ClawHub
Back to skill

Security audit

Zhihu Assistant

Security checks for vulnerabilities and agentic risk

Overview

This Zhihu assistant is mostly purpose-aligned, but it handles session cookies and API keys while exposing a config-display path and installer behavior that users should review before installing.

Review before installing. Use a dedicated environment, pin dependencies if possible, avoid running the installer with elevated privileges, and do not use the generated config display command unless you have confirmed secret redaction. Treat the Zhihu Cookie like a password, rotate it if it is exposed, and only configure trusted AI endpoints for draft generation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
install.sh:24
Finding

Unpinned Dependencies Installed into the Global Python Environment

Content
View full analysis
/dev/null || pip3 install --break-system-packages -q pyyaml requests httpx openai 2>/dev/null || { ``` ### Technical Analysis The installer retrieves packages without fixed versions or integrity hashes. Consequently, each installation can resolve to different package versions than those reviewed during development. If a package release or its distribution account is compromised, installation may execute attacker-controlled package setup logic under the identity running the installer. The fallback uses `--break-system-packages`, permitting modification of an externally managed Python environment. This can overwrite or conflict with packages used by other applications. In addition, `httpx` and `openai` are not used by the audited implementation, so installing them expands the supply-chain attack surface beyond the minimum required for the declared functionality. ### Attack Path 1. An upstream dependency, maintainer account, or package distribution channel is compromised. 2. A malicious package version is published under one of the unrestricted dependency names. 3. A user runs `install.sh`. 4. `pip3` resolves and downloads the malicious version because no version or hash constraint is present. 5. Package installation code executes with the privileges of the user running the installer. 6. If the installer runs with elevated privileges, or the fallback modifies a shared system interpreter, the compromise can affect additional users and applications. ### Impact Assessment Successful exploitation can result in arbitrary code execution with the installer user's privileges. An attacker could access files and credentials available to that user, alter the installed Skill, or tamper with other packages in the same P ...[truncated 202 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
install.sh:65
Finding

Whole-Skill Configuration Display May Expose Stored Credentials

Content
View full analysis
/dev/null || echo " 暂无配置" ``` ### Technical Analysis The generated `config` command retrieves and prints the complete configuration namespace for the Skill rather than selecting individual non-sensitive settings. That namespace contains `zhihu_cookie`, `kimi_api_key`, and potentially `doubao_api_key`, all of which are marked as secrets in `config.schema.json`. Although the underlying OpenClaw command may apply redaction in some environments, this wrapper neither enforces nor verifies redaction. It therefore creates a disclosure path whenever the configuration backend returns raw values. Printing all settings also exceeds the minimum privilege and data-access requirements of a status-display command. ### Attack Path 1. A user, support operator, automation process, or local attacker invokes `openclaw zhihu config`. 2. The wrapper requests the entire `skills.zhihu-assistant` configuration object. 3. If the OpenClaw configuration command does not redact secret fields, the Zhihu Cookie and AI API keys are written to standard output. 4. The output may be observed directly or captured by terminal logging, CI logs, remote support sessions, screen recordings, or process-output collectors. 5. A recipient can reuse the exposed Cookie to access the associated Zhihu session or consume the exposed AI API key within its authorized quota and permissions. ### Impact Assessment Exposure of the Zhihu Cookie may permit session impersonation within the scope granted by that Cookie. Exposure of an AI provider key may allow unauthorized API use, quota consumption, and financial charges. This issue does not grant system privileges by itself. Its scope is limited to credentials returned by the configuration command and the permiss ...[truncated 135 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The document describes local persistence in data/answered.json, data/pending.json, and logs/app.log, but these storage and logging behaviors are not surfaced as declared capabilities or privacy-relevant behavior. Undeclared persistence is security-significant because it can retain sensitive drafts, account-linked activity, or identifiers longer than users expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The document describes local persistence in data/answered.json, data/pending.json, and logs/app.log, but these storage and logging behaviors are not surfaced as declared capabilities or privacy-relevant behavior. Undeclared persistence is security-significant because it can retain sensitive drafts, account-linked activity, or identifiers longer than users expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The document describes local persistence in data/answered.json, data/pending.json, and logs/app.log, but these storage and logging behaviors are not surfaced as declared capabilities or privacy-relevant behavior. Undeclared persistence is security-significant because it can retain sensitive drafts, account-linked activity, or identifiers longer than users expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The document describes local persistence in data/answered.json, data/pending.json, and logs/app.log, but these storage and logging behaviors are not surfaced as declared capabilities or privacy-relevant behavior. Undeclared persistence is security-significant because it can retain sensitive drafts, account-linked activity, or identifiers longer than users expect.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documentation declares installation, configuration, scheduled jobs, local storage, and external service use, but it does not declare any explicit tool scope or permissions despite requiring network access, file reads/writes, environment/config access, and likely shell execution. This weakens least-privilege controls and makes it harder for users or the platform to understand and constrain what the skill can access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The feature description states that drafts are pushed to Feishu for review, but it does not prominently warn that fetched Zhihu content and AI-generated text will be transmitted to a third-party messaging platform. In this context, the skill handles user-linked content and potentially sensitive drafts, so insufficient disclosure can lead to privacy and compliance issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The scheduled tasks run automatically every hour and use stored credentials/session material to fetch content and send outbound notifications, but the documentation lacks an explicit warning about ongoing background activity. In a skill that relies on a live Zhihu cookie and external messaging, silent automation increases the chance of unexpected account usage, data transmission, and operational surprises.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer and the generated wrapper command present all user-facing messages, help text, and setup instructions exclusively in Chinese. This creates a natural-language locale policy issue because the skill does not offer user opt-in or an alternative language, and no region-specific justification is documented in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring, usage instructions, and CLI descriptions are entirely in Chinese, which imposes a specific language on users. The file does not indicate that Chinese is optional, user-selectable, or required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

模块级文档在 L007 将技能功能描述为“推送到飞书”，命令示例和 CLI 帮助在 L014-L015、L362-L363 也表述为执行推送。但本文件中的 notify 实现仅调用 memory.get_pending 过滤未推送项目并返回/打印列表（L303-L325, L395-L402），没有调用 FeishuNotifier 发送消息，表现与宣称功能不一致。

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · main.py (reported line 59)May include surrounding context.

python
def get_openclaw_config(key: str, default=None):
    """从 OpenClaw 配置读取"""
    try:
        result = subprocess.run(
            ['openclaw', 'config', 'get', f'skills.zhihu-assistant.{key}'],
            capture_output=True, text=True, timeout=10
        )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · main.py (reported line 127)May include surrounding context.

python
'kimi': {
                'api_key': '',
                'model': 'kimi-coding/k2p5',
                'base_url': 'https://api.moonshot.cn/v1'
            },
            'feishu': {
                'use_openclaw': True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

函数注释和周边 CLI 文案把 notify 语义描述成飞书推送流程的一部分，但 notify_pending 的具体实现只是读取待审核数据、筛选没有 feishu_message_id 的项并返回列表，没有任何调用 notifier 的发送副作用。这不是简单的信息缺失，而是文档对执行效果的表述与代码实际行为相冲突。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This code sends externally sourced or user-provided content over the network to a remote API endpoint. External transmission is expected for an LLM-backed generator, but it remains security-relevant because the module does not enforce sensitivity filtering, domain allowlisting beyond a configurable base_url, or consent controls, making data leakage to third parties possible if sensitive input is processed.

Content

Scanner excerpt · modules/content_gen.py (reported line 123)May include surrounding context.

python
'max_tokens': 1500
                }
                
                response = requests.post(self.api_url, headers=headers, json=data, timeout=60)
                response.raise_for_status()
                
                result = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The function transmits user-provided question content, detail, and excerpt to a third-party API without any built-in consent gate, redaction, or sensitivity check. In this skill context, scraped or operator-supplied content may include private, copyrighted, or otherwise sensitive material, so silent exfiltration to an external model provider creates a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

代码在非测试模式下会把用户提供的 Cookie 放入请求头，并在 L128 发起外部 HTTP 请求到知乎接口。虽然有一般性 docstring 说明 cookie 用途，但没有明确提示这是认证凭据、会被发送到外部服务，也没有额外的用户提示或敏感操作警示。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The skill documentation is entirely written in Chinese and does not indicate that other languages are supported or that the language choice is intentional and limited to a region-specific audience. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The constructor documentation says the default API key comes from an environment variable for the declared 豆包 API integration, which implies a matching provider-specific variable. In code, the fallback is os.environ.get('KIMI_API_KEY'), contradicting the documented behavior and indicating a likely provider/credential mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The initializer reads an API key from an environment variable, which is a sensitive credential access pattern. While the constructor docstring mentions reading from the environment by default, there is no explicit user-facing warning or disclosure about handling sensitive credentials or the expected variable name.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code emits natural-language content entirely in Chinese, including the notification body and user instructions. Under the policy, forcing a specific language without offering user choice can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

L091 将 Accept-Language 硬编码为 "zh-CN,zh;q=0.9,en;q=0.8"，这会在所有请求中强制发送特定语言/地区偏好。文件中未见允许用户选择语言环境或说明该限制仅适用于特定合规/区域场景的自然语言说明。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.