Weibo CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:26 AM UTC
• Version: 0.1.1

Overview

The skill is mostly a coherent Weibo lookup helper, but it asks users to run an unpinned third-party npm CLI and optionally provide a login cookie without enough security guidance.

Review before installing. Prefer a pinned local installation of the npm package, avoid global install and ad-hoc npx execution, and do not provide WEIBO_COOKIE unless you are comfortable giving the CLI access to an active Weibo session. Treat that cookie like a password and rotate/revoke it if exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-22
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

## Installation

# Global install
npm install -g @marvae24/weibo-cli

# Or local install (safer)
npm install @marvae24/weibo-cli
npx @marvae24/weibo-cli hot

Technical Analysis

The skill instructs users or agents to install and execute @marvae24/weibo-cli without pinning an exact version or providing a lockfile, integrity hash, vendored source, or other mechanism for verifying the retrieved artifact. The audited project contains only SKILL.md; therefore, the dependency's implementation and the documentation's claims concerning API access, cookie processing, and retry behavior cannot be verified from the project.

Both installation commands resolve a mutable package version from the npm registry. The npx command may retrieve and immediately execute that package. Global installation also increases exposure by placing the executable in the user's global command environment.

The skill additionally states at line 27 that the package can consume the optional WEIBO_COOKIE environment variable. This is not evidence that the current package is malicious, but it means that malicious code introduced through a compromised or changed release could access an authenticated Weibo session cookie when the variable is present.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a future package release.
2. The attacker publishes malicious code under the same package name and a version selected by npm's unpinned resolution.
3. A user or agent follows the skill instructions and runs npm install, npm install -g, or npx.
4. npm retrieves the mutable package release from the external registry.
5. Package lifecycle scripts or the invoked CLI execute with the privileges of the calling user.
6. The ma ...[truncated 868 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than relying on the latest registry release.
2. Include a lockfile with npm integrity metadata and use npm ci for reproducible installation.
3. Provide a verifiable source-code repository and review the package implementation and lifecycle scripts before recommending execution.
4. Prefer a project-local installation over global installation, and invoke the pinned local binary.
5. Avoid allowing npx to download an unverified package at execution time; use an already verified local installation.
6. Execute the CLI in a restricted environment with minimal filesystem and network permissions.
7. Do not expose unrelated environment variables or credentials to the process.
8. If WEIBO_COOKIE is necessary, use a dedicated, minimally privileged session, avoid persistent plaintext storage, and rotate the session after suspected exposure.
9. Monitor the dependency for publisher changes, unexpected releases, ownership transfers, and reported supply-chain incidents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to run npx @marvae24/weibo-cli without pinning a specific version, which causes execution of whatever package version is current at install time. This creates a supply-chain risk: if the package is compromised or a breaking/malicious version is published, users may execute attacker-controlled code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation tells users they can pass a login cookie to the CLI but does not warn that a cookie is effectively account-authentication material. Users may expose an active session token to local logs, shell history, subprocesses, or malicious package code, enabling account takeover or privacy loss if the token is stolen.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The description frames the skill entirely around Weibo and Chinese content, including Chinese examples and a Chinese social-media platform, without indicating whether users can choose another language/locale. Because the instructions are scoped to a specific locale/domain and do not mention opt-in or alternatives, this may conflict with a language/locale choice policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill is presented as a no-auth public-data tool, but it also encourages supplying a personal WEIBO_COOKIE for higher rate limits. That widens the trust boundary by inviting users to provide sensitive session material to a third-party CLI, increasing the chance of credential misuse, account compromise, or unintended collection of authenticated data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.