Security audit

Zhihu Article Fetcher

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Zhihu article-fetching purpose, but its weak URL validation can send saved Zhihu session cookies to a non-Zhihu URL.

Review carefully before installing. Do not place real Zhihu session cookies in config/cookie.json unless you trust the code and have fixed the URL validation to require exactly https://zhuanlan.zhihu.com/p/<id>. Treat those cookies like account credentials, keep them out of shared folders and source control, and prefer running the skill in an isolated environment with pinned dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_article.py:208
Finding: Weak URL Validation Can Expose Zhihu Session Cookies to Attacker-Controlled Hosts
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:37
Finding: Runtime Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares capabilities that clearly involve network access plus reading and writing local files, but it does not define any tool scope, permissions, or allowed-tools constraints. In an agent environment, this increases the chance the skill will be executed with broader-than-necessary authority, enabling unintended file access or outbound requests beyond the narrow article-fetching use case.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs users to manually extract authenticated Zhihu cookies from browser developer tools and store them in a local JSON file, but provides no warning that these are sensitive session credentials. If leaked, reused, or written to insecure locations, those cookies could allow account hijacking, unauthorized access to private data, or abuse of the user's Zhihu session; the surrounding context is more dangerous because the skill also promotes anti-bot bypass behavior and fallback mechanisms that normalize handling live auth material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script automatically loads authentication cookies from a local file and transmits them to Zhihu, enabling use of a logged-in session without an explicit confirmation step at the time of use. In this skill's context, that is more sensitive because the tool is explicitly designed to bypass anti-bot protections and degrade to cookie-backed access, which can lead to unintended account/session use or disclosure of privileged content tied to the operator's account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language note is written only in Chinese and provides no alternative language or indication that the skill is region- or locale-specific. This can constitute a language/locale policy violation because it implicitly requires Chinese comprehension without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Accept-Language header forces a zh-CN preference, which is a natural-language locale choice embedded in the code. There is no opt-in, configuration option, or documented justification making this locale restriction explicit to the user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This second request mode again specifies zh-CN as the preferred language in the Accept-Language header. Because the file provides no user-selectable locale setting, it imposes a language preference contrary to the policy guidance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The docstring on fetch_article says Four-level auth fallback, while the code only tries three methods: Playwright browser, file cookie, and simulated headers. This is an active contradiction in inline documentation rather than a minor omission because it misstates the implemented authentication/fetch strategy.
Content: No source excerpt is available for this finding.