今日头条资讯采集

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:00 AM UTC
• Version: 3.6.1

Overview

The skill is mostly a read-only Toutiao API helper, but it includes automatic fallback guidance to unrelated platforms, so users should review it before installing.

Install only if you are comfortable giving this skill a MaxHub API key and sending Toutiao-related IDs, URLs, and queries to www.aconfig.cn. Review or remove the non-Toutiao fallback instructions before use, and prefer a pinned or otherwise verified ClawHub installer command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned npm CLI Package Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:14 and README_CN.md:14
Vulnerability Type: Supply-chain risk from unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

README.md:13-15:

bash

npx clawhub install maxhub-toutiao

README_CN.md:13-15:

bash

npx clawhub install maxhub-toutiao

Technical Analysis

Both installation guides instruct users to execute the clawhub npm package through npx without specifying a reviewed version or integrity constraint. If the package is not available locally, npx can retrieve it from the configured npm registry and immediately execute its CLI.

Because package resolution is mutable, the code executed by this command may differ from the code that existed when the Skill was audited. The project does not provide a package version, cryptographic digest, signature-verification procedure, or other mechanism that binds installation to a reviewed artifact.

This is an insecure dependency and remote execution channel at installation time. It does not establish that the current clawhub package is malicious, but it makes users dependent on the continuing integrity of the package publisher, npm account, registry, network path, and local npm configuration.

Attack Path

1. An attacker compromises the clawhub npm publisher account, package distribution process, or another relevant package-resolution component.
2. The attacker publishes a malicious or compromised version under the package name resolved by npx.
3. A user follows either README and runs npx clawhub install maxhub-toutiao.
4. npx retrieves the currently resolved package because the documentation does not pin a reviewed version.
5. The downloaded package's CLI code executes with the privileges of the user running the installation command.
6. Malicious code can perform actions permitted to that user before, during, or instead of installing the Skill. ...[truncated 687 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specifically reviewed package version in both README files:

   bash

   npx --yes clawhub@<reviewed-version> install maxhub-toutiao
   

2. Confirm and document the authoritative npm package name, publisher, and official registry source so users can detect dependency-confusion or package-spoofing attempts.

3. Publish a checksum, signed release, or other verifiable provenance information for the reviewed installer artifact.

4. Recommend reviewing the resolved version before execution, especially in CI/CD or privileged environments.

5. Keep the English and Chinese installation instructions synchronized so neither document retains the unpinned command.

6. Avoid running the installer as root or another privileged account, and use an isolated environment where practical.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

| "analyze" / "分析一下" | Switch to analyze mode |
| "compare with X" / "和X对比" | Add X as second query |

## Output Guidelines

1. **Language consistency** — ALL output matches user's detected language.
2. **Markdown links** — All URLs in `[text](url)` format.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as a Toutiao-only read-only data assistant, but the fallback and error-handling sections instruct use of Douyin and Xiaohongshu endpoint paths. This inconsistency can cause cross-platform requests outside the declared scope, increasing the risk of unintended data access, policy bypass, or covert capability expansion hidden inside operational guidance.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-content-user.md (reported line 11)May include surrounding context.

md

`GET /api/v1/toutiao/app/get_article_info`

<!-- Full path: /api/v1/toutiao/app/get_article_info -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-content-user.md (reported line 37)May include surrounding context.

md

`GET /api/v1/toutiao/app/get_article_info`

<!-- Full path: /api/v1/toutiao/web/get_article_info -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-content-user.md (reported line 63)May include surrounding context.

md

`GET /api/v1/toutiao/app/get_comments`

<!-- Full path: /api/v1/toutiao/app/get_comments -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-content-user.md (reported line 91)May include surrounding context.

md

`GET /api/v1/toutiao/app/get_user_id`

<!-- Full path: /api/v1/toutiao/app/get_user_id -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-content-user.md (reported line 117)May include surrounding context.

md

`GET /api/v1/toutiao/app/get_user_info`

<!-- Full path: /api/v1/toutiao/app/get_user_info -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-content-user.md (reported line 143)May include surrounding context.

md

`GET /api/v1/toutiao/app/get_video_info`

<!-- Full path: /api/v1/toutiao/app/get_video_info -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-content-user.md (reported line 169)May include surrounding context.

md

`GET /api/v1/toutiao/app/get_video_info`

<!-- Full path: /api/v1/toutiao/web/get_video_info -->

### Parameters

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx clawhub install maxhub-toutiao without pinning a specific version of the installer package. This can cause users to execute whatever version is currently published under that package name, increasing supply-chain risk if a malicious or compromised release is published later. The skill context does not mitigate this risk because installation is the trust boundary and occurs before users can inspect behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub install maxhub-toutiao without pinning a specific package version. This can cause users to fetch and execute whatever version is latest at install time, increasing supply-chain risk if the package is compromised, unpublished/replaced, or updated with malicious code.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill is designed to transmit user-supplied queries and an API bearer token to an external third-party service. External transmission is expected for API-backed skills, but it is still security-relevant because sensitive query data and credentials leave the local environment and depend on the trustworthiness and scope control of the upstream service.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

# GET example
curl -s "https://www.aconfig.cn/api/v1/toutiao/{endpoint}?{params}" \
  -H "$maxhub_auth_header"

# POST example

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The security declaration asserts that all endpoints are legitimate, read-only, and aligned with this skill's purpose, but later sections document unrelated cross-platform paths. Such contradictory assurances can mislead reviewers and users about the true operational scope, reducing scrutiny and making hidden overreach more likely to go unnoticed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list includes very generic terms such as "get", "info", "find", and broad topic words like "user" or "video" without clear exclusion conditions. In a markdown skill description, these vague signals can make it unclear when this skill should activate versus when ordinary conversation should not route into it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The mode table treats common phrases like "find", "show me", and "analyze" as routing signals with no contextual guardrails. Because these expressions are frequent in everyday requests, the markdown does not clearly distinguish when Browse, Analyze, or Compare should or should not be selected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents authentication via Authorization: Bearer $MAXHUB_API_KEY, which indicates the skill will use sensitive credentials and make authenticated network requests. The file does not include any warning about protecting the API key, avoiding accidental disclosure, or the fact that requests send user-supplied content/URLs to an external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented endpoint line shows GET /api/v1/toutiao/app/get_article_info, while the accompanying comment states the full path is /api/v1/toutiao/web/get_article_info. These two pieces of inline documentation contradict each other about which API variant is being described.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The section documents GET /api/v1/toutiao/app/get_video_info, but the inline comment identifies the full path as /api/v1/toutiao/web/get_video_info. This is an active contradiction in the documentation about what endpoint the skill actually exposes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.