juejin-publisher-pro

• Outcome: Review
• Latest audit: Sep 19, 2026 · 2:29 AM UTC
• Version: 1.0.9

Overview

This is a coherent publishing automation skill, but it stores live login cookies and can publish or schedule public posts without a final approval gate.

Install only if you intentionally want an agent/script to act on your live Juejin and Zhihu publishing accounts. Treat .juejin.env and .cdp-profile as credentials, keep them out of source control and shared folders, review posts before running publish or zhihu --auto, and avoid scheduled publishing unless you are comfortable with unattended public posting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

代码与声明存在明显范围不一致。当前片段的核心职责是“掘金定时发布调度器”，包括队列选择、去重、频率护栏和调用 publish 模块完成发布流程，这与声明中的“掘金自动发布”部分部分吻合。代码中也能看到 create_draft、upload_cover、publish_draft、column_id_from_meta 等调用，因此建稿、封面上传、挂专栏、发布这些步骤大体相符。 但声明还强调了多个更广泛能力：知乎 CDP 半自动、扫码登录抓 Cookie、审核状态自检、column-new/column-cover 专栏管理、以及真实账号逆向实测接口口径等；这些在给定代码片段中完全没有出现。相反，代码额外强调了 Windows 计划任务定时触发与自动删除计划任务，这属于声明未提及的重要行为。由于声明描述的是一个更大的一体化多平台工具，而实际代码片段只是其中“掘金定时发布驱动”的一部分，若按“描述是否准确代表该代码片段实际行为”来判断，应认定为不匹配。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

1. 把 `scripts/publish.py` 复制到写作项目根目录，`uv add websockets pillow`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README promotes fully automated draft creation, cover upload, column attachment, publishing, and status checks against a remote account without warning that the tool will perform state-changing actions on behalf of the user. Because this skill targets real platform accounts and reverse-engineered interfaces, lack of clear disclosure and guardrails makes accidental or unauthorized content modification more likely and increases the blast radius of misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly advertises automatic harvesting of login cookies and a device UUID with roughly one-year persistence, but gives no warning that these are sensitive authentication artifacts. In this context, the skill is designed to act on a user's live publishing account, so undocumented collection or storage of long-lived session material materially increases the risk of account takeover, session theft, and privacy exposure if the artifacts are logged, copied, or stored insecurely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises operational capabilities that imply access to environment data, local files, network calls, and shell execution, but it does not declare any tool scope or permissions boundary. That omission makes the skill harder to review safely and increases the chance an operator will run a high-impact automation with broader access than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs users to capture and store long-lived Juejin/Zhihu cookies and record a device UUID, yet it does not provide a clear security warning about the sensitivity of these credentials. If .juejin.env or related artifacts are exposed, an attacker could hijack the user's publishing account for a long period and impersonate the device context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill promotes fully automated draft creation and publishing to external platforms without a prominent warning about irreversible side effects on user accounts and public platform state. In practice, this can cause accidental publication, reputation damage, moderation penalties, or account restrictions, especially when combined with scheduled execution and no dry-run support.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions in comments are entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The provided policy explicitly calls out language or locale constraints as violations unless the skill offers a choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The user-facing natural language in the module docstring, usage text, and argument descriptions is entirely Chinese, which imposes a specific language/locale on operators of the skill. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/auto_publish.py (reported line 133)May include surrounding context.

python

log(f"队列 {len(queue)} 篇已全部发布")
    for tn in filter(None, args.task_names.split(",")):
        subprocess.run(["schtasks", "/Delete", "/TN", tn, "/F"], capture_output=True)
        log(f"已注销计划任务 {tn}")
    return 0

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing command descriptions are written exclusively in Chinese, and the workflow assumes Chinese platform interactions, labels, and prompts. There is no indication that the skill is region-specific by design or that users can opt into another language/locale.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish.py (reported line 456)May include surrounding context.

python

f"--user-data-dir={CDP_PROFILE}",
            "--no-first-run", "--no-default-browser-check", "--restore-last-session=false",
            url]
    subprocess.Popen(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    for _ in range(50):
        if cdp_alive():
            return

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The script builds a PowerShell -Command string using an interpolated file path, then executes it. Although the path is wrapped in single quotes, a crafted filename containing a single quote or PowerShell metacharacters can break out of the quoted context and inject arbitrary PowerShell commands, leading to local code execution when the clipboard fallback path is used.

Content

Scanner excerpt · scripts/publish.py (reported line 961)May include surrounding context.

python

content = f"# {post['title_zhihu']}\n\n{post['body']}"
    out.write_text(content, encoding="utf-8")
    try:
        subprocess.run(
            ["powershell", "-NoProfile", "-Command",
             f"Get-Content -LiteralPath '{out}' -Raw -Encoding UTF8 | Set-Clipboard"],
            check=True, creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The auto-publish path can perform irreversible publication actions without a final confirmation prompt at the moment of execution. In this skill's context, the tool holds live authenticated sessions for content platforms and can immediately publish content to public accounts, so accidental invocation, misuse by another local process, or operator error can cause reputational and business impact.

Content

No source excerpt is available for this finding.