ClawHub
Back to skill

Security audit

掘金工具

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Juejin helper, but its broad and mismatched activation instructions are risky given its login cookie, network, command, write, and publishing capabilities.

Review this carefully before installing. Use it only for explicit Juejin tasks, avoid shared or CI environments for login, delete the local cookie after use, and do not let the broad database/automation trigger language steer unrelated work into this skill. Pin Playwright in an isolated environment if you use the login feature.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:227
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 227
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
| Playwright | Browser automation | Required for login | `pip install playwright` |

Technical Analysis

The skill directs users or agents to install Playwright without specifying an exact version, lock file, or integrity hash. This makes dependency resolution mutable: the package and its transitive dependencies may differ depending on when installation occurs.

Although no malicious package is embedded in the reviewed project, an unpinned installation can expose the environment to a compromised upstream release, malicious dependency substitution, or unexpected behavior introduced by a future version. Installation may also invoke package build hooks or install dependencies that were not part of the original audit.

Attack Path

  1. A user activates the skill and follows its dependency setup instructions.
  2. The user or agent executes pip install playwright.
  3. pip resolves the latest available Playwright release and its dependency graph at installation time.
  4. If an upstream package, release artifact, build dependency, or distribution channel has been compromised, attacker-controlled components are downloaded.
  5. Malicious installation hooks or subsequently imported package code execute under the privileges of the user or agent running the skill.

Impact Assessment

Successful supply-chain exploitation could allow arbitrary code execution with the privileges of the account performing the installation or running the installed dependency. The affected scope may include accessible project files, user files, environment variables, browser session data, and authentication material such as the Juejin session cookie described elsewhere in the skill.

The project does not instruct installation with elevated privi ...[truncated 209 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin Playwright to an explicitly reviewed version, for example using an exact == constraint.
  • Maintain a lock file that records all direct and transitive dependency versions.
  • Require package hashes with pip install --require-hashes and a reviewed requirements file.
  • Use only trusted package indexes and explicitly configure the intended index to reduce dependency-confusion exposure.
  • Install dependencies inside an isolated virtual environment or disposable container using a non-privileged account.
  • Require explicit user approval before installing or upgrading third-party packages.
  • Add a documented dependency review and update process so pinned versions receive controlled security updates rather than silently tracking the latest release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The skill explicitly instructs the agent to run a destructive shell command, rm $HOME/.juejin_cookie.json, via exec. Even though the stated goal is cleanup, shell-based deletion with environment-variable expansion is a dangerous pattern in agent skills because it normalizes direct command execution against user environment state and can be misapplied, broadened, or trigger deletion in the wrong context.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
- **默认草稿**：发布默认只存草稿，避免误公开。
- **路径要显式**：用户必须显式给 md 路径，AI 不代填。
- **下载限 output**：下载结果只写 `./output/`，防越权。
- **Cookie 及时清**：用完执行 `rm $HOME/.juejin_cookie.json` 撤销登录态。
- **别在共享环境登录**：Cookie 明文存本地，避免共享/CI 环境。

## 常见问题

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill for broad efficiency, automation, batch processing, and workflow optimization, far beyond a Juejin reader/draft tool. Overbroad activation can cause the agent to invoke a skill with exec and write capabilities in unrelated contexts, increasing the chance of unnecessary command execution or external transmission.

Content

No source excerpt is available for this finding.

Scope Creep

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The front matter declares allowed-tools: read exec at L006, but the tools list at L019-L022 includes write. This is a permissions mismatch: the skill claims a narrower allowed-tool set than it actually declares elsewhere, while the documented behavior also includes writing output files and drafts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The technical summary states the skill supports 创建/查询/修改/删除 operation modes, but the surrounding documentation defines a much narrower scope: read-only ranking/article retrieval and Markdown draft publishing with strict default-draft behavior. Mentioning delete and generic modify operations materially overstates and contradicts the intended behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

bash
# 分类列表
GET https://api.juejin.cn/tag_api/v1/query_category_briefs

# 热门文章
POST https://api.juejin.cn/recommend_api/v1/article/recommend_cate_feed

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

bash
# 分类列表
GET https://api.juejin.cn/tag_api/v1/query_category_briefs

# 热门文章
POST https://api.juejin.cn/recommend_api/v1/article/recommend_cate_feed

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

bash
# 分类列表
GET https://api.juejin.cn/tag_api/v1/query_category_briefs

# 热门文章
POST https://api.juejin.cn/recommend_api/v1/article/recommend_cate_feed

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

bash
# 分类列表
GET https://api.juejin.cn/tag_api/v1/query_category_briefs

# 热门文章
POST https://api.juejin.cn/recommend_api/v1/article/recommend_cate_feed

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The 触发条件 section says the skill should be used for database operations, SQL queries, and data storage management, but the rest of the manifest describes a Juejin community tool for rankings, article download, and draft publishing. This is not merely incomplete wording; it actively points users to an unrelated intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger condition is both ambiguous and unrelated to the skill's purpose, saying it should activate for database/SQL tasks. A mismatched trigger can route unrelated requests into a skill that uses exec, network access, and file operations, which expands attack surface and may lead to unsafe or surprising behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description states '支持中文交互', and the capability note repeats '本技能涵盖 中文交互', but there is no indication that other languages are allowed or that Chinese is optional. This is a language/locale constraint expressed in natural language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The feature note lists Chinese interaction as part of the core capabilities, but does not indicate that the user can choose another language. This can be read as forcing a specific language/locale, which violates the policy unless optional or justified.

Content

No source excerpt is available for this finding.