zhihu-fetcher

SUSPICIOUS: the core behavior is largely consistent with a Zhihu scraping/export skill, and the visible data flow stays local plus Zhihu. The main concerns are persistent cookie handling, broad execution/file permissions, and incomplete dependency transparency because requirements were referenced but not supplied; this raises security risk more than malware likelihood.

This module is best characterized as an automation tool that relies on interactive login to a specific site and then harvests and persists sensitive authentication cookies (notably z_c0) to a local JSON file. While there is no explicit remote exfiltration shown in the provided fragment, the design directly captures session credentials and stores them unprotected, which is a high-value target for misuse if the cookie file is exposed. Additionally, it includes stealth/anti-detection behavior and injects an initialization script whose content is not visible in the snippet; combined with '--no-sandbox', this increases risk. Overall: likely intended for authenticated account automation/scraping, but the credential-handling and missing init-script visibility warrant careful review and operational controls (e.g., file permissions, encryption-at-rest, and auditing of STEALTH_SCRIPT).

Overall, this module is designed to collect and persist sensitive authentication cookies from a manually authenticated Zhihu browser session into a plaintext JSON file. While it does not show explicit exfiltration or overt malware behavior, it meaningfully increases account/session compromise risk if cookie_file (or user_data_dir) is exposed or mishandled. The use of a persistent browser profile and exporting all cookies without filtering are the most significant security concerns.