Security audit

抖音违禁词检测

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Douyin copy-checking tool that uses a RedFox API key, sends checked text to RedFox, and creates a local optimized-copy file, with some privacy disclosures that should be clearer.

Install only if you are comfortable sending checked text and extracted webpage/file content to RedFox over HTTPS and storing the revised copy in a local text file. Use a scoped, revocable RedFox API key, avoid highly sensitive internal documents, and remove generated output files when they are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The FAQ states that content is not stored locally, but other parts of the skill require writing optimized text to a local file. This is a real security and privacy issue because users may rely on the no-local-storage claim when submitting sensitive marketing copy or internal documents, while the skill actually persists derived content on disk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill reads multiple shell startup files to discover REDFOX_API_KEY automatically, which exceeds the minimum access needed for a prohibited-word checker. This broad credential discovery behavior can unexpectedly access secrets from a user's environment and normalizes scanning personal config files without explicit consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill automatically fetches webpage content and submits text to a detection service, but the documentation does not provide a prominent pre-disclosure that content will leave the local environment. This creates a meaningful privacy risk because users may paste internal URLs or proprietary copy expecting local analysis only.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill requires automatic writing of an optimized text file, but this write operation is not surfaced prominently as a user-facing side effect. While lower risk than external transmission, silent local persistence can expose sensitive text to other local users, backups, sync services, or later unintended disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code accesses sensitive credentials from shell config files without clear user-facing disclosure. Even if only one variable name is targeted, this behavior can surprise users and violates least astonishment for a text-checking tool, especially because startup files often contain other secrets and personal configuration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill sends user-provided text and extracted web content to a third-party API without an explicit warning or consent step. Because the content may contain private, proprietary, or regulated information, silent external transmission creates a real data exposure risk even if the endpoint is part of the intended service design.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.