zhihu
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from Zhihu search results, trending topics, and the open web.
- Ingestion points: External data enters the agent context via
scripts/search.py(search results) andscripts/blog.py(article/answer reading). - Boundary markers: The instructions lack explicit delimiters or warnings to the agent to treat external content as untrusted data.
- Capability inventory: The skill has access to Bash, network operations (urllib), and credential-backed write operations on Zhihu.
- Sanitization: Excerpts undergo basic HTML tag stripping, but the primary content is passed through to the agent without significant sanitization.
- [COMMAND_EXECUTION]: Every Bash block in
SKILL.mdincludes logic to resolve the skill directory by searching the/tmpfile system. This is used to ensure scripts are located correctly if environment variables are inconsistent, but involves traversing temporary directories. - [EXTERNAL_DOWNLOADS]:
scripts/blog.pydownloads images from arbitrary external URLs provided in user-supplied content to re-host them on Zhihu's CDN. While this is the intended functionality, it involves fetching data from arbitrary remote sources.
Audit Metadata