Security audit

Zsxq Post Fetch

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real ZSXQ content-fetching skill, but it needs review because it handles private account data, legacy tokens, and automatic local attachment downloads with weak per-use safeguards.

Review before installing. Prefer the official zsxq-cli login path, leave ZSXQ_BACKEND unset, and avoid setting ZSXQ_TOKEN unless you specifically need legacy HTTP fallback. Consider disabling download_attachments in config.json, use explicit group IDs/date ranges/counts, and treat exported Markdown and attachments as private account data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The legacy HTTP fallback consumes a raw authentication token from the environment and manually constructs browser-like authenticated requests. This bypasses the safety and visibility benefits of the official CLI login flow, increasing the risk of accidental token misuse, unauthorized API calls, and operational handling of long-lived secrets inside generic process environments.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The example trigger phrase is very broad everyday language, so an agent platform may invoke this skill in situations where a user did not specifically intend to access private 知识星球 data. Because the skill can list groups and fetch private post content from an already-authorized account, accidental invocation can expose sensitive content to the agent or downstream logs.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation description is very broad—covering viewing, summarizing, searching, and exporting knowledge-platform content whenever a user asks for related information. This can cause the agent to invoke a data-accessing skill in situations where the user did not clearly consent to querying a third-party account or exposing account-scoped content such as joined groups and attachments.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The prompt-usage section maps many common natural-language requests directly to authenticated data-fetching actions, including listing joined groups and exporting/downloading content. Without tighter constraints or confirmation gates, the skill may over-collect or disclose private subscription content beyond what the user specifically intended.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code automatically injects the authentication cookie into outbound requests whenever ZSXQ_TOKEN is present, with no confirmation at the point of use. That makes it easy for the skill to transmit a sensitive bearer-equivalent token to the remote service without strong user awareness, especially in a larger agent workflow.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Attachment downloads create local files on disk and may store untrusted remote content from posts accessible to the authenticated account. In an agent context, automatic persistence of externally sourced files can create privacy, storage, and downstream malware-handling risks if users are not clearly informed or if the path is broadly writable.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: Markdown export writes user-accessible content to local disk, which can expose sensitive group data in plaintext files and create persistence the user may not expect. Although this is part of the advertised export functionality, silent file creation still carries confidentiality and operational risk in an automated skill setting.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: fetch_topics.js:167