Pyzhihu Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for using a Zhihu CLI, but it gives an agent account-level posting/deletion powers and credential-handling flows without enough confirmation or cleanup safeguards.

Review this skill before installing if you expect the agent to operate a real Zhihu account. Prefer QR login, avoid pasting cookies into commands or chats, confirm the exact target before any post/delete/vote/follow action, and manually remove stale login_qrcode.png files from the Zhihu CLI and OpenClaw media directories after login.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-44
Vulnerability Type: Unpinned third-party package installation and upgrade
Risk Level: Medium

bash

uv tool install pyzhihu-cli
pipx install pyzhihu-cli
pip install pyzhihu-cli

uv tool upgrade pyzhihu-cli
pipx upgrade pyzhihu-cli
pip install -U pyzhihu-cli

Technical Analysis

The Skill directs users or agents to install and upgrade the externally maintained pyzhihu-cli package without specifying an exact version, integrity hash, lockfile, or verified package source. Because this project contains only documentation and metadata, the executable implementation is not included in the audited artifact.

Consequently, the effective code executed by the Skill can change independently after this audit. A compromised package publisher account, malicious future release, dependency confusion event, or compromised transitive dependency could introduce arbitrary code. Installation hooks and the subsequently invoked zhihu executable would operate with the permissions of the user running the agent.

Attack Path

1. An attacker compromises the package publisher, package distribution channel, or a transitive dependency.
2. The attacker publishes a malicious release under the expected package name.
3. A user or agent follows the documented unpinned installation or upgrade command.
4. The package manager retrieves the current compromised release.
5. Malicious installation logic or the installed zhihu executable runs under the user's account.
6. The malicious package may access files, environment variables, locally stored Zhihu cookies, or other resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation or CLI. The accessible scope may include the user's home directory, agent workspace, environment variables, Zhihu sessi ...[truncated 255 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pyzhihu-cli to a specifically reviewed version, such as pyzhihu-cli==0.2.6, rather than installing the latest available release.
• Use package-manager integrity hashes or a hash-locked requirements file where supported.
• Document and enforce the canonical package index or repository source.
• Review the package, its installation hooks, and its transitive dependencies before updating the approved version.
• Avoid recommending unconditional upgrade commands. Require explicit review and approval for each new release.
• Consider distributing a lockfile or a reproducible installation manifest containing exact dependency versions and integrity information.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:111

Finding

Authentication Cookies Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 111
Vulnerability Type: Sensitive authentication data passed as a process argument
Risk Level: Medium

bash

zhihu login --cookie "z_c0=...; _xsrf=...; d_c0=..."

The same command pattern is also presented elsewhere in SKILL.md, including the prerequisites and command-reference sections.

Technical Analysis

The documented login method places the complete Zhihu authentication cookie in a command-line argument. Command-line arguments are not a suitable secret-transport mechanism because they may be retained in shell history, agent command transcripts, terminal logs, debugging output, crash reports, or telemetry. Depending on the operating system and process isolation configuration, arguments may also be observable through process-inspection facilities while the command is running.

This pattern conflicts with the Skill's stated requirement that cookies must not be written to conversations or logs. Even if the CLI stores the resulting cookie file with restrictive permissions, exposure can occur before that file is created because the secret is already present in the invocation string.

Attack Path

1. A user supplies an active Zhihu cookie for authentication.
2. The agent or user inserts the cookie into the documented zhihu login --cookie command.
3. The complete command is recorded in shell history, agent execution logs, terminal capture, process metadata, or error telemetry.
4. A local user, monitoring process, log reader, support operator, or other party with access to those records retrieves the cookie.
5. The attacker reuses the cookie before it expires or is revoked.
6. The attacker performs actions as the authenticated Zhihu account within the permissions represented by that session.

Impact Assessment

Exposure of an active session cookie may enable account impersonation without knowing the user's password. Depending on Zhihu's s ...[truncated 389 chars]

Remediation

View remediation

Remediation Suggestions

• Remove support for supplying cookie values directly through command-line arguments.
• Prefer QR-code authentication, as already supported by the Skill.
• If manual cookie authentication is necessary, modify the CLI to read the cookie from a protected standard-input stream or an interactive no-echo prompt.
• Alternatively, accept a path to a permission-restricted credential file instead of accepting the credential itself as an argument.
• Ensure agent execution logs redact authentication values and never persist the expanded command.
• Prevent shell-history retention during any unavoidable manual credential operation.
• Restrict the resulting credential file to the authenticated user and verify permissions after creation.
• Advise users to run zhihu logout and revoke the affected session immediately if a cookie may have appeared in command history or logs.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill instructs copying the login QR code image into another tool's workspace and sending it over OpenClaw, which expands the exposure of authentication material beyond the original local-only path. Even though it is 'just' a QR code, it is part of an active login flow and may persist in another directory, be accessible to other processes, or be sent to an unintended recipient/channel.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

1. **诉求 → 命令**：按下表映射。
2. **数据查询优先用 --json**：凡执行**数据查询类**指令（如 `search`、`hot`、`question`、`answers`、`answer`、`user`、`user-answers`、`user-articles`、`followers`、`following`、`feed`、`topic`、`collections`、`notifications`、`whoami` 等），**必须**带 `--json`，以获取 API 返回的完整数据，便于解析、汇总或向用户展示；不得仅依赖终端表格等非结构化输出。例外：`feeds` 当前不支持 `--json`；需要展示回答评论时使用 `answer --comments`（`--json` 只输出回答详情，不输出评论）。
3. **需登录时**：先 `zhihu status`；未登录则 `zhihu login --qrcode` 或引导用户 `zhihu login --cookie "..."`。
4. **扫码登录**：执行 `zhihu login --qrcode` 后，若本轮未发过二维码且用户已配置 OpenClaw → 先将二维码复制到 OpenClaw 工作目录的 `media` 文件夹，再 `openclaw message send --channel <渠道> --target <目标> --media <media 路径>/login_qrcode.png --message "请用知乎 App 扫码并确认登录"`；**保持登录进程不中断**直到成功/失败/超时；用户说「重新登录/换号」则中断当前进程再重新执行登录。**复制步骤**：Linux/macOS：`mkdir -p ~/.openclaw/workspace/media && cp ~/.zhihu-cli/login_qrcode.png ~/.openclaw/workspace/media/`；Windows：`mkdir "%USERPROFILE%\.openclaw\workspace\media" 2>nul & copy "%USERPROFILE%\.zhihu-cli\login_qrcode.png" "%USERPROFILE%\.openclaw\workspace\media\login_qrcode.png"`（若 OpenClaw 工作目录不同则替换为实际路径）。
5. **安全**：Cookie 仅本地；优先扫码，避免在不可信处粘贴 Cookie；可提醒 `zhihu logout` 清空。
6. **升级**：`uv tool upgrade pyzhihu-cli` / `pipx upgrade pyzhihu-cli` / `pip install -U pyzhihu-cli`。

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill enables destructive actions such as deleting questions, pins, and articles, including a force flag (-y), but does not require an explicit confirmation or clear warning about irreversible loss before execution. In an agent setting, this increases the chance of accidental or misinterpreted user requests causing permanent deletion of user content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

This section repeats instructions to copy the login QR code into the OpenClaw media directory, creating an additional persisted copy of a sensitive authentication artifact. The duplication makes session-related material more likely to remain on disk or be mishandled, increasing the chance of unauthorized login if the QR is exposed during its validity window.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

1. 确保二维码已生成（Linux/macOS：`~/.zhihu-cli/login_qrcode.png`；Windows：`%USERPROFILE%\.zhihu-cli\login_qrcode.png`）。
2. 复制到 OpenClaw 工作目录的 `media` 文件夹：
   - **Linux/macOS**：`mkdir -p ~/.openclaw/workspace/media && cp ~/.zhihu-cli/login_qrcode.png ~/.openclaw/workspace/media/`
   - **Windows（cmd）**：`mkdir "%USERPROFILE%\.openclaw\workspace\media" 2>nul & copy "%USERPROFILE%\.zhihu-cli\login_qrcode.png" "%USERPROFILE%\.openclaw\workspace\media\login_qrcode.png"`
   - **Windows（PowerShell）**：`New-Item -ItemType Directory -Force "$env:USERPROFILE\.openclaw\workspace\media" | Out-Null; Copy-Item "$env:USERPROFILE\.zhihu-cli\login_qrcode.png" "$env:USERPROFILE\.openclaw\workspace\media\login_qrcode.png"`
   （若 OpenClaw 工作目录不是默认的 `~/.openclaw/workspace` 或 `%USERPROFILE%\.openclaw\workspace`，则替换为实际路径。）

Static analysis

No suspicious patterns detected.