T09 · Insecure Skill Coding Practices
Error
- Location
zhihu_crawl.py:102- Finding
Authenticated Session Cookie Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Zhihu Keyword Content Search
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Zhihu crawler, but it asks users to pass a full logged-in browser cookie on the command line without adequate warnings or safer handling.
Install only if you are comfortable giving the tool an active Zhihu login cookie and storing scraped answer data locally. Prefer running it in a dedicated environment, avoid pasting real cookies into shared terminals or logs, clear shell history after use, and revoke or refresh the Zhihu session afterward.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
README.md:7- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and verify cryptographic hashes for the complete dependency set. 3. Install with hash enforcement, such as: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Include and pin transitive dependencies through a lock-file workflow. 5. Document the expected trusted package index and avoid untrusted mirrors. 6. Periodically review pinned versions for security advisories and update them through a controlled process. 7. Run the crawler in a dedicated virtual environment under a non-privileged user account. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs users to copy and supply their full authenticated Zhihu cookie, which is effectively a bearer credential that can enable account access, session hijacking, and exposure of private account data if logged, stored, or reused by the agent. The absence of any warning, minimization, or safer authentication method makes credential compromise substantially more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly instructs users to extract and pass their full authenticated Zhihu cookie into the tool, but it does not warn that this cookie is effectively a live session credential that can be abused if logged, shared, leaked via shell history, or exposed to other local processes. In the context of a crawler skill, this normalizes unsafe handling of authentication secrets and increases the risk of account compromise or unauthorized access to the user's Zhihu session.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Telling users to copy the entire authenticated Zhihu cookie from browser developer tools and supply it to the program encourages insecure secret extraction and handling. Because the cookie represents an active logged-in session, disclosure through documentation, terminal history, screenshots, process listings, or saved scripts can let others impersonate the user and access their account context.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill clearly directs the agent/user to perform network access and write scraped data to disk, but it does not declare any explicit tool scope or permissions. This creates an authorization gap where a caller may not realize the skill can exfiltrate data from the network and persist sensitive content locally, increasing the chance of misuse or unsafe execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill normalizes bulk scraping and saving of Zhihu questions and answers into JSON and merged text files without any guidance on privacy, copyright, retention, or downstream handling. Persisting scraped content to disk and combining it into AI-ready text increases the chance of over-collection, accidental redistribution, and exposure of personal or sensitive information contained in the source material.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script requires a live Zhihu login Cookie and automatically sends it in HTTP headers to Zhihu APIs, but it provides no warning about handling sensitive session credentials, storage risks, shell history exposure, or account/privacy implications. In a skill context, users may paste reusable authenticated cookies into command lines or agent workflows, increasing the chance of credential leakage through logs, process listings, transcripts, or accidental reuse beyond the user's expectations.
- Content
Static analysis
No suspicious patterns detected.