Security audit

图文运营创作器

Security checks for vulnerabilities and agentic risk

Overview

This writing-and-image skill is mostly purpose-aligned, but it fetches URLs and images with TLS verification disabled and has under-disclosed credential handling.

Install only if you are comfortable with the skill fetching supplied links, sending prompts and reference images to RedFox, and writing article/report files locally. Avoid pasting API keys into chat; use a revocable environment variable, and treat the disabled TLS checks as a real transport-security risk until fixed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and relies on environment-variable access, local file reads/writes, and external network fetching, but does not declare permissions or provide an explicit capability boundary. This weakens user consent and platform enforcement, increasing the chance of unexpected data access, local file modification, or external requests being triggered without adequate review.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The function that downloads a user-supplied reference image explicitly disables both certificate validation and hostname verification before fetching an arbitrary HTTPS URL. This enables man-in-the-middle interception or content substitution, so an attacker on the network path could replace the downloaded image or redirect the request to malicious content while the script trusts it.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The generated-image download path also disables TLS verification when retrieving image URLs, so the script cannot authenticate the remote server. An attacker able to tamper with network traffic or DNS could swap generated images, inject unexpected files, or cause users to save untrusted content locally.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README tells users to invoke the skill with broad natural-language requests and 'no commands to memorize,' which increases the chance that ordinary user text will accidentally match activation heuristics. In an agent environment, unintended activation can cause the skill to fetch links, process local skill paths, or generate outputs when the user did not explicitly intend to invoke this tool.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example trigger phrases are generic requests such as rewriting articles, writing promotional content, and adding images, which are common user intents across many contexts. Because these phrases overlap with normal conversation, they can cause accidental tool selection or prompt-routing to this skill, potentially exposing user content, remote URLs, or local file paths to the skill without sufficiently explicit consent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README instructs users to invoke the skill with broad natural-language phrases such as '生成运营文章' and '对标分析', which are common requests that could accidentally trigger the skill outside a clearly consented context. Because the skill can fetch remote content, generate images, and write output files, ambiguous activation increases the chance of unintended external requests and content production.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README advertises automatic article fetching, image generation, and saving completed files, but it does not clearly warn that user-provided links and content may be sent to external services or that local files will be created as a side effect. This can lead to unintentional data disclosure, unexpected network access, and filesystem modifications when users believe they are only requesting drafting assistance.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad and overlap with normal writing-assistance requests such as '生成运营文章' or '对标分析', which can cause the skill to activate in situations where the user did not intend network fetches, file operations, or automated content generation. In a skill with code-capable behaviors, accidental invocation is more dangerous because it may initiate external requests and local writes unexpectedly.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The description states that article links can be provided and content/images will be fetched, but it does not clearly warn users up front that external URLs will be retrieved and processed. This reduces informed consent and can expose user IP/addressing metadata, retrieve untrusted content, or surprise users who expected only offline text assistance.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The output section mentions files being saved, but the skill does not present this as a clear advance warning before operation begins. Unexpected local writes can overwrite files, leak generated content into shared workspaces, or violate user expectations about whether the interaction is chat-only.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document tells users they can directly input an API key if the environment variable is not set, but it does not warn that API keys are sensitive secrets or restrict where they should be entered. In an agent/skill context, this can cause users to paste credentials into chat, logs, prompts, or other storage paths that may be retained, exposed to operators, or reused by downstream components.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: TLS certificate validation is explicitly disabled by setting check_hostname=False and verify_mode=ssl.CERT_NONE before fetching attacker-controlled URLs. In a skill that ingests arbitrary article links, this enables man-in-the-middle interception or spoofing of HTTPS content, causing the system to trust modified HTML and images from an unverified source.

Missing User Warnings

High

Confidence: 99% confidence
Finding: For downloads from user-controlled URLs, the code suppresses certificate checks without warning the user. Because the feature accepts arbitrary remote references, the surrounding skill context increases risk: external URLs are an intended workflow, making insecure transport easy to trigger in normal use.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The same insecure TLS configuration is used when downloading generated images, again without any warning or opt-in. Even though these URLs may come from the upstream API, disabling verification removes the main protection against spoofed endpoints and tampered downloads.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/fetch_article.py:140

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/generate_image.py:243