ClawHub
Back to skill

Security audit

Fetch Zhihu Content

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its Zhihu download purpose, but it can open arbitrary web addresses with weakened browser protections, so it should be reviewed before use.

Install only if you are comfortable running a browser automation scraper locally. Use it only on trusted Zhihu URLs, preferably in a disposable or isolated environment with no sensitive local services exposed. Before broader use, the maintainer should enforce a strict Zhihu URL allowlist, validate redirects, remove default --no-sandbox, and clearly disclose or remove anti-detection behavior.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/fetch_zhihu_content.py:395
Finding

Unrestricted URL Navigation Enables SSRF-Like Internal Network Access

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_zhihu_content.py:415
Finding

Chromium Browser Sandbox Is Explicitly Disabled

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior does not fully match the skill’s actual capabilities, including support for broader URL types and undisclosed anti-detection or anti-automation evasion. Hidden or misleading behavior is dangerous because it defeats informed consent, can violate platform expectations, and may mask functionality that increases legal, operational, or detection risk when the agent runs the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script injects anti-detection logic to spoof webdriver, plugins, languages, and window.chrome in order to evade bot detection. For a content-export skill, this is unnecessary and materially increases abuse potential by helping automated browsing bypass platform defenses, making the tool more dangerous than its stated purpose suggests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes a Python script that writes files and may access environment-dependent browser/runtime state, but it declares no explicit tool scope or permissions. This weakens policy enforcement and reviewability: an agent or orchestrator cannot reliably constrain file output locations or understand that local resources may be touched before execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The browser context is hard-coded to use locale="zh-CN" and timezone_id="Asia/Shanghai", and the anti-detection script also forces navigator.languages to ['zh-CN', 'zh']. This is a natural-language/locale policy concern because the skill imposes a specific language/locale environment without user opt-in or configuration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill claims to download Zhihu content, but parse_args() accepts any argument containing 'zhihu.com' and fetch_zhihu() never enforces that the URL is actually a Zhihu article/answer/question page. This broad URL acceptance can be abused to make the agent visit unintended endpoints under attacker influence, expanding the tool into a general authenticated browser fetcher for the zhihu.com domain and potentially enabling misuse against internal Zhihu flows or sensitive pages.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/fetch_zhihu_content.py (reported line 425)May include surrounding context.

python
if cfg["channel"]:
        launch_kwargs["channel"] = cfg["channel"]

    engine = getattr(p, engine_name)
    echo(f"  启动浏览器: {engine_name}" + (f" ({cfg['channel']})" if cfg['channel'] else ""))
    return await engine.launch(**launch_kwargs)

Static analysis

No suspicious patterns detected.