ClawHub
Back to skill

Security audit

抖音实时热点榜

Security checks for vulnerabilities and agentic risk

Overview

This skill is for Douyin trend reports, but it needs review because it reads shell startup files for credentials and creates executable HTML reports from remote data.

Review before installing. Use a narrowly scoped, revocable REDFOX_API_KEY and prefer setting it only as an environment variable rather than storing it in shell startup files. Be aware that the skill sends that key to redfox.hk, writes local JSON/HTML/PDF report artifacts, and generated reports can execute JavaScript from embedded data and cdnjs when opened.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/gen_douyin_hot_html.py:239
Finding

Stored HTML and JavaScript Injection in Generated Reports

Content
View full analysis
🥇'; tagHtml = '新'; } else if (rank === 2) { rowCls = 'row-top2'; badgeHtml = '🥈'; tagHtml = '热'; } else if (rank === 3) { rowCls = 'row-top3'; badgeHtml = '🥉'; tagHtml = '升'; } else { badgeHtml = '' + rank + ''; } html += '' + '' + badgeHtml + '' + '' + '
' + title + '
' + '
' + desc + '
' + '' + '
' ...[truncated 2924 chars]
Remediation
View remediation
` element and escape at least `<` as `\u003c` before insertion. 6. Avoid directly embedding arbitrary JSON inside an executable ``, quotes, HTML tags, event-handler attributes, and `javascript:` URLs. 10. Apply the same URL validation before creating clickable PDF annotations. ]]>

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/gen_douyin_hot_html.py:245
Finding

Generated Reports Retrieve and Execute Third-Party JavaScript Without Integrity Protection

Content
View full analysis
``` ### Technical Analysis Every generated report loads and executes JavaScript from the cdnjs third-party content delivery network when opened. Although explicit library versions appear in the URLs, the script elements do not use Subresource Integrity hashes. The generated document also has no restrictive Content Security Policy. This means the effective code executed by the report is not fully contained in the audited Skill package. A compromise of the CDN, its delivery infrastructure, or the hosted assets could cause modified JavaScript to execute in generated reports without changes to the local project. The behavior also conflicts with the generator's description of producing an independently openable report because opening the report makes external network requests and PDF export depends on those requests succeeding. ### Attack Path 1. The Skill creates an HTML report containing the two external script references. 2. The user opens the report while connected to the network. 3. The browser retrieves JavaScript from cdnjs. 4. If either remote resource or its delivery path is compromised, altered code is returned. 5. The browser executes the altered code with the same document access as the report's own JavaScript. 6. The remote code can inspect or manipulate the displayed trend data and report interface. ### Impact Assessment A successful supply-chain or remote-delivery compromise could execute arbitrary JavaScript in all reports opened while the malicious asset is served. This could alter report content, capture user interactions, red ...[truncated 296 chars]
Remediation
View remediation
``` 4. Generate and verify the integrity values from trusted upstream release artifacts; do not use placeholder hashes. 5. Add a restrictive Content Security Policy limiting scripts to the exact required sources and disallowing unexpected connections. 6. Document that opening the report requires network access if external resources remain. 7. Prefer an offline report architecture so report rendering and PDF export continue to work if third-party services are unavailable. 8. Maintain a dependency inventory and regularly review the bundled library versions for known vulnerabilities. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note
Location
scripts/hotspot_fetcher.py:40
Finding

API Credential Discovery Reads Entire Shell Startup Files Beyond Necessary Privilege

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill claims scheduled subscription/push features without any described implementation, while also disclosing behavior to read API keys from shell startup files that is not reflected in the high-level declaration. Hidden or under-disclosed local credential harvesting behavior materially increases risk because shell rc files may contain other sensitive data beyond the intended API key.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill claims scheduled subscription/push features without any described implementation, while also disclosing behavior to read API keys from shell startup files that is not reflected in the high-level declaration. Hidden or under-disclosed local credential harvesting behavior materially increases risk because shell rc files may contain other sensitive data beyond the intended API key.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
2. 确保 Agent 可读取 `SKILL.md` 与 `references/core_workflow.md`

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

quests`

环境变量配置

变量名必填说明
REDFOX_API_KEY是红狐Hub API 访问密钥，格式 ak_xxxxxxxx

配置方式（任选其一）：

bash
# 方式一：直接设置环境变量（推荐）
export REDFOX_API_KEY=ak_xxxxxxxx

# 方式二：写入 Shell 配置文件（~/.bashrc / ~/.bash_profile / ~/.zshrc）
echo 'export REDFOX_API_KEY=ak_xxxxxxxx' >> ~/.bashrc
source ~/.bashrc

若未配置环境变量，技能将自动从 Shell 配置文件读取；若仍未获取到，会在运行时提示配置。

在 WorkBuddy 中配置 Key：可在系统环境变量中设置 REDFOX_API_KEY，或在 Shell 配置文件中写入后重启 WorkBuddy，无需在每次对话中手动传入。

使用指南

基础使用

1. 查看实时热榜

告诉助手你想查看当前抖音热点：

用户：抖音热榜 助手：为您展示抖音实时热榜 TOP 20

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README instructs users to invoke the skill with very generic phrases such as 'Today's hot list', 'Load more', and 'Cancel subscription'. Broad natural-language triggers like these can overlap with ordinary conversation, increasing the chance the skill is activated unintentionally or hijacks unrelated user intent in a larger agent environment. Because this skill can also create or cancel scheduled subscriptions, accidental invocation could have side effects beyond a simple read-only query.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README states users can 'directly use natural language to describe needs' without clearly constraining supported actions or rejecting out-of-scope requests. In an agent setting, overly broad invocation language can cause the skill to engage on ambiguous prompts, increasing the chance of unintended activation, prompt overlap with general conversation, or misuse of downstream capabilities such as subscriptions or report generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The example utterances are very short and generic, such as '今日热榜', '继续加载', and '取消订阅', which are likely to overlap with ordinary conversation in Chinese. This raises the risk of accidental triggering or ambiguous routing, especially for follow-up commands that could perform actions without sufficient context or confirmation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documentation describes capabilities that require access to environment variables, local files, network requests, and generated output files, but it does not explicitly declare any tool scope or permission boundaries. This creates a transparency and least-privilege problem: an agent may grant broader-than-expected access, and users cannot readily assess what local or network resources the skill may touch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document says the agent will automatically load the skill when the user says "抖音热榜" or "今日热榜". In particular, "今日热榜" is a generic natural-language phrase that could arise in ordinary discussion of trending topics, and the file does not define tighter activation constraints or exclusion conditions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The quick-reference table lists phrases such as "继续加载", "加载更多", and "取消订阅" as commands, but these are common conversational phrases that can appear outside this skill's intended context. The documentation does not specify contextual guards, required prior state, or negative examples to prevent unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

All instructions, prompts, output formats, and user interaction examples are fixed in Chinese, and the skill does not offer users a language or locale option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow materially expands the skill from simple hot-list retrieval into mandatory creator-oriented analysis and reporting. This broadens the skill’s behavior beyond the stated core function, increasing the chance of unexpected autonomous output, overreach, and user confusion about what actions the agent will take.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger condition is broad enough to match generic questions about Douyin trends, hot topics, rankings, history, or subscriptions, which can cause the skill to activate when the user did not intend to invoke it. Over-broad activation increases the risk of unintended data fetching, analysis, subscription prompting, and file generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow requires proactive subscription prompting and says user preferences should be recorded, but it does not disclose what data will be stored, where it will be stored, how long it will be retained, or how it can be deleted. That creates a privacy and consent gap around persistence of user preferences.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow mandates HTML/PDF generation, preview, and delivery as forced steps even though the skill description centers on retrieving Douyin trending data. Automatic artifact creation and file handling increase the capability surface and can cause unintended local writes and exfiltration-style attachment delivery without clear necessity or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow forces generation and delivery of HTML/PDF files without a user-facing warning that files will be written to disk and shared as attachments. Automatic artifact creation can leave residual local data, surprise users, and increase privacy exposure, especially because temporary JSON and rendered documents may persist.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

文件头部文档将该脚本描述为“从JSON文件读取热榜数据，生成可独立打开的HTML页面”，但同时又实现了在未提供 JSON 时直接调用 redfox.hk API 获取数据的逻辑。对一个名为 gen_douyin_hot_html 的生成器而言，这超出了文档所呈现的单纯离线渲染职责。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script reads ~/.bashrc, ~/.bash_profile, and ~/.zshrc to extract REDFOX_API_KEY, which reaches beyond the minimum privileges needed for HTML generation and accesses potentially sensitive local configuration without explicit consent at runtime. In a skill context, this is more dangerous because users may expect a formatting/reporting tool, not one that inspects shell startup files for secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

At the point of use, the script silently falls back from environment variables to reading shell profile files for credentials, without an interactive warning or affirmative user consent. This creates a transparency and least-privilege problem: a user invoking an HTML generator would not reasonably expect inspection of personal shell initialization files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends the API key in an X-API-KEY header and includes query metadata to an external domain during execution without a user-facing warning in that execution path. While contacting the documented backend is part of the feature, the lack of explicit notice is risky in a skill setting because users may run it assuming local-only HTML generation, causing unanticipated outbound transmission of credentials and usage metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This file contains user-facing natural-language instructions and descriptions exclusively in Chinese, including the module docstring and operational guidance. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script reads ~/.bashrc, ~/.bash_profile, and ~/.zshrc to extract REDFOX_API_KEY, which expands its access beyond the stated purpose of fetching Douyin hot-trend data. Even though it targets a specific variable rather than harvesting arbitrary secrets, scanning local shell config files is a sensitive-file access pattern that can expose credentials unexpectedly and violates least-privilege expectations for this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

文档标题、说明和触发示例均固定为中文，没有提供其他语言选项，也未说明该技能是否仅支持中文或允许用户选择语言。根据语言/locale 政策，若技能强制单一语言而未给用户选择，可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The workflow instructs use of preview and attachment-delivery tooling beyond the manifest’s stated purpose of obtaining trending data. Tooling that previews local files and delivers attachments can expose filesystem paths or create unexpected outbound artifacts, especially when invoked automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Mandatory PDF output is unrelated to the core retrieval function and introduces extra processing and file-conversion behavior that the user may not expect. While not inherently dangerous on its own, unnecessary output formats enlarge the attack and privacy surface by creating additional persistent artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.