csdn

SUSPICIOUS: the skill's purpose largely matches its capabilities, but it depends on injected full-session cookies, reverse-engineered private CSDN endpoints, and browser-fingerprint/WAF workarounds. It is not overt malware and does not show obvious third-party exfiltration, yet the credential scope and real-account posting capability make the trust boundary broader than a typical benign API integration.

This module does not show clear signs of stealth malware (no dynamic execution, no persistence, no reverse shell, no system command execution, no obvious sensitive local data exfiltration). However, it has meaningful security and supply-chain risks: it embeds a hardcoded signing secret (CA_SECRET) and it performs high-impact authenticated account actions (article publication/draft creation) using user-supplied cookies. It also introduces a pathway to download and re-upload attacker-controlled external image content referenced in user Markdown. Overall risk is driven more by secret management and misuse potential than by covert malicious behavior in the snippet itself.