T01 · Skill Instruction Hijacking
Error
- Location
.- Finding
Agent-Turn Command Injection Through Scheduled Publishing Inputs
- Content
View full analysis
- Remediation
View remediation
Security audit
Social Media Automation Operations Assistant
Security checks for vulnerabilities and agentic risk
Overview
This social-media automation skill is mostly purpose-aligned, but it needs review because it can affect real public accounts and contains unsafe scheduling, command construction, and token-handling patterns.
Review before installing or using with real accounts. Use dry-run/manual review by default, avoid untrusted content or plan files, do not register generated cron jobs without checking the full agentTurn message, and rotate any Weibo token that may have appeared in logs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
.- Finding
Browser Automation Command Injection Through Unescaped Social-Media Content
- Content
View full analysis
kind=click', }, { step: 4, action: 'type', description: 'Fill in the title', command: `browser act ref= kind=type text="${title}"`, value: title, }, { step: 5, action: 'type', description: 'Fill in the body', command: `browser act ref= kind=type text="${body.slice(0, 200)}..."`, value: body, }, { step: 6, action: 'type', description: 'Enter tags', command: `browser act ref= kind=type text="${tags}"`, value: tags, }, ``` ```js // scripts/utils/xiaohongshu.js:91-99 function buildImageGenerationCommands(imageDescription) { return [ { step: 'img-1', action: 'click', command: 'browser act ref= kind=click' }, { step: 'img-2', action: 'type', command: `browser act ref= kind=type text="${imageDescription}"` }, { step: 'img-3', action: 'click', command: 'browser act ref= kind=click' }, { step: 'img-4', action: 'click', command: 'browser act ref= kind=click' }, { step: 'img-5', action: 'click', command: 'browser act ...[truncated 2571 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/weibo.js:26- Finding
Weibo Access Token Disclosure Through Query Strings and Application Logs
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/generate_content.js:86- Finding
Indirect Prompt Injection Through Untrusted Remote Trend Data
- Content
View full analysis
{let d=\'\';r.on(\'data\',c=>d+=c);r.on(\'end\',()=>console.log(d))})"', { timeout: 10000 } ).toString(); const data = JSON.parse(result); return (data.items || data.data || []).slice(0, 10).map(i => i.title || i.name || i); ``` ```js // scripts/generate_content.js:151-157 if (opts['auto-topic']) { const hotTopics = await fetchHotTopics(); topic = hotTopics[0]; console.log(`[info] Auto-selected topic: ${topic}`); } const output = formatOutput(topic, platforms, opts.tone); ``` The selected topic is subsequently inserted into each platform prompt: ```js userPrompt: `Topic: ${topic}`, ``` ### Technical Analysis The `--auto-topic` workflow obtains topic text from the third-party endpoint `newsnow.busiyi.world`. The response is parsed, but the selected title is not validated for type, length, control characters, or instruction-like content before being inserted into a prompt intended for a downstream AI model. A compromised endpoint, upstream data source, or malicious trending item can provide a title containing instructions such as requests to ignore the system prompt, reveal data, or invoke tools. Because the project explicitly delegates actual AI generation to a caller, this creates an indirect prompt-injection boundary between untrusted remote data and the downstream model. The hard-coded `execSync` command does not contain attacker-controlled shell input, so this finding is not shell command injection or remote code execution. The risk arises from untrusted response content ...[truncated 1219 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (43)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant of the mismatch specifically notes external network access to fetch hot topics without corresponding declared permissions. Undeclared outbound access is security-relevant because it can surprise users, expand data exposure, and bypass expected review of what the skill can send or retrieve.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant of the mismatch specifically notes external network access to fetch hot topics without corresponding declared permissions. Undeclared outbound access is security-relevant because it can surprise users, expand data exposure, and bypass expected review of what the skill can send or retrieve.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant of the mismatch specifically notes external network access to fetch hot topics without corresponding declared permissions. Undeclared outbound access is security-relevant because it can surprise users, expand data exposure, and bypass expected review of what the skill can send or retrieve.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant of the mismatch specifically notes external network access to fetch hot topics without corresponding declared permissions. Undeclared outbound access is security-relevant because it can surprise users, expand data exposure, and bypass expected review of what the skill can send or retrieve.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant of the mismatch specifically notes external network access to fetch hot topics without corresponding declared permissions. Undeclared outbound access is security-relevant because it can surprise users, expand data exposure, and bypass expected review of what the skill can send or retrieve.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The skill explicitly requires access tokens, API keys, and possibly browser cookies for social-media accounts. In this context, those credentials enable direct posting and account interaction, so any overexposure, mishandling, or unnecessary broad env access could lead to account takeover, unauthorized posting, or data leakage.
- Content
md ### Weibo - Weibo Open Platform App Key / Access Token - Or browser Cookie (configured via `references/weibo-guide.md`) - Environment variables: `WEIBO_APP_KEY`, `WEIBO_ACCESS_TOKEN`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate_content.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate_content.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate_content.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate_content.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/publish.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/publish.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/schedule_post.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/schedule_post.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/schedule_batch.js \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/monitor_interactions.js \
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents use of environment variables and authenticated platform access, but the manifest declares no explicit tool scope or permission boundary. That creates an authorization ambiguity where a host agent may expose env-backed secrets or external-action capability without clear user-visible consent and least-privilege controls.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation keywords are broad enough to match many ordinary social-media requests, increasing the chance the skill is triggered in contexts where users did not intend account-affecting automation. In a skill capable of publishing, scheduling, or replying on external platforms, overbroad activation materially raises the risk of unintended high-impact actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation presents one-click and scheduled publishing flows without a prominent warning that these actions can make real posts or replies using user-linked accounts. In the context of social-platform automation, missing action warnings can lead to accidental public posting, reputational damage, spam, or policy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The browser automation flow includes direct steps to navigate to Weibo, enter content, and click publish without any warning, confirmation gate, or indication that the action posts publicly and may be difficult or impossible to undo fully once seen. In a social-media auto-publishing skill, this increases the risk of accidental public posting, unintended disclosure, reputational harm, and rapid propagation of unsafe or non-compliant content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction requires replies to use terms like "dear," "friend," and "sister," which imposes a particular language/register choice on all generated replies. This is a natural-language policy concern because the file does not offer the user a choice about whether to use these culturally specific forms of address.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The header comment describes this as an "AI Content Generator" that "Automatically generates social media content," which implies the script itself performs generation. However, the implementation only builds platform-specific prompt metadata, and an inline comment at L123 explicitly states that actual AI generation is handled elsewhere. This is an active contradiction between documentation and code behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Twitter prompt explicitly requires an 'English tweet within 280 characters.' This imposes a language constraint in natural-language instructions without offering the user a choice or documenting a justified region-specific requirement.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script spawns a shell-executed subprocess to perform network retrieval from a third-party endpoint for automatic topic selection. While the command string is static, this design expands the attack surface through shell/process invocation and imports untrusted remote content directly into the publishing pipeline, which is riskier in a social auto-publisher because fetched topics may drive downstream autogenerated posts without validation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes an assistant that can automatically generate and publish content, but this code path for Xiaohongshu does not publish anything itself. It only prints a command sequence and explicitly says publication requires manual execution in a browser environment, which materially falls short of the advertised automated publishing behavior.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/generate_content.js:89