Security audit

公开社交账号分析

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent public-account analysis goal, but it also handles live login cookies/tokens, can save and auto-reuse them, and includes broader scraping/signing machinery that needs user review.

Review this before installing. Prefer unauthenticated public data or user-exported files. Do not paste real account cookies into chat unless you trust the runtime and understand they are live session credentials. Avoid --persist-cookie unless you need reuse, clear cached cookies afterward, and bind any signing service to localhost rather than a network-visible host.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (38)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill declares no permissions while the content explicitly describes capabilities involving environment variables, file reads/writes, network access, and shell/subprocess execution. This under-declaration weakens review and runtime trust boundaries because operators may approve or run the skill without understanding that it can ingest cookies/tokens, persist files, and make live external requests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description presents the skill as an analyzer of public accounts, but the body reveals substantially broader behavior: live scraping/collection, cookie ingestion and optional persistence, OAuth-based authorized collection, workspace/evidence management, and a signing service. This mismatch is dangerous because users and reviewers may consent to a low-risk analysis tool while actually granting a much more capable data-collection and credential-handling workflow.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The training data explicitly labels an Instagram analysis request as a positive trigger even though the skill metadata says Instagram is unsupported and should not trigger. This inconsistency can cause the agent to activate outside its declared scope, increasing the chance of unintended scraping, policy bypass, or handling of unsupported platforms in unsafe ways.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The validation set explicitly marks a YouTube account-analysis request as triggering the skill even though the skill metadata says YouTube is unsupported. This mismatch can cause the router or evaluator to approve out-of-scope invocations, weakening platform-boundary enforcement and increasing the chance the skill is used on unintended targets or with collection logic not designed for that platform.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill is scoped to analyzing public social accounts, but this guide explicitly expands operation into authenticated-session access by asking for user login cookies. That creates a clear mismatch between declared capability and actual behavior, enabling access to non-public content and handling live credentials far beyond what is necessary for the stated use case.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The document instructs users to copy full browser Cookie headers or export cookie JSON and paste them into chat, which exposes active session credentials directly to the agent and any downstream systems processing the conversation. Anyone with access to those values may be able to impersonate the user on the target platform until the session expires or is revoked.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The guide authorizes writing session cookies to local files and automatically reusing them across future tasks, extending credential lifetime and attack surface beyond the immediate request. Persisting unencrypted session tokens, even with restrictive file permissions, materially increases the risk of later misuse, accidental disclosure, or unauthorized reuse.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The file presents the skill as public-account analysis while directing the agent to use login sessions whenever a login wall appears. That framing can mislead users and reviewers into believing the workflow is low-risk public scraping when it actually depends on privileged authenticated access and credential handling.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation explicitly allows persistent storage of a user's authenticated Weibo cookie in `workspace/weibo-cookies.json` for reuse across future tasks. That expands the skill from analyzing public content into handling reusable account credentials, increasing the blast radius if the workspace is accessed by other tools, sessions, or logs. In this skill context, that is more dangerous because the stated purpose is public-account analysis and does not require long-lived authenticated secrets.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The workflow explicitly instructs the agent to solicit and handle a user's authenticated session cookie, which expands the skill from public-content analysis into credential/session handling. Even though it says not to echo or log the cookie, collecting live session material materially increases the risk of account misuse, unauthorized access to non-public data, accidental disclosure, and scope creep beyond the skill's declared public-only purpose.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The authorized Douyin OAuth collection flow enables access using account-owner credentials, which goes beyond the stated scope of analyzing public social accounts. This creates a pathway for privileged data access and token handling inside a skill that users would reasonably expect to remain limited to public evidence, increasing the chance of over-collection, token leakage, and misuse of private account capabilities.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The entrypoint supports loading cached cookies from a workspace directory and persisting user-supplied cookies for future runs, which expands the skill from public-account analysis into credential handling and session reuse. In an agent setting, this creates a cross-run trust boundary issue: a later task may silently inherit authentication material from an earlier one, causing unintended authenticated access, data-scope expansion, or credential misuse beyond the user's immediate request.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The standalone cached-cookie deletion/management flow adds credential-store administration behavior unrelated to the advertised analysis function. While deletion is less dangerous than persistence, exposing side-effectful credential management in the same skill increases attack surface and can be abused by prompts or orchestrators to manipulate session state outside the user's analysis request.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script performs authorized-owner collection using OAuth credentials for the token owner's Douyin account, which is materially broader than the skill's stated scope of analyzing public social accounts from public inputs such as URLs, handles, or exported files. This expands the skill into private or account-holder data access and persistent storage, creating a capability mismatch that could collect non-public data under the guise of a public-account analyzer.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code reads an access token and open_id from environment variables and uses them to access the bound Douyin account, which is not justified by a public-account analysis skill. Even though the script tries to prevent secret leakage into analysis_goal, the mere presence of secret-driven account access introduces credential handling and privileged data collection beyond the declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The file includes a browser-based fetch capability that can drive a real browser process and inject cookies into it, which materially expands the attack surface beyond simple public-account collection. Even if not currently wired into the main protection path, keeping this capability in the collector increases the risk of future misuse, accidental invocation, or policy drift toward browser-mediated scraping.

Intent-Code Divergence

Low

Confidence: 72% confidence
Finding: The code comments and docstrings state that browser fallback will not be used to bypass platform protections, yet a browser-fetch pathway is still implemented in the session class. This mismatch is dangerous because it can mislead reviewers and operators about the actual capabilities present, increasing the chance that a later change or indirect call path enables behavior that exceeds the skill's stated scope.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The browser backend exposes generic capabilities—arbitrary navigation, DOM extraction, scrolling, and unrestricted JavaScript evaluation—that are broader than the skill's declared public-account-analysis purpose. In an agent environment, these primitives can be repurposed by other components or prompt-controlled flows to visit unrelated sites, inspect page contents, and execute browser-side actions, expanding the attack surface beyond intended scope.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code explicitly uses a real browser network path as a fallback when normal HTTP collection is blocked, which is a transport-layer bypass of environment-level restrictions. Even though the comments disclaim CAPTCHA/login/rate-limit bypass, this still enables collection through a different execution path that may evade network controls, monitoring, or policy boundaries in hosted agent environments.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: This file implements loading, persisting, existence checks, and deletion for authenticated platform cookie files, which exceeds the documented public-account-analysis scope. Even though the code includes some safety checks such as file mode and ownership validation, the capability itself enables use of session credentials and expands the skill from public scraping/analysis into authenticated access, increasing the chance of unauthorized account access or accidental credential handling.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill metadata explicitly says it should operate on public content only and should not require login data, but this module manages authenticated cookies for Douyin, Bilibili, Weibo, and Xiaohongshu. That mismatch is security-relevant because it creates hidden capability beyond the declared trust boundary, allowing the skill to process sensitive session material users would not expect to provide for a public-content workflow.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: This module adds capability to load and persist platform cookies, which expands the skill from public-account analysis into handling authentication material. Even though the code includes bounds checking and private-file writes, storing and processing cookies enables authenticated access paths that contradict the declared scope and can be abused to analyze non-public data if invoked elsewhere.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The save path persists sanitized but still fully usable authentication cookies to disk, creating a durable credential store inside a skill that explicitly says it should not use login/private-data workflows. This increases the chance of unauthorized account access, secret reuse by other components, and accidental expansion from public scraping into authenticated collection of private or restricted information.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This file implements a dedicated request-signing service for multiple platforms, explicitly designed to generate anti-bot signatures used for scraping. That materially exceeds the stated analytics-only skill purpose and creates an abuse-enabling capability that can be used to access protected endpoints and evade platform controls.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code contains platform-specific anti-bot/signature circumvention logic for Xiaohongshu, Douyin, Bilibili, and Weibo, including reverse-engineered JS/runtime execution and generation of signatures/cookies for scraping requests. In the context of an account-analysis skill, this is especially dangerous because it directly enables bypass of platform request protections unrelated to the declared user-facing functionality.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.