draft_to_zhihu.example.py (reported line 118)May include surrounding context.

python
# 保持浏览器挂起，直到用户手动关闭
        try:
            page.wait_for_event("close", timeout=0)
        except Exception:
            pass

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file is a natural-language template entirely framed in Chinese, including the title and all section instructions, with no indication that the user can choose another language. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template title and all instructional text are written in Chinese, and the file presents a Zhihu-specific question template without offering any language or locale choice. This can violate language/locale policy when a skill imposes a specific language by default rather than letting the user opt in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file explicitly labels the skill in Chinese and all operational instructions are written only in Chinese, indicating a fixed language/locale expectation. Because the document does not offer an alternative language or user choice, this is a natural-language locale policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README content is written in Chinese and does not indicate that users may choose another language or that the locale restriction is required for a documented regional compliance reason. This is a natural-language policy concern because it imposes a specific language context without an explicit opt-in or stated justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents all user-facing instructions exclusively in Chinese, and it does not state that the language is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The file’s operational instructions are entirely written in Chinese, and there is no accompanying statement that the skill is Chinese-only, region-specific, or that users may choose another language. Under the stated policy, forcing a specific language without opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document presents all substantive skill content in Chinese, including field labels and descriptions, with no indication that another language is supported or that Chinese is optional. This can violate a language/locale policy when users are not given a choice or informed that the skill is region- or language-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file uses Chinese-language headings and keywords throughout, which can amount to a language policy constraint if the skill content is expected to be generally reusable. The file does not indicate that Chinese is optional or that the content is intentionally region-specific, so users may be forced into a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file hard-codes key brand fields such as product name, audience, and value proposition in Chinese. Because no opt-in, multilingual alternative, or justification for a China-specific locale is provided, this creates a natural-language locale policy concern under the language-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all user-facing FAQ content exclusively in Chinese, with no indication that the skill or documentation is region-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains user-facing natural language exclusively in Chinese, which can constitute a language/locale policy issue when no opt-in or locale justification is provided. The policy specifically calls for flagging cases where a skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file is entirely written in Chinese and does not indicate that the language choice is optional or limited to a region-specific audience. Under the policy rule for language or locale constraints, content that effectively forces a specific language without user opt-in can be flagged unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.