Zhihu Yanghao Pkg

• Outcome: Review
• Latest audit: Sep 12, 2026 · 11:19 AM UTC
• Version: 1.3.6

Overview

This skill is a disclosed Zhihu account-growth automation, but it disables sandboxing and can perform public account actions while using anti-abuse evasion tactics.

Only install this if you intentionally want a privileged, logged-in Zhihu automation tool that may publish, like, follow, collect, comment, or edit through your account. Run it only in a disposable or tightly controlled environment, do not disable sandboxing on a machine with sensitive files, avoid using shared /tmp parameter files, review every generated post manually, and assume this workflow may violate Zhihu platform rules or put the account at risk.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:29
• Finding: Mandatory Disabling of WorkBuddy Sandbox Protections<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–33 **Vulnerability Type**: Security boundary bypass and excessive privilege **Risk Level**: High ### Vulnerable Instruction ```text dangerouslyDisableSandbox: true ``` The same section also instructs the operator to disable the top-level WorkBuddy sandbox security switch before executing the Skill's browser automation. ### Technical Analysis The Skill makes deactivation of two security controls a prerequisite: 1. The command-level sandbox is bypassed with `dangerouslyDisableSandbox: true`. 2. The global WorkBuddy sandbox security control is temporarily disabled. This expands the authority of all subsequently executed JavaScript. The project scripts can read arbitrary paths supplied through parameters, invoke browser automation under an authenticated session, and, in `verify_via_cli.js`, start a local child process. Without sandbox containment, a compromised script, substituted executable, or attacker-controlled input can affect any files and processes accessible to the current operating-system account. The instruction does not provide a restricted alternative, capability allowlist, or verification mechanism for the scripts that will run while containment is disabled. ### Attack Path 1. The operator installs or loads the Skill. 2. The Skill instructs the operator or Agent to disable WorkBuddy sandbox protections. 3. The operator runs one of the JavaScript files through `ego-browser nodejs`. 4. A replaced script, malicious executable resolved from `PATH`, or exploitable input path executes outside the normal sandbox. 5. The resulting code can access resources available to the current user and perform actions through the authenticated browser session. ### Impact Assessment An attacker who obtains control of code or inputs during execution could gain the privileges of the current operating-system user rather than the restricted capabilities normally granted to the Skill. The affec ...[truncated 171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not require users or Agents to disable the global WorkBuddy sandbox. - Grant only the specific browser IPC capability required by `ego-browser`. - Run filesystem parsing and browser automation in separate, least-privileged processes. - Deny child-process execution to publication scripts. - Require explicit per-run user approval if an unsandboxed operation is unavoidable. - Verify script integrity before any exceptional unsandboxed execution. - Fail closed when the required IPC capability is unavailable instead of automatically weakening security controls. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run_shift.js:29
• Finding: Predictable Shared Temporary Files Can Control Authenticated Publication<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run_shift.js`, lines 29–39, with the publication source used at line 238 **Vulnerability Type**: Unsafe temporary file and arbitrary local file input **Risk Level**: High ### Vulnerable Code Parameter loading: ```js const file = '/tmp/zhihu_shift_params.json' if (!p.shift) { try { const f = JSON.parse(fs.readFileSync(file, 'utf8')) for (const k of ['shift', 'configPath', 'qid', 'content', 'contentFile', 'kw', 'limit', 'commentText', 'deep']) { if (f[k] != null && p[k] == null) p[k] = f[k] } cliLog('PARAMS_FROM_FILE: ' + file) } catch (e) { cliLog('PARAMS_FILE_MISSING: ' + file + ' (' + e.message + ')') } } ``` The attacker-controlled path is later read as publication content: ```js let content = P.content || '' if (P.contentFile) content = fs.readFileSync(P.contentFile, 'utf8') ``` Equivalent predictable control files are also used by: ```js const file = '/tmp/zhihu_moment_params.json' const f = JSON.parse(fs.readFileSync(file, 'utf8')) ``` and: ```js const file = '/tmp/zhihu_edit_params.json' const f = JSON.parse(fs.readFileSync(file, 'utf8')) ``` ### Technical Analysis The scripts trust fixed, system-wide paths under `/tmp` without validating: - File ownership - File permissions - Symbolic-link status - File type - Creation provenance - Whether the content path is inside an approved workspace The shift parameter file can specify `contentFile`, `qid`, `configPath`, interaction settings, and execution mode. The selected `contentFile` is read without path restrictions and can then be pasted into a logged-in Zhihu editor and published. The moment script defaults to dry-run, but a temporary parameter file can explicitly specify `dryRun: false`. The answer orchestrator does not use a publication dry-run flag. Its word-count check limits which files can be published but does not prevent disclosure of a readable file whose length is within the configured range. ...[truncated 1318 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store control files in a user-private directory created with mode `0700`. - Create each parameter file atomically with mode `0600` and a cryptographically random filename. - Open files with protections against symbolic-link traversal, and validate ownership and regular-file status with `lstat` or `fstat`. - Reject configuration and content paths outside an explicitly approved workspace. - Canonicalize paths with `realpath` before applying allowlist checks. - Validate all IDs and configuration fields against strict schemas. - Add a mandatory draft-only default to `run_shift.js`. - Display the destination, action, content source, and content preview, then require immediate user confirmation before every public action. - Remove stale parameter files after use without following symbolic links. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/verify_via_cli.js:24
• Finding: PATH-Based zhihu-cli Resolution Allows Executable Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `scripts/verify_via_cli.js`, lines 24–34 **Vulnerability Type**: Untrusted executable resolution **Risk Level**: High ### Vulnerable Code ```js // Locate zhihu-cli: prefer PATH, then fall back to the default macOS installation path. let cli = 'zhihu-cli' try { cp.execSync('command -v zhihu-cli', { stdio: 'ignore' }) } catch (e) { const fallback = '/Users/songhonglei/Library/Application Support/zhihu-cli/current/zhihu-cli' if (fs.existsSync(fallback)) cli = fallback else { cliLog('ERROR: zhihu-cli not found in PATH nor at ' + fallback) return } } out = cp.execFileSync( cli, ['me', 'contents', '--type', type, '--limit', '20'], { encoding: 'utf8' } ) ``` ### Technical Analysis When `command -v zhihu-cli` succeeds, the script retains the bare executable name `zhihu-cli`. `execFileSync` then performs normal `PATH` lookup. The implementation does not verify: - The canonical executable path - File ownership or permissions - Whether the containing directory is writable by an untrusted party - Whether the executable is a symbolic link - Package signature, hash, or expected version Although `execFileSync` uses an argument array and therefore avoids direct shell injection for the final invocation, it still executes whichever program appears first in `PATH`. The preceding `execSync` shell probe does not make that executable trustworthy. The mandatory sandbox deactivation documented by the project increases the impact of executable substitution. ### Attack Path 1. An attacker places a malicious executable named `zhihu-cli` in a directory. 2. That directory is added before the legitimate installation directory in the victim's `PATH`. 3. The user runs `scripts/verify_via_cli.js`. 4. `command -v zhihu-cli` succeeds. 5. `execFileSync('zhihu-cli', ...)` resolves and executes the attacker's program. 6. The malicious process runs with the privileges and environment of the user executing the Skil ...[truncated 329 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require an explicitly configured absolute path to `zhihu-cli`. - Resolve the path with `realpath` and compare it against an allowlist of approved installation locations. - Reject symbolic links and executables located in user-writable or globally writable directories. - Verify file ownership, executable permissions, and package signature or a pinned cryptographic hash. - Remove the shell-based `command -v` probe. - Execute the verifier inside a restricted sandbox with a minimal environment and a fixed `PATH`. - Avoid hardcoding a developer-specific home directory; use a validated installation discovery mechanism. ]]>

other

Warning

• Location: scripts/like_top5.js:43
• Finding: Automated Engagement Uses Deliberate Anti-Abuse Evasion Techniques<![CDATA[ ## Vulnerability Details **File Location**: `scripts/like_top5.js`, lines 43–73 **Vulnerability Type**: Platform anti-abuse evasion and engagement manipulation **Risk Level**: Medium ### Vulnerable Code ```js const count = n === 0 ? 0 : (minC + Math.floor(Math.random() * (maxC - minC + 1))) const shuffled = before.slice() for (let i = shuffled.length - 1; i > 0; i--) { const j = Math.floor(Math.random() * (i + 1)) const t = shuffled[i] shuffled[i] = shuffled[j] shuffled[j] = t } const picks = shuffled.slice(0, count) for (let i = 0; i < picks.length; i++) { const itemId = picks[i].itemId // The selected answer's approval control is clicked here. results.push({ itemId: itemId, after: clicked }) if (i < picks.length - 1) { const gap = 35 + Math.floor(Math.random() * 45) await wait(gap) } } ``` The behavior is reinforced by the documented operating policy, which directs the automation to mix actions into natural browsing traffic, randomize intervals, and avoid recognizable account behavior fingerprints. The default configuration enables three daily answer shifts and randomized approval actions in each shift. Midday and evening shifts also enable collection and question following. ### Technical Analysis The random count, shuffled target order, simulated reading, randomized delay, and browsing-camouflage instructions are not ordinary rate limiting. They are explicitly intended to make automation appear human and reduce detection by Zhihu's behavioral controls. The scripts automate ranking and engagement signals, including approvals, collections, follows, comments, and publication. This can create inauthentic activity and expose the account to platform enforcement. The project describes prior temporary restrictions and adjusts timing and behavioral patterns in response. ### Attack Path 1. The user copies the example configuration without disabling the default shifts. 2. The orchestrator selects a trending question. ...[truncated 730 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove automated approval, collection, follow, and comment actions. - Remove random timing, target shuffling, simulated reading, and browsing-camouflage logic intended to evade behavioral detection. - Restrict the Skill to drafting, analytics, and user-reviewed recommendations. - Default all public interactions and publication actions to disabled. - Require a separate, immediate user confirmation for every individual public action. - Enforce platform-approved APIs and published automation policies. - Add clear daily limits that cannot be increased merely through configuration. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/edit_answer.js:67
• Finding: Unvalidated answerUrl Permits Navigation Outside the Intended Zhihu Origin<![CDATA[ ## Vulnerability Details **File Location**: `scripts/edit_answer.js`, lines 67–70 **Vulnerability Type**: Missing URL origin validation **Risk Level**: Medium ### Vulnerable Code ```js const url = P.answerUrl || ( P.qid ? ('https://www.zhihu.com/question/' + P.qid + '/answer/' + P.aid) : ('https://www.zhihu.com/answer/' + P.aid) ) const space = 'zhihu-edit-' + P.aid const task = await useOrCreateTaskSpace(space) await openOrReuseTab(url, { wait: true, timeout: 25 }) ``` After navigation, the script searches for generic button text, clicks matching controls, clears a content-editable element, inserts content, and may click submission or confirmation controls. ### Technical Analysis The optional `answerUrl` parameter is accepted without parsing or validating its scheme, hostname, port, or path. It can be supplied through the predictable `/tmp/zhihu_edit_params.json` control file. This breaks the script's claimed Zhihu-only origin boundary. A tampered parameter file can direct the authenticated browser automation to an arbitrary origin. The script then applies generic DOM queries and button-label matching to that page. Browser same-origin protections limit direct cross-origin data access, but they do not prevent the automation tool from opening the attacker-selected page and executing DOM actions in that page's active context. ### Attack Path 1. An attacker creates or alters `/tmp/zhihu_edit_params.json`. 2. The attacker supplies a valid-looking answer ID, content, and an arbitrary URL in `answerUrl`. 3. The user starts `scripts/edit_answer.js`. 4. The script opens the attacker-controlled origin. 5. The page presents elements matching the generic editor and button selectors expected by the script. 6. The automation inserts content and may click matching submission or confirmation controls. 7. Actions occur outside the intended Zhihu scope. ### Impact Assessment Exploitation can cause unintended browser actions on attacker-controlled ...[truncated 337 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Parse the supplied value with `new URL()`. - Require the `https:` scheme. - Allowlist the exact intended Zhihu hostname. - Reject credentials, non-default ports, fragments, and unexpected query parameters. - Validate the pathname against the expected answer URL patterns. - Require `aid` and `qid` to contain digits only. - Re-check the active page origin and path immediately before every DOM modification or click. - Prefer constructing the URL exclusively from validated IDs and remove arbitrary `answerUrl` support. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Credential Access

High

• Category: Privilege Escalation

Content

- 已安装 ego-browser（ego lite 浏览器 + CLI），知乎账号已登录（ego-browser 继承系统登录态）。
- ⚠️ 运行 `ego-browser nodejs` 需关闭 WorkBuddy 沙箱（详见 SKILL.md「前置依赖」）。
- （可选）zhihu-cli + 知乎开放平台 Access Secret，用于热榜扫描与发布结果权威校验。

## 安装

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch is more security-relevant because the skill claims a browser-driven workflow while also invoking a local external CLI and reading temp files/environment data, which materially expands the trust and attack surface beyond what users may expect. Hidden or underdeclared local process execution can lead to unintended access to local state and credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch is more security-relevant because the skill claims a browser-driven workflow while also invoking a local external CLI and reading temp files/environment data, which materially expands the trust and attack surface beyond what users may expect. Hidden or underdeclared local process execution can lead to unintended access to local state and credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch is more security-relevant because the skill claims a browser-driven workflow while also invoking a local external CLI and reading temp files/environment data, which materially expands the trust and attack surface beyond what users may expect. Hidden or underdeclared local process execution can lead to unintended access to local state and credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: This mismatch is more security-relevant because the skill claims a browser-driven workflow while also invoking a local external CLI and reading temp files/environment data, which materially expands the trust and attack surface beyond what users may expect. Hidden or underdeclared local process execution can lead to unintended access to local state and credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: This mismatch is more security-relevant because the skill claims a browser-driven workflow while also invoking a local external CLI and reading temp files/environment data, which materially expands the trust and attack surface beyond what users may expect. Hidden or underdeclared local process execution can lead to unintended access to local state and credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch is more security-relevant because the skill claims a browser-driven workflow while also invoking a local external CLI and reading temp files/environment data, which materially expands the trust and attack surface beyond what users may expect. Hidden or underdeclared local process execution can lead to unintended access to local state and credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This mismatch is more security-relevant because the skill claims a browser-driven workflow while also invoking a local external CLI and reading temp files/environment data, which materially expands the trust and attack surface beyond what users may expect. Hidden or underdeclared local process execution can lead to unintended access to local state and credentials.

Ae1

High

• Category: analysis-evasion

Content

3. **配置话题与班次**（用户自定义）：复制 `config.example.json` 为 `config.json`，按你的账号/话题/互动修改（详见 references/workflow.md 的「配置 config.json」）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

3. **配置话题与班次**（用户自定义）：复制 `config.example.json` 为 `config.json`，按你的账号/话题/互动修改（详见 references/workflow.md 的「配置 config.json」）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

3. **配置话题与班次**（用户自定义）：复制 `config.example.json` 为 `config.json`，按你的账号/话题/互动修改（详见 references/workflow.md 的「配置 config.json」）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

High

• Confidence: 90% confidence
• Finding: The instruction explicitly requires using the 'text-humanize skill 中文模式', which imposes a specific language/locale behavior. The file does not indicate that the user can choose another language or that this restriction is optional or justified as a region-specific constraint.

Ae1

High

• Category: analysis-evasion

Content

DOM 选择器、按钮点击要点见 references/selectors.md。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

DOM 选择器、按钮点击要点见 references/selectors.md。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

2. **启动器必须接管 Promise**（`SKILL.md` 运行模式）：原示例 `(function(){ eval(src); })()` 中，`(async () => {...})()` 返回的 Promise 无人接管，运行时判定同步代码已跑完即结束会话，异步流程被整体丢弃——症状是「跑了三四分钟、零输

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ssd 4

High

• Confidence: 99% confidence
• Finding: This document explicitly operationalizes evasion of Zhihu's anti-abuse and risk-control systems for automated account nurturing, including timing thresholds, activity pacing, fingerprint-avoidance guidance, and recovery tactics after enforcement. The skill context makes this more dangerous, not less, because it is embedded in an automation workflow designed to publish, engage, and blend bot actions into normal traffic while minimizing detection.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow explicitly instructs operators to run `ego-browser` with `dangerouslyDisableSandbox: true` and to temporarily disable the platform's sandbox security controls. That removes a primary isolation boundary for browser automation handling untrusted web content, so any malicious page, compromised dependency, or browser exploit could gain broader access to the host environment.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This script automates visible Zhihu account actions at scale, including publishing answers, liking, following, collecting, and commenting, with no explicit runtime user confirmation before irreversible platform actions occur. In the context of an account-nurturing/growth automation skill explicitly designed to simulate natural engagement and evade platform risk controls, this enables deceptive inauthentic activity, accidental mass posting, and potential account compromise or policy abuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README explicitly notes that moment posting defaults to dry-run, but the primary 'run one shift' workflow is presented as a normal quick-start command even though it performs real platform actions: liking content, generating an answer, publishing it, and verifying the result. That asymmetry can mislead users into triggering irreversible actions on a logged-in Zhihu account without clear informed consent, which is especially risky in an automation skill designed to simulate organic engagement.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use powerful local/browser capabilities, environment variables, external CLI access, and to disable the sandbox, yet it declares no explicit tool scope or permission boundaries. That makes the skill far more dangerous to invoke because an orchestrator or reviewer cannot easily constrain what local/network actions it may perform.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: An overly broad manifest description increases the chance that the skill is selected for ambiguous user prompts, even when the user did not clearly request account automation. In the context of a social-platform automation skill, unintended activation can lead to unwanted account actions and platform-policy abuse.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The invocation phrases are broad enough that the skill may trigger on loosely related requests such as browsing, posting, engagement, or growth activities. Because this skill performs account actions and recommends privileged browser automation, accidental invocation could cause unwanted posting or interactions on a real user account.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The configuration values and writing guidance are entirely specified in Chinese, including the account identifier example and the required content perspective, with no indication that the skill supports other languages or that the locale is an intentional regional-only constraint. This creates a natural-language locale policy concern because it effectively mandates a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The title explicitly labels the skill guidance as Chinese-language content, and the entire document is written only in Chinese with no indication that users may choose another language or locale. This creates a natural-language policy concern because the skill appears to impose a specific language by default rather than offering an opt-in or documenting a justified region-specific limitation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The document is presented entirely in Chinese and is explicitly scoped to a Zhihu account workflow, with no indication that users may choose another language or locale. This constitutes a language/locale constraint that is not offered as an opt-in choice or otherwise justified in the file.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/verify_via_cli.js:26