ClawHub
Back to skill

Security audit

Pyzhihu Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Zhihu automation helper, but it gives an agent account-changing and deletion authority without strong confirmation or cleanup safeguards.

Install only if you are comfortable letting the agent operate your Zhihu account. Before using it, require explicit confirmation for posting, voting/following, and especially deleting exact content IDs; avoid pasting cookies into untrusted contexts; and remove the copied login_qrcode.png from the OpenClaw media folder after QR login completes or times out.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill exposes destructive deletion commands (`delete-question`, `delete-pin`, `delete-article`) and even documents `-y` non-interactive confirmation, but it does not require an explicit secondary confirmation from the user before execution. In an agent context, this raises the risk of accidental or prompt-induced destructive actions against the user's own content, especially because natural-language requests can be ambiguous or manipulated.

Session Persistence

Medium
Category
Rogue Agent
Content
1. **诉求 → 命令**：按下表映射。
2. **数据查询优先用 --json**：凡执行**数据查询类**指令（如 `search`、`hot`、`question`、`answers`、`answer`、`user`、`user-answers`、`user-articles`、`followers`、`following`、`feed`、`topic`、`collections`、`notifications`、`whoami` 等），**必须**带 `--json`，以获取 API 返回的完整数据，便于解析、汇总或向用户展示；不得仅依赖终端表格等非结构化输出。例外：`feeds` 当前不支持 `--json`；需要展示回答评论时使用 `answer --comments`（`--json` 只输出回答详情，不输出评论）。
3. **需登录时**：先 `zhihu status`；未登录则 `zhihu login --qrcode` 或引导用户 `zhihu login --cookie "..."`。
4. **扫码登录**：执行 `zhihu login --qrcode` 后，若本轮未发过二维码且用户已配置 OpenClaw → 先将二维码复制到 OpenClaw 工作目录的 `media` 文件夹，再 `openclaw message send --channel <渠道> --target <目标> --media <media 路径>/login_qrcode.png --message "请用知乎 App 扫码并确认登录"`；**保持登录进程不中断**直到成功/失败/超时；用户说「重新登录/换号」则中断当前进程再重新执行登录。**复制步骤**：Linux/macOS：`mkdir -p ~/.openclaw/workspace/media && cp ~/.zhihu-cli/login_qrcode.png ~/.openclaw/workspace/media/`；Windows：`mkdir "%USERPROFILE%\.openclaw\workspace\media" 2>nul & copy "%USERPROFILE%\.zhihu-cli\login_qrcode.png" "%USERPROFILE%\.openclaw\workspace\media\login_qrcode.png"`（若 OpenClaw 工作目录不同则替换为实际路径）。
5. **安全**：Cookie 仅本地；优先扫码，避免在不可信处粘贴 Cookie；可提醒 `zhihu logout` 清空。
6. **升级**：`uv tool upgrade pyzhihu-cli` / `pipx upgrade pyzhihu-cli` / `pip install -U pyzhihu-cli`。
Confidence
84% confidence
Finding
The login QR code is copied from the private zhihu-cli directory into the OpenClaw workspace media folder and then sent through another messaging channel. Although this is not the cookie itself, the QR code is an authentication artifact tied to account login, so persisting and redistributing it outside the original local path increases exposure and creates an opportunity for unauthorized scanning or reuse before expiration.

Session Persistence

Medium
Category
Rogue Agent
Content
1. 确保二维码已生成（Linux/macOS：`~/.zhihu-cli/login_qrcode.png`；Windows：`%USERPROFILE%\.zhihu-cli\login_qrcode.png`）。
2. 复制到 OpenClaw 工作目录的 `media` 文件夹：
   - **Linux/macOS**：`mkdir -p ~/.openclaw/workspace/media && cp ~/.zhihu-cli/login_qrcode.png ~/.openclaw/workspace/media/`
   - **Windows（cmd）**：`mkdir "%USERPROFILE%\.openclaw\workspace\media" 2>nul & copy "%USERPROFILE%\.zhihu-cli\login_qrcode.png" "%USERPROFILE%\.openclaw\workspace\media\login_qrcode.png"`
   - **Windows（PowerShell）**：`New-Item -ItemType Directory -Force "$env:USERPROFILE\.openclaw\workspace\media" | Out-Null; Copy-Item "$env:USERPROFILE\.zhihu-cli\login_qrcode.png" "$env:USERPROFILE\.openclaw\workspace\media\login_qrcode.png"`
   （若 OpenClaw 工作目录不是默认的 `~/.openclaw/workspace` 或 `%USERPROFILE%\.openclaw\workspace`，则替换为实际路径。）
Confidence
86% confidence
Finding
This section repeats instructions to copy the login QR code into a secondary workspace path, which extends the lifetime and accessibility of a live authentication token image. In the context of an agent skill that may operate across local tools and messaging integrations, duplicating the QR code into shared media locations increases the chance of unintended access or later leakage.

Static analysis

No suspicious patterns detected.