Security audit

ZSXQ Digest

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with a private Knowledge Planet digest workflow, but it handles live session cookies in ways that could leak account access if misused or logged.

Review before installing. This skill should only be used in a private local environment, with a dedicated low-risk ZSXQ session if possible. Do not run probe or custom API-base options with untrusted URLs, do not share tool logs, and treat `state/session.token.json` and `state/captured-cookies.json` as account-access credentials.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/collect_from_session.py:66
Finding: Authenticated session cookie can be transmitted to arbitrary caller-controlled destinations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capture_browser_cookies.js:72
Finding: Browser-captured authentication cookies are exposed through stdout and insufficiently protected files
Content: View full analysis
cookie && cookie.name === args.cookieName); } const payload = { status: 'ok', count: cookies.length, ws_url: args.wsUrl, urls: args.urls, cookies, }; const text = JSON.stringify(payload, null, 2); if (args.output) { fs.mkdirSync(path.dirname(args.output), { recursive: true }); fs.writeFileSync(args.output, text + '\n', 'utf8'); } console.log(text); ``` The normal wrapper supplies filters but persists the raw cookie artifact and retains the secret-bearing capture payload: ```python capture_cmd = [ "node", str(CAPTURE), "--ws-url", capture_ws_url, "--cookie-name", args.cookie_name, "--output", str(args.cookies_file), ] capture_urls = args.capture_url or list(DEFAULT_CAPTURE_URLS) for url in capture_urls: capture_cmd += ["--url", url] capture_payload = run_json(capture_cmd) ``` ```python return { "status": "ok", "capture": capture_payload, "finalize": finalize_payload, "verify": verify_payload, "verification_warning": verification_warning, "capture_ws_url": capture_ws_url, "cookies_file": str(args.cookies_file), "token_file": str(args.token_file), } ``` ### Technical Analysis The CDP helper places complete cookie objects, including their secret values, into a JSON payload. It then: - Writes the plaintext payload with `fs.writeFileSync()` without explicitly setting restrictive permissions. - Prints the complete p ...[truncated 2492 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (47)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: zsxq-digest description: Summarize new updates from followed Knowledge Planet (知识星球 / zsxq.com) circles and produce a daily triage digest that helps decide whether to click through and read in depth. Use when the user wants: (1) a daily summary of what changed across followed planets, (2) extraction of new posts/topics from Knowledge Planet through a locally stored private access token/session file, (3) browser-assisted fallback extraction when token mode is unavailable or needs verification, (4) prioritization of which circles or posts are worth opening, or (5) a reusable workflow for private-membership content where secrets must stay local and never be published with the skill. --- # ZSXQ Digest

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
- Never hardcode personal circle names or secrets into `SKILL.md`, scripts, or references unless the user explicitly wants a private fork.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This script explicitly queries browser cookies via the Chrome DevTools Protocol and then prints them to stdout and optionally writes them to disk, but it provides no user-facing warning, consent prompt, masking, or restriction on what cookies may be collected. Browser cookies often contain session tokens or authentication state, so collecting and persisting them can enable account takeover or lateral movement if the output is exposed, logged, or reused.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Probe mode accepts an arbitrary --url and unconditionally attaches the session cookie in the Cookie header. That means a user can be induced to send their authenticated session token to any attacker-controlled domain, causing direct credential exfiltration and possible account takeover or unauthorized API access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The sample output fixes the digest title to Chinese (知识星球信息流摘要) and the surrounding output guidance prefers Chinese field labels such as 摘要时间跨度 and 作者, but the document does not offer the user a language choice or state that Chinese output is optional. This creates a natural-language locale policy issue because it implicitly forces a specific language in the user-facing result.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The flow tells the agent to send a visible login QR or prompt to the user in chat without warning that chat systems may retain images, expose them to other viewers, or create an authentication replay/social-engineering risk. For authentication material, lack of privacy guidance is a meaningful security weakness even if the QR is short-lived.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown describes collecting cookies and writing a reusable session token but does not provide a prominent warning that these artifacts are sensitive credentials equivalent to account access. This omission increases the chance that operators will store, transmit, or troubleshoot with those files unsafely, leading to credential compromise and account takeover.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document explicitly proposes connecting to a browser via CDP, extracting cookies from an already logged-in session, and converting them into a reusable local token file. That is credential harvesting behavior by design, and in a public skill with no clear manifest-scoped justification or strong consent boundaries, it creates a serious risk of unauthorized account access, token theft, and persistence beyond the original browser session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow explicitly instructs operators to extract data from a logged-in browser session and save the resulting page-derived content to a local JSON file, but it provides no guidance on minimizing sensitive data, securing storage, redacting private content, or handling retention/deletion. In the context of a private or authenticated feed, this creates a real risk of unintentionally storing and redistributing sensitive user content outside the browser's access controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: No manifest is available, so there is no stated purpose that justifies handling private session tokens or instructing users to extract authentication cookies from browser developer tools. This file specifies obtaining and storing a reusable zsxq_access_token, which is a sensitive capability beyond a purpose-neutral baseline.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The example configuration uses Chinese planet names as the only illustrated content, and elsewhere the plan centers on a specific Chinese service without explicitly stating that the skill is intended only for that locale or that language is configurable. This can amount to a locale/language assumption in natural-language documentation without clear opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The planned collect_from_session.py component performs token validation and accesses /v2/groups and /v2/groups/{group_id}/topics, which enables direct retrieval of account-associated content. Without a manifest describing the skill as an authenticated Knowledge Planet digest tool, this capability is context-inappropriate relative to an unknown-purpose skill.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/github-survey.md (reported line 67)May include surrounding context.
md
- Keep `zsxq-digest` focused on lightweight summarization, bounded state, and public-friendly distribution. ### 4. RSSHub proves a narrow route can work, but it is API-coupled RSSHub's ZSXQ route uses a token and fetches group topics through API paths under `https://api.zsxq.com/v2`. It is elegant, but tightly tied to the platform's API behavior. **Takeaway for this skill:**

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/final-implementation-plan.md (reported line 106)May include surrounding context.
md
### Extraction guidance - Document a simple user path such as: browser devtools -> Application/Storage or Network -> Cookies -> copy `zsxq_access_token` -> paste into `state/session.token.json`. - Keep the README explanation beginner-friendly. - Never ask the user to paste the token into public chat if a local file path will do. ### Requirements - Never commit these files.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/runtime-modes.md (reported line 55)May include surrounding context.
md
### Extraction guidance - Document a simple user path such as: browser devtools -> Application/Storage or Network -> Cookies -> copy `zsxq_access_token` -> paste into `state/session.token.json`. - Keep the README explanation beginner-friendly. - Never ask the user to paste the token into public chat if a local file path will do. ### Requirements - Never commit these files.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The recommended response template is written entirely in Chinese and presented as the default output format. This imposes a specific language on users without indicating a choice, opt-in, or a clear region-specific requirement, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide explicitly instructs users to extract a live authentication cookie from browser storage or network traffic and save it into a local JSON file, with optional User-Agent capture to improve replayability. While it includes 'do not commit' advice, it normalizes manual credential harvesting and local token storage without stronger guidance such as restricting file permissions, minimizing retention, redacting examples, warning that the token grants account access, or preferring safer auth flows; this increases the risk of credential leakage or misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document's natural-language instructions are entirely in Chinese and directly specify the skill's output framing and presentation, implying a fixed Chinese-language experience. There is no indication that users may choose another language or that the Chinese-only constraint is required for a region-specific compliance or product reason.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code extracts a reusable authentication cookie and persists its raw value to a local JSON file on disk. Even though it includes a note saying 'stored locally only; do not commit', there is no technical protection such as file permission hardening, encryption, secure storage, or confirmation gating, so any local user, malware, backup process, or accidental source-control inclusion could expose the token and enable account/session hijacking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This script enumerates visible links and extracts page title, URL, author names, timestamps, engagement counts, and content previews from the current page, then returns them in a structured object. In an agent skill context, that is page scraping of potentially sensitive user-visible content without any in-script consent gate, minimization control, or disclosure, which creates a privacy and data-handling risk if the data is transmitted or stored elsewhere.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This script emits user-facing natural-language strings in Chinese, such as the fallback title （无标题）, and similar fixed Chinese messages appear throughout classification and CLI defaults. Because the file provides no opt-in or locale selection, it enforces a specific language, which matches the language/locale policy-violation category.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code performs HTTP requests using a session cookie in the Cookie header, which transmits credentials and may retrieve user-associated data from the remote service. While the script's purpose is collection, there is no confirmation prompt, warning print, or explanatory comment/docstring near the network operation to disclose that authenticated requests will be sent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings that force the generated digest into Chinese, including action labels and later defaults/headings, with no option for the user to select another language. That is a language/locale policy concern under SQP-3 because the skill imposes a specific language rather than offering a choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/export_groups_config.py (reported line 22)May include surrounding context.
python
def run_json(cmd: List[str]) -> dict: proc = subprocess.run(cmd, text=True, capture_output=True) payload = None for candidate in (proc.stdout, proc.stderr): if not candidate or not candidate.strip():

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/run_browser_bootstrap.py (reported line 39)May include surrounding context.
python
def run_json(cmd: List[str]) -> dict: proc = subprocess.run(cmd, text=True, capture_output=True) payload = None for candidate in (proc.stdout, proc.stderr): if not candidate or not candidate.strip():