Security audit

内容创业凭证管理器

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent credential manager, but it asks users to put powerful API keys and a full session cookie into chat or command arguments without enough safeguards.

Review before installing. Use only on a trusted local machine, avoid pasting full API keys or cookies into chat, and prefer entering secrets through a secure local prompt or manually editing a protected credentials file. Treat the Xiaohongshu cookie like a password and rotate any credential that may already have been exposed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The script claims the credentials file will be readable and writable only by the current user, but it only changes the process umask before opening the file and never enforces permissions on an already-existing file. If the file was previously created with broader permissions, secrets may remain accessible to other local users, which is a real confidentiality issue for stored API credentials.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill repeatedly tells users to paste full API keys, app secrets, and complete cookies directly into chat, but does not present a clear warning that chat transcripts may expose or retain these credentials. This creates a direct social-engineering path for secret exfiltration through the conversation channel rather than through a safer secret-entry mechanism.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrase "哪些技能可以用了" is broad enough to match common status or help requests outside this skill’s narrow credential-management scope. Overly broad activation can cause the wrong skill to intercept user intent, leading to unintended disclosure or processing of credential-status information in unrelated conversations.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The phrase "为什么XX技能不能用" is ambiguous because it can refer to any troubleshooting issue, not specifically missing or invalid credentials. This ambiguity increases the chance that the skill is invoked for unrelated failures and may provide misleading diagnosis or expose internal configuration state unnecessarily.

Vague Triggers

Low

Confidence: 80% confidence
Finding: The trigger "开始内容创作前检查环境" is very general and could overlap with many setup, readiness, or workspace checks unrelated to credentials. Such loose activation boundaries can cause accidental invocation and broaden access to operational status data beyond what the user intended.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill normalizes disclosure of full cookies, API keys, and app secrets in natural language so the assistant can store them on the user's behalf. Because these values grant direct access to third-party accounts and services, exposing them in chat creates a high-risk leakage path through logs, memory, screenshots, prompt injection side effects, or downstream processing.

Static analysis

No suspicious patterns detected.