微博舆情数据采集

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:03 AM UTC
• Version: 3.6.1

Overview

This Weibo data skill is mostly read-only, but it needs review because its instructions can route failed requests to unrelated Douyin/Xiaohongshu-style API paths.

Review before installing. Use it only if you are comfortable sending MaxHub API credentials and Weibo queries to aconfig.cn, avoid providing browser cookies unless necessary, and prefer a pinned or already-verified ClawHub CLI install. The publisher should remove the Douyin/Xiaohongshu fallback material or clearly declare multi-platform scope before this is treated as fully coherent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:18

Finding

Unpinned npm Package Execution in English Installation Guide

Content

View full analysis

Vulnerability Details

File Location: README.md:18
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable code:

bash

npx clawhub install maxhub-weibo

Technical Analysis

The installation guide instructs users to execute clawhub through npx without specifying an exact, audited package version or verifying package integrity. If the package is not already available locally, npx may retrieve its current release from the configured npm registry and execute it immediately.

Consequently, the code executed by this command can change after the Skill has been reviewed. Compromise of the npm package, its publisher account, the registry resolution path, or a future package release could result in unreviewed code running under the installing user's account.

Attack Path

1. An attacker compromises the npm package, its publisher credentials, or another component of the package-resolution chain.
2. The attacker publishes a malicious or backdoored release that resolves under the unversioned clawhub package name.
3. A user follows the installation command in README.md.
4. npx downloads the currently resolved package because no exact version is pinned.
5. The package executes with the privileges of the user running the command.
6. The malicious package can access resources available to that user and may install additional components.

Impact Assessment

Successful exploitation would provide code execution with the installing user's privileges. Depending on the execution environment, the malicious package could read user-accessible files and environment variables, including API credentials; modify project or user configuration; make arbitrary network requests; or install persistence where the user has sufficient permissions. The command does not inherently grant administrative privileges, so the maximum scope is bounded by the privileges of the invoking acc ...[truncated 5 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact version that has been reviewed, for example:

  bash

  npx --yes clawhub@AUDITED_EXACT_VERSION install maxhub-weibo
  

• Do not use a floating tag such as latest or a semver range.
• Document the expected npm package publisher, registry, version, and package digest.
• Prefer a trusted, separately installed CLI whose provenance and integrity have already been verified.
• Where supported, verify package signatures or registry integrity metadata before execution.
• Re-audit the pinned package before updating the documented version.

T08 · Insecure Dependencies

Warning

• Location: README_CN.md:18

Finding

Unpinned npm Package Execution in Chinese Installation Guide

Content

View full analysis

Vulnerability Details

File Location: README_CN.md:18
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable code:

bash

npx clawhub install maxhub-weibo

Technical Analysis

The localized installation guide repeats the same unversioned npx command. When a trusted local copy is unavailable, npx may download and immediately execute the package currently resolved by the npm registry. The command provides no exact version, checksum, signature requirement, or other mechanism that binds execution to the release reviewed during this audit.

This creates a supply-chain trust boundary outside the audited project: a later release or compromised package-distribution channel can alter the effective installation payload without any modification to this repository.

Attack Path

1. An attacker gains control of the package publisher account, package contents, or package-resolution infrastructure.
2. A malicious release becomes the version selected for the unpinned package name.
3. A user copies and runs the command from README_CN.md.
4. npx retrieves and executes the attacker-controlled release.
5. The payload operates with the invoking user's permissions and accesses resources available to that account.

Impact Assessment

Exploitation can produce arbitrary code execution at the privilege level of the installing user. Potential consequences include exposure of user-readable credentials and files, unauthorized configuration changes, arbitrary outbound communication, project compromise, and user-level persistence. Administrative access is not automatically obtained; broader impact would require the command to be run by a privileged account or a separate privilege-escalation vulnerability.

Remediation

View remediation

Remediation Suggestions

• Replace the command with an exact, audited version:

  bash

  npx --yes clawhub@AUDITED_EXACT_VERSION install maxhub-weibo
  

• Keep the English and localized installation instructions synchronized so both use the same approved version.
• Publish the expected package provenance and integrity information.
• Prefer a preinstalled, verified CLI rather than downloading executable code at installation time.
• Establish a controlled review and update process before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (56)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The metadata and description claim a Weibo-only assistant, yet the documented behavior includes cross-platform API guidance for Douyin and Xiaohongshu. This mismatch is dangerous because it broadens the operational scope beyond what users and defenders expect, increasing the chance of unintended data access, misrouting, or abuse of unrelated platform endpoints.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicated hidden-instructions finding points to the same issue: the skill relies on non-obvious reference/comment content to govern path selection and downgrade behavior. Such covert instruction channels reduce auditability and create an attack surface for prompt/instruction smuggling within documentation artifacts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicated hidden-instructions finding points to the same issue: the skill relies on non-obvious reference/comment content to govern path selection and downgrade behavior. Such covert instruction channels reduce auditability and create an attack surface for prompt/instruction smuggling within documentation artifacts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

| "compare with X" / "和X对比" | Add X as second query |
| "AI搜索" / "AI search" | Route to ai_search endpoint |

## Output Guidelines

1. **Language consistency** — ALL output matches user's detected language.
2. **Markdown links** — All URLs in `[text](url)` format.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is presented as a Weibo-only data assistant, but its error-handling and downgrade logic instructs switching to Douyin and references Xiaohongshu path patterns. That cross-platform fallback can cause the agent to invoke unrelated APIs, violate user expectations, and potentially send Weibo-derived queries or credentials into the wrong service namespace.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 11)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/check_allow_comment_with_pic`

<!-- Full path: /api/v1/weibo/web_v2/check_allow_comment_with_pic -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 74)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_ai_related_search`

<!-- Full path: /api/v1/weibo/web_v2/fetch_ai_related_search -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 129)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_comment_replies`

<!-- Full path: /api/v1/weibo/web/fetch_comment_replies -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 181)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_hot_ranking_timeline`

<!-- Full path: /api/v1/weibo/web_v2/fetch_hot_ranking_timeline -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 244)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_hot_search_index`

<!-- Full path: /api/v1/weibo/web_v2/fetch_hot_search_index -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 296)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_pic_search`

<!-- Full path: /api/v1/weibo/web_v2/fetch_pic_search -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 356)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_post_comments`

<!-- Full path: /api/v1/weibo/web_v2/fetch_post_comments -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 388)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_post_detail`

<!-- Full path: /api/v1/weibo/web/fetch_post_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 413)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_post_detail`

<!-- Full path: /api/v1/weibo/web_v2/fetch_post_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 440)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_post_sub_comments`

<!-- Full path: /api/v1/weibo/web_v2/fetch_post_sub_comments -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 472)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_search`

<!-- Full path: /api/v1/weibo/web/fetch_search -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 472)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_search`

<!-- Full path: /api/v1/weibo/web/fetch_search -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 550)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_social_ranking`

<!-- Full path: /api/v1/weibo/web_v2/fetch_social_ranking -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 611)May include surrounding context.

md

`GET /api/v1/weibo/app/fetch_status_detail`

<!-- Full path: /api/v1/weibo/app/fetch_status_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 675)May include surrounding context.

md

`GET /api/v1/weibo/app/fetch_status_reposts`

<!-- Full path: /api/v1/weibo/app/fetch_status_reposts -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 706)May include surrounding context.

md

`GET /api/v1/weibo/app/fetch_user_info_detail`

<!-- Full path: /api/v1/weibo/app/fetch_user_info_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 765)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_user_posts`

<!-- Full path: /api/v1/weibo/web/fetch_user_posts -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 794)May include surrounding context.

md

`GET /api/v1/weibo/web/fetch_user_posts`

<!-- Full path: /api/v1/weibo/web_v2/fetch_user_posts -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 832)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_user_recommend_timeline`

<!-- Full path: /api/v1/weibo/web_v2/fetch_user_recommend_timeline -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 832)May include surrounding context.

md

`GET /api/v1/weibo/web_v2/fetch_user_recommend_timeline`

<!-- Full path: /api/v1/weibo/web_v2/fetch_user_recommend_timeline -->

### Parameters

Static analysis

No suspicious patterns detected.