account-pool-manager

• Outcome: Review
• Latest audit: Aug 15, 2026 · 4:30 AM UTC
• Version: 1.0.2

Overview

This skill is not clearly malicious, but it manages many account cookies and publishing rotation with under-scoped safeguards users should review before installing.

Install only if you intend to manage a multi-account publishing pool and are comfortable with local scripts reading cookie files, writing account state, and optionally sending cookies to platform verification APIs. Prefer using tenant-specific checks, avoid running broad verification across all cookies, and require input validation before allowing untrusted account registration data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill's stated purpose is account-pool management, but the documentation expands into real publishing workflows, anti-risk posting intervals, and integration with automated publishing. This scope creep increases the chance that a seemingly administrative skill will be used to facilitate multi-account automated content operations, reducing oversight and making misuse or policy-violating automation easier.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: Granting `exec` to a skill whose core function is managing account metadata and checking cookie health is broader than necessary as documented. Overbroad execution capability raises the blast radius if the skill is misused, modified, or chained with untrusted inputs, because arbitrary local commands or scripts could be launched under the guise of account maintenance.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: register_account accepts an arbitrary department value and unconditionally creates BASE_DIR / department with mkdir(parents=True), instead of restricting values to the intended fixed set. If an attacker can invoke this script with crafted input such as path traversal segments, they may create directories and write account JSON files outside the intended account-pool hierarchy, causing unauthorized file creation or corruption of adjacent application data.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill describes file-writing and `exec`-based workflows that create directories, update account state, and run scripts, but it does not warn users about filesystem changes, credential/cookie sensitivity, or process execution impact. Lack of transparency can lead operators to trigger sensitive actions without informed consent, increasing the risk of accidental credential exposure or unintended system modifications.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: When verification is enabled, the code constructs a Cookie header from local cookie files and sends it to third-party platform APIs to test login validity. Even if this is functionally intended, cookies are highly sensitive credentials, and transmitting them off-box without explicit consent, clear audit controls, or scoping increases the chance of account takeover if logs, proxies, or misdirected requests expose them.

External Transmission

Medium

• Category: Data Exfiltration

Content

"segmentfault","bilibili","sohu"}
# API验证策略（来源: content_stats_collector.py已验证的API）
API_VERIFY = {
    "bilibili": ("https://api.bilibili.com/x/web-interface/nav",
                 lambda d: d.get("data",{}).get("isLogin") is True),
    "zhihu": ("https://www.zhihu.com/api/v4/me",
              lambda d: "id" in d and d.get("id") is not None),

• Confidence: 82% confidence
• Finding: The code is designed to contact external APIs and, during verification, attaches a Cookie header derived from stored authentication material. In the context of an account-pool manager, this increases sensitivity because the system handles many accounts and tenants, so a mistake, interception point, or unintended invocation can expose reusable session credentials at scale.

External Transmission

Medium

• Category: Data Exfiltration

Content

lambda d: d.get("data",{}).get("isLogin") is True),
    "zhihu": ("https://www.zhihu.com/api/v4/me",
              lambda d: "id" in d and d.get("id") is not None),
    "juejin": ("https://api.juejin.cn/user_api/v1/user/get",
               lambda d: d.get("data",{}).get("user_id") is not None),
}
MCP_VERIFY = {"xianyu": ("fishclaw-mcp", "check_cookie_validity")}

• Confidence: 82% confidence
• Finding: This external transmission path is another instance of remote cookie validation against a third-party API. Because the script manages multi-account cookies and can scan broad directories, the operational context amplifies privacy and credential-exposure risk if verification is run broadly or without tenant safeguards.

Static analysis

No suspicious patterns detected.