掘金自动发布

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:09 PM UTC
• Version: 1.0.3

Overview

This skill is for publishing to Juejin, but it asks users to handle a full account cookie and run unaudited workspace scripts without enough safeguards.

Review carefully before installing. Only use it with a low-risk Juejin account if possible, do not store the browser cookie in shared or synced workspace files, verify any referenced Python scripts before running them, and assume the cookie can publish as your account until revoked or expired.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:63

Finding

Plaintext Storage of an Authentication Session Cookie

Content

View full analysis

" ``` The source instructs users to place their complete Juejin authentication cookie directly in `~/.openclaw/workspace/JUEJIN.md`. ### Technical Analysis An authenticated session cookie is a bearer credential: possession may be sufficient to submit requests with the privileges of the corresponding logged-in session. The documented configuration stores this credential as plaintext in a workspace file. The Skill does not prescribe restrictive file permissions, encryption, an operating-system credential store, access isolation, output redaction, or secure deletion. Because the file is placed under a shared Agent workspace, other local Skills, processes, backup tools, or users with workspace read access may be able to retrieve it. ### Attack Path 1. The user copies the complete cookie from an authenticated browser session. 2. The user stores it in `~/.openclaw/workspace/JUEJIN.md` as instructed. 3. Another local process, Skill, or user with read access opens the plaintext configuration file. 4. The cookie is extracted and replayed in requests to Juejin. 5. The attacker performs actions permitted by the session, potentially including creating or publishing content as the victim. Exploitation requires access to the configuration file or another disclosure mechanism. The precise account privileges available depend on the permissions and validity of the captured Juejin session. ### Impact Assessment Disclosure may allow impersonation of the affected Juejin session. Potential impact includes unauthorized draft creation, publication of attacker-controlled articles, modification of content where allowed by the session, reputational harm, and abuse of the victim's account identity. The exposure is limited to the priv ...[truncated 94 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Execution of Unbundled Scripts from a Mutable Workspace Path

Content

View full analysis

" \ --content "" \ --tags "Python,AI,Automation" python3 ~/.openclaw/workspace/custom/juejin_publisher.py \ --title "" \ --file article.md \ --schedule "2026-03-12 09:00" python3 ~/.openclaw/workspace/custom/juejin_publisher.py \ --queue ~/.openclaw/workspace/memory/content-queue/ ``` The referenced `juejin_publisher.py` file is not included in the audited project. ### Technical Analysis The Skill relies on a Python program located at a fixed path in a mutable workspace rather than bundling an auditable implementation with the Skill. The package therefore does not establish the provenance, integrity, ownership, or expected hash of the executed program. If another component can create or replace the referenced file, the documented command will execute that component's code under the invoking user's privileges. The missing implementation also prevents verification of credential handling, input validation, queue processing, scheduling, network destinations, and publication controls. This is not evidence that the absent script is itself malicious. The vulnerability is the trust placed in an unaudited file at a mutable external path. ### Attack Path 1. An attacker or compromised local Skill obtains write access to `~/.openclaw/workspace/custom/`. 2. It creates or replaces `juejin_publisher.py` with attacker-controlled Python code. 3. The user follows the documented publication instructions. 4. Python executes the substituted script with the user's local privileges. 5. The substituted code reads accessible files or c ...[truncated 684 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:98

Finding

Execution of an Unbundled Cookie-Extraction Script

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to store a full authenticated Juejin session cookie in a local file, which is effectively a bearer credential that can allow account access if exposed. Although this is common in automation, the documentation provides no warning about the sensitivity of the cookie, storage risks, or the consequences of leakage from local files, backups, or shared workspaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly teaches users how to extract and copy the complete browser cookie but omits any warning that this may expose an active authenticated session. A stolen or mishandled cookie can allow account takeover or unauthorized publishing actions without needing the user's password.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

发布接口

text

POST https://api.juejin.cn/content_api/v1/article_draft/create

Headers:
  Cookie: [你的Cookie]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

发布接口

text

POST https://api.juejin.cn/content_api/v1/article_draft/create

Headers:
  Cookie: [你的Cookie]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The API example demonstrates transmitting article content and authentication cookies to a remote service, but does not warn users that they are sending both private content and account credentials over the network. The endpoint uses HTTPS, which reduces transport risk, but the missing disclosure and safety guidance still creates avoidable exposure and misuse risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

"tag_ids": tags,
        "brief_content": content[:100]
    }
    response = requests.post(url, json=data, cookies=cookies)
    return response.json()

# 使用

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language instructions, headings, examples, and operational guidance are all presented in Chinese, with no opt-in, alternate language option, or explanation of a region-specific requirement. Under the stated policy, forcing a specific language without user choice can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.