Security audit
Security checks for vulnerabilities and agentic risk
The text checker fits its purpose, but its automatic payment setup and recharge instructions lack clear approval controls, and its privacy claims contradict saved output files.
Before installing, require approval before payment-tool installation and each recharge, verify the recipient and amount, and use a reviewed, pinned payment package. Submitted text goes to RedFox, and revised copies remain on disk despite the privacy claim. Supply the intended account key explicitly and avoid confidential content unless you accept that processing and storage.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
last_error = None
for attempt in range(3): # 最多3次（1次原始 + 2次重试）
try:
response = requests.post(
API_URL,
json=payload,
headers=headers,
The core detection and highlighting behavior matches the description, but two expressly promised capabilities are absent from this code chunk. Payment-related instructions printed by the script are not executable payment integration and do not establish that automatic recharge or query resumption occurs. File access, webpage retrieval, API authentication, and remote checking are supporting implementation details rather than unrelated capabilities.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
新注册用户将获赠免费积分，可立即开始使用 API 服务
4. 注册登录后，在个人中心获取 API Key，格式为 ak_xxxxxxxx
将 API Key 配置为环境变量 REDFOX_API_KEY：
方式一：临时设置（当前终端会话有效）
export REDFOX_API_KEY=ak_xxxxxxxx
方式二：永久设置（推荐）
# Bash 用户
echo 'export REDFOX_API_KEY=ak_xxxxxxxx' >> ~/.bashrc
source ~/.bashrc
# Zsh 用户
echo 'export REDFOX_API_KEY=ak_xxxxxxxx' >> ~/.zshrc
source ~/.zshrc
| 变量名 | 必填 | 说明 |
|---|---|---|
REDFOX_API_KEY | 是 | RedFox API 访问密钥，格式 ak_xxxxxxxx，脚本自动通过 X-API-KEY 请求头附加 |
当脚本以退出码 3 结束、并在 stdout 打印 ===PAYMENT_REQUIRED_JSON_START=== 区块时，表示当前 API Key 积分不足（接口 code=3210，兼容 3201）。响应体 data 内�
The visible instructions turn an insufficient-credit API response into payment initiation and submission without requiring explicit approval of the purchase, amount, and recipient. A request to check text is not authorization to buy credits, and reliance on response-provided payment details introduces a trust boundary that could enable unwanted charges or payment misdirection. The referenced payment workflow was not supplied, so downstream safeguards or wallet confirmation requirements cannot be verified.
On an insufficient-credit response, the script emits imperative instructions directing the agent to invoke payment tools using a server-supplied payment URL, amount, and merchant description without a transaction-specific approval step. Automatic recharge is advertised in the metadata, which makes this less suggestive of concealed malicious intent, but it does not establish informed approval of a particular recipient or amount; the script itself does not execute payment.
The README describes an API-backed checker accepting pasted text, documents, images, and web-page content without explicitly warning that submitted text may be transmitted to an external provider. Users could consequently disclose unpublished marketing material, confidential documents, or personal information without understanding the data flow; the API-key security guidance does not address this content-privacy risk. This is a disclosure and consent gap, not evidence of malicious exfiltration, and the actual transmission behavior cannot be verified from this README alone.
Without declared permissions the skill's intent is opaque and cannot be validated.
The privacy answer says copy is not stored locally, but the mandatory workflow writes the optimized copy to a local text file. Users checking confidential or unpublished material could therefore leave persistent copies in a shared or backed-up working directory despite the privacy assurance; HTTPS does not address that retention risk.
The workflow directs the agent to install missing payment software automatically, without first disclosing the local changes or obtaining explicit approval. A text-checking request does not itself authorize installing software, and the payment-related context makes undisclosed executable installation more sensitive; this does not establish that payment itself occurs without user approval.
The command uses @latest, allowing npx -y to download and execute a changing package version without an interactive installation prompt. A compromised package release could execute code with the agent's local privileges, access available credentials, or tamper with payment handling; this is a CLI supply-chain issue rather than an MCP-server-specific issue.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The workflow directs the agent to submit user-provided or extracted text to an external detection API without first disclosing that transfer or obtaining informed authorization. Uploaded documents, image text, and webpage content may contain confidential or personal information, so a routine compliance check can unintentionally disclose sensitive material to a third party. External processing is consistent with the skill's purpose, but the API-key configuration and results disclaimer do not adequately inform users about where their content goes.
When no environment credential is supplied, the script silently searches personal shell startup files and uses any matching credential for remote requests. Although limited to a service-specific variable and apparently intended as a convenience, this crosses the user's explicit credential-provisioning boundary and can consume credits or use an account the user did not authorize for this invocation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
last_error = None
for attempt in range(3): # 最多3次（1次原始 + 2次重试）
try:
response = requests.post(
API_URL,
json=payload,
headers=headers,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
last_error = None
for attempt in range(3): # 最多3次（1次原始 + 2次重试）
try:
response = requests.post(
API_URL,
json=payload,
headers=headers,