微博内容保存

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a Weibo-archiving purpose, but it needs review because it can automatically scrape pages, persist content, upload to third-party services, and explicitly works around network blocking.

Install only if you are comfortable with a skill that uses browser automation to read Weibo pages, saves copied content and images locally, and may upload them to Feishu or Notion when credentials are configured. Prefer local-only use, validate Weibo URLs before running it, avoid using a browser profile with sensitive sessions, and do not enable external sync unless you intend to transmit the archived content there.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:41

Finding

Shell Command Injection Through User-Controlled Short URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41-43
Vulnerability Type: OS command injection
Risk Level: High

Vulnerable code snippet:

bash

curl -sIL "https://t.cn/xxx" 2>&1 | grep -i "^location:" | tail -1

Technical Analysis

The workflow instructs the agent to process a user-supplied Weibo short URL by substituting it into a shell command. It does not require structured URL parsing, strict hostname validation, path validation, or shell-safe argument handling before execution.

Enclosing an interpolated value in double quotes does not neutralize shell command substitutions such as $(...) or backticks. If the agent replaces the example URL with the user's input verbatim and invokes a shell, shell metacharacters embedded in that value may be evaluated before curl executes.

The issue arises from passing untrusted input through a shell command rather than using an HTTP client or process API that supplies the URL as a discrete argument without shell interpretation.

Attack Path

1. An attacker sends a purported t.cn URL containing shell command-substitution syntax.
2. The skill recognizes the input as a short Weibo link and enters the link-expansion step.
3. The agent substitutes the untrusted value into the documented curl command.
4. The command is executed through a shell.
5. The shell evaluates the injected substitution before invoking curl.
6. The attacker's command runs with the same operating-system privileges and filesystem access as the agent process.

Impact Assessment

Successful exploitation could provide arbitrary command execution under the agent's local account. Depending on that account's permissions, an attacker could read or modify Obsidian files, access locally available configuration and API credentials, alter user data, initiate outbound connections, or execute additional local programs.

The vulnerability does not itself demonstrate pri ...[truncated 171 chars]

Remediation

View remediation

Remediation Suggestions

• Do not interpolate user-supplied URLs into shell command strings.
• Prefer a structured HTTP client or URL-expansion tool that does not invoke a shell.
• If a process must be launched, pass arguments as an array and disable shell execution, such as using a subprocess API without shell=True.
• Parse the input with a standards-compliant URL parser before making the request.
• Allow only the https scheme and the exact hostname t.cn.
• Reject user information, unexpected ports, fragments, control characters, whitespace, and paths that do not match the expected short-link format.
• Validate every redirect target and impose a small redirect limit.
• Reject redirects to loopback, link-local, private, reserved, or otherwise prohibited network addresses.
• Add tests using command-substitution syntax, backticks, newlines, quotes, and shell metacharacters to confirm that input is never interpreted by a shell.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69

Finding

Browser-Based Bypass of SSRF Network Restrictions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69-81
Vulnerability Type: SSRF-control bypass through an alternate browser request channel
Risk Level: Medium

Vulnerable instruction excerpt, translated into English:

text

Problem: Sinaimg domains resolve to private 198.18.x.x addresses and are
blocked by the SSRF policy, so they cannot be downloaded directly.

Solution:
1. When opening the Weibo post with the browser, extract all image URLs
   through CDP evaluate.
2. Iterate over the image URLs and use browser evaluate to request each
   image blob inside the page.
3. Alternatively, extract blob URLs from image elements already loaded
   in the browser page.

Technical Analysis

The skill explicitly identifies that direct image retrieval is denied by an SSRF policy and then instructs the agent to use browser-side evaluation as an alternate request channel. This changes the request mechanism without preserving the security checks that caused the original request to be blocked.

The instructions require extraction and retrieval of all image URLs but do not require validation of the URL scheme, destination hostname, port, redirect chain, or resolved IP address. An image URL embedded in remotely controlled post content, or a permitted URL that redirects, could therefore cause the browser to contact a destination that the standard downloader would reject.

Use of an existing browser profile increases the potential exposure because requests can occur within a stateful browser context. Depending on browser policy and destination behavior, that context may include active authentication state or access to resources reachable from the browser's network environment.

Attack Path

1. An attacker publishes or supplies a Weibo post containing an attacker-controlled image URL, or a URL whose redirect behavior is attacker-controlled.
2. A user asks the agent to save that post.
3. Direct retr ...[truncated 1245 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use browser automation to circumvent a request rejected by the platform's SSRF policy.
• Route image retrieval through an approved, restricted downloader that applies the same network policy to every request.
• Allow only HTTPS URLs on an explicit set of required Sina image hostnames.
• Resolve destination hostnames and reject loopback, link-local, private, reserved, benchmark, multicast, and other prohibited address ranges.
• Revalidate the hostname and resolved address after every redirect; do not rely solely on validation of the initial URL.
• Reject non-HTTP schemes, embedded credentials, unexpected ports, malformed hostnames, and encoded IP-address representations.
• Apply response-size, MIME-type, timeout, and redirect-count limits.
• Use an isolated, unauthenticated browser context if browser rendering remains necessary.
• Avoid exposing general-purpose evaluate-based fetching to URLs extracted from untrusted page content.
• Record and fail closed on blocked image downloads rather than silently switching to a less restricted request channel.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description is broad and based on loosely defined keywords like '微博链接', 't.cn', 'weibo.com', and '转发微博', which can cause the skill to activate on unintended inputs. Because the workflow then performs browser fetches, local file writes, and optional third-party syncs, accidental triggering can lead to unintentional collection and persistence of user-provided or third-party content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill reads credentials, scrapes third-party content, saves data locally, and may transmit content and images to Feishu and Notion, but it does not present a clear, centralized notice about privacy and data handling. Users may not realize that invoking the skill can cause local persistence and onward transfer of content and metadata to external services.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow is specifically designed to capture full third-party Weibo content, images, author metadata, and optionally replicate that material into multiple downstream systems. Even if intended as a personal archiving feature, duplicating third-party content across Obsidian, Feishu, and Notion increases privacy, compliance, and unauthorized redistribution risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This instruction explicitly uploads files to Notion using an API token, which is a real external data transmission path rather than a hypothetical reference. In the context of this skill, the transmitted data can include scraped third-party images and associated metadata, so accidental or unauthorized export is possible if users do not clearly understand or control the sync behavior.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

File Upload 分三步：

bash

# Step 1: 创建上传对象
curl -X POST "https://api.notion.com/v1/file_uploads" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2026-03-11" \
  -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This instruction explicitly uploads files to Notion using an API token, which is a real external data transmission path rather than a hypothetical reference. In the context of this skill, the transmitted data can include scraped third-party images and associated metadata, so accidental or unauthorized export is possible if users do not clearly understand or control the sync behavior.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

File Upload 分三步：

bash

# Step 1: 创建上传对象
curl -X POST "https://api.notion.com/v1/file_uploads" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2026-03-11" \
  -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.