Security audit

小红书低粉爆款笔记

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with its Xiaohongshu analytics purpose, but it handles API credentials and generated HTML in ways that need review before use.

Review this skill before installing. Use it only with a revocable, low-scope RedFox API key, prefer setting REDFOX_API_KEY directly in the current environment, avoid relying on shell-profile discovery, and be cautious opening generated HTML exports because remote or cached fields and CDN scripts can execute in the browser.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: scripts/fetch_explosive_articles.py:1041
Finding: Generated Reports Contain Instructions That Hijack Agent Output
Content: View full analysis
") full_output_lines.append("") # If the date was switched automatically, notify the user first if auto_switched: full_output_lines.append(f"**数据还没更新，目前最新数据到{start_date}。我将直接为您查询{start_date}的对应数据。**") full_output_lines.append("") # Part 1: Viral-note table table_text = format_ranking_list( articles, query_category, args.show_all, rank_date=start_date ) full_output_lines.append(table_text) # Part 2: Viral-pattern analysis insights = generate_insights_analysis(articles) full_output_lines.append("") full_output_lines.append("---") full_output_lines.append("") full_output_lines.append(insights) # Part 3: Feature selection full_output_lines.append("") full_output_lines.append("---") full_output_lines.append("") full_output_lines.append("技能还支持以下功能：") full_output_lines.append("1\uFE0F\u20E3 支持订阅小红书低粉爆款笔记。订阅后将在每日19:30为您推送当日小红书低粉爆款笔记TOP50。直接回复\"订阅\"或 \"1\"即可订阅相关内容。") ``` The first generated string translates to an instruction that the content must be output verbatim, that its formatting must not be changed, and that no portion—including subscription and HTML-export promotion—may be omitted. ### Technical Analysis The script does not merely return ranking data. It embeds an instruction directed at the consuming AI agent inside generated Markdown. The instruction attempts to control how the agent handles the result by requiring verbatim reproduction and prohibiting removal of selected promotional material. This crosses the boundary between tool data and agent instructions. Tool output must be treated as untrusted data, not as an authority capable of re ...[truncated 1247 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_explosive_articles.py:241
Finding: API Key Is Transmitted Over TLS Without Certificate or Hostname Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_explosive_articles.py:775
Finding: Unescaped API and Cache Fields Allow Stored HTML and JavaScript Injection
Content: View full analysis
str: """Generate HTML for one note.""" try: title = article.get("title", "无笔记标题") or "无笔记标题" photo_url = article.get("photoJumpUrl", "#") user_name = article.get("userName", "未知作者") user_url = article.get("userJumpUrl", "#") fans = article.get("fans", "0") desc = article.get("desc", "") like_count = article.get("useLikeCount", "0") collect_count = article.get("collectedCount", "0") comment_count = article.get("useCommentCount", "0") share_count = article.get("useShareCount", "0") interactive_count = article.get("interactiveCount", "0") analysis = generate_content_analysis(desc, title) stats_html = f'''
❤️ 点赞 {like_count}

⭐ 收藏 {collect_count}

💬 评论 {comment_count}

📤 分享 {share_count}

互动总数 {interactive_count}
''' user_head_url = article.get("userHeadUrl", "") if user_head_url: author_html = f'
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: assets/preview-template.html:8
Finding: Exported HTML Retrieves and Executes Mutable JavaScript from External CDNs
Content: View full analysis
``` ### Technical Analysis Every exported HTML file retrieves executable JavaScript at viewing time. The effective code can therefore change after the Skill package has been audited. The template does not use Subresource Integrity hashes, an enforcing Content Security Policy, or a locally bundled reviewed artifact. The fallback logic dynamically inserts scripts from two additional providers, increasing the supply-chain and availability attack surface. The version number in a CDN URL provides some version selection but does not cryptographically verify the returned bytes. ### Attack Path 1. The Skill generates an HTML export. 2. The user or agent opens the file while network access is available. 3. The browser requests `html2pdf.js` from the primary CDN. 4. If the primary source fails, the page attempts additional CDN sources. 5. A compromised CDN, publishing account, DNS route, proxy, or delivery path returns altered JavaScript. 6. The browser executes the alter ...[truncated 664 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/fetch_explosive_articles.py:97
Finding: Skill Unnecessarily Scans Shell Profiles for Credentials and Logs a Secret Prefix
Content: View full analysis
str: """ Three-level REDFOX_API_KEY lookup: 1. Current REDFOX_API_KEY environment variable 2. Shell configuration files 3. Configuration instructions """ # First level: current environment variable api_key = os.getenv("REDFOX_API_KEY", "").strip() if api_key: print(f"[鉴权] 从环境变量读取到 REDFOX_API_KEY（前8位: {api_key[:8]}...）", file=sys.stderr) return api_key # Second level: read shell configuration files home = os.path.expanduser("~") shell_configs = [] if sys.platform == "win32": ps_profile = os.path.join( home, "Documents", "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1" ) shell_configs.append(ps_profile) ps7_profile = os.path.join( home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1" ) shell_configs.append(ps7_profile) shell_configs.append(os.path.join(home, ".bashrc")) shell_configs.append(os.path.join(home, ".bash_profile")) else: shell_configs = [ os.path.join(home, ".zshrc"), os.path.join(home, ".bashrc"), os.path.join(home, ".bash_profile"), os.path.join(home, ".profile"), ] for config_path in shell_configs: if os.path.exists(config_path): try: with open(config_path, 'r', encoding='utf-8') as f: for line in f: line_stripped = line.strip() if line_stripped.startswith('#') or not line_stripped: continue for pattern in [ ...[truncated 2663 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a data-query utility but additionally performs local cache reads, HTML generation, and a fallback mode that can trigger new API requests. That mismatch matters because local file handling and re-requests introduce privacy, integrity, and cost implications beyond a simple lookup workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill presents itself as a data-query utility but additionally performs local cache reads, HTML generation, and a fallback mode that can trigger new API requests. That mismatch matters because local file handling and re-requests introduce privacy, integrity, and cost implications beyond a simple lookup workflow.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
md
- 核心脚本：[scripts/fetch_explosive_articles.py](scripts/fetch_explosive_articles.py) — 数据获取（原生 socket+SSL，三级 API Key 鉴权）、分析和 md 输出

Hidden Instructions

High

Category: Prompt Injection
Confidence: 92% confidence
Finding: This duplicate finding reflects the same issue: the page includes and dynamically injects third-party script sources from jsDelivr, cdnjs, and unpkg without integrity verification. Any compromised dependency source gains full execution in the browser, enabling data theft, content manipulation, or malicious PDF generation.
Content: Scanner excerpt · assets/preview-template.html (reported line 7)May include surrounding context.
html
<meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>{{KEYWORD}} · 小红书低粉爆款笔记TOP{{TOP_N}}</title>  <script src="https://cdn.jsdelivr.net/npm/html2pdf.js@0.10.1/dist/html2pdf.bundle.min.js"></script> <script> // 如果第一个CDN加载失败，尝试第二个

Hidden Instructions

High

Category: Prompt Injection
Confidence: 92% confidence
Finding: This duplicate finding reflects the same issue: the page includes and dynamically injects third-party script sources from jsDelivr, cdnjs, and unpkg without integrity verification. Any compromised dependency source gains full execution in the browser, enabling data theft, content manipulation, or malicious PDF generation.
Content: Scanner excerpt · assets/preview-template.html (reported line 7)May include surrounding context.
html
<meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>{{KEYWORD}} · 小红书低粉爆款笔记TOP{{TOP_N}}</title>  <script src="https://cdn.jsdelivr.net/npm/html2pdf.js@0.10.1/dist/html2pdf.bundle.min.js"></script> <script> // 如果第一个CDN加载失败,尝试第二个

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.en.md (reported line 73)May include surrounding context.
md
## Use Cases | Scenario | Role | Example question | Benefit | | ----------------------------- | ------------------------ | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Daily topic inspiration | Xiaohongshu creator | `Show low-follower virals in beauty` | Browse TOP50 topics and use viral analysis to quickly find replicable titles and writing approaches | | Competitor content monitoring | Content ops | `Check low-follower home décor virals regularly` | Track content topic shifts and title pattern changes to spot emerging topic directions |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README says users can '直接用自然语言描述需求，无需记忆命令', which makes invocation conditions very broad and does not define when this skill should activate versus ordinary conversation. Although examples are provided below, there are no explicit constraints, trigger list boundaries, or negative examples to prevent accidental invocation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool scope even though the specification clearly directs use of environment access, local file reads/writes, and outbound network access. Without an allowlist, an agent may exercise broader capabilities than users expect, reducing transparency and weakening least-privilege controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill description and interaction examples are entirely in Chinese, and the document does not state that the skill supports other languages or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to scan shell startup files and profiles for API keys, which are local configuration files that may contain unrelated secrets, tokens, or personal settings. Reading them without a clear upfront warning and consent violates user expectations and can lead to unauthorized secret exposure beyond the single API key sought.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill says it will automatically generate Markdown, JSON cache, and HTML export files, then deliver attachments, without clearly warning the user that query results will be persisted locally. Silent local writes can expose browsing or business-interest data to other local users, backups, or later processes, especially when filenames and caches are predictable.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script searches local shell profile files such as .zshrc, .bashrc, and PowerShell profiles to extract REDFOX_API_KEY, which is a form of credential harvesting from unrelated local files. This exceeds the stated purpose of fetching ranking data and creates unnecessary access to sensitive material that may expose secrets or normalize broader local secret scraping behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script accesses sensitive credential sources without a clear upfront warning or explicit consent, which is risky even if limited to a specific key name. In a skill whose purpose is content ranking retrieval, silently reading shell profiles is especially unjustified and can violate user expectations around local secret handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The outbound HTTPS implementation disables certificate validation and hostname checking before sending the API key, which enables man-in-the-middle interception or spoofing of the remote service. In addition, the request transmits credentials and query data without explicit user awareness, making secret exposure substantially more dangerous.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script writes Markdown output and a JSON cache file to the current directory and advertises additional workflows beyond simple data retrieval. While not inherently malicious, undeclared local persistence broadens the data-handling surface and can leave potentially sensitive query results or derived content on disk without clear user awareness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The embedded user-facing strings instruct the interaction flow entirely in Chinese and direct the user to reply with specific Chinese terms such as '订阅'. There is no indication that the user can choose another language or locale, so the skill effectively imposes a language constraint without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level docstring is written entirely in Chinese and describes the skill's invocation flow in Chinese only, including the required user reply of "2" to confirm HTML generation. This indicates a language-specific interaction requirement without any opt-in, fallback, or documented region-specific justification, which is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language instructions and usage guidance are fully Chinese-language, with no indication that users may choose another language or that Chinese is a documented requirement. This can constitute a language policy issue when a skill implicitly forces one language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The HTML root explicitly sets lang="zh-CN", and the visible UI text throughout the template is fixed in Chinese. This imposes a specific language/locale without offering user opt-in or documenting that the skill is intentionally region-specific, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file is natural-language documentation, and its content forces a single language/locale for all users without any opt-in or alternative. Under the stated policy, language-only documentation can be flagged when it imposes a specific language without user choice or justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest only describes discovering and listing low-follower high-engagement Xiaohongshu posts. The output text tells users they can subscribe to daily pushes, but this script contains no subscription implementation and the capability is not part of the described skill purpose, creating an intent mismatch between presented behavior and actual declared scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script writes Markdown and JSON cache files into the working directory without clear default notice or consent. Although the stored data appears to be fetched content rather than credentials, silent persistence can leak usage patterns, query context, or scraped content into shared directories or synced folders.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/fetch_explosive_articles.py:225

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/fetch_explosive_articles.py:272