Security audit

小红书文案创作

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Xiaohongshu writing purpose, but it under-discloses local HTML report creation that can overwrite files and include unsafe HTML content.

Install only if you are comfortable giving the skill a Redfox API key and letting it contact redfox.hk and web search for Xiaohongshu topics. Run it in a restricted working directory, avoid sensitive personal writing samples, and review or patch the script before use so HTML output is opt-in, path-contained, non-overwriting, and properly escaped.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_xhs_hot_articles.py:586
Finding: User-Controlled Arbitrary File Creation and Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_xhs_hot_articles.py:227
Finding: HTML Injection Through Unescaped User and API-Controlled Values
Content: View full analysis

{idx + 1}. {title}

{author_name}（{fuzzy_count(fans)}粉） · 发布日期：{pub_time}
{scores_html}
🔥 {interactive_count}互动 👍{like_count} ⭐{collect_count} 查看作品 ↗
''' ``` ```python

小红书热门笔记数据分析报告

关键词：{keyword} | 时间范围：{time_range}

共找到 {total} 条相关笔记

``` ### Technical Analysis The HTML formatter inserts multiple untrusted values directly into an HTML document: - `keyword` originates from the search request or API response. - `author_name`, `note_link`, and other article fields originate from the remote API. - `note_link` is placed in a quoted HTML attribute without escaping or URL-scheme validation. - `keyword` and `author_name` are inserted into HTML text contexts without escaping. The script applies limited manual escaping only to note titles. That protection does not cover the other fields and is not a substit ...[truncated 2131 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/fetch_xhs_hot_articles.py (reported line 94)May include surrounding context.
python
body = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request(url, data=body, headers=headers, method="POST") with urllib.request.urlopen(req, timeout=30) as resp: status_code = resp.status resp_bytes = resp.read() resp_text = resp_bytes.decode("utf-8")

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is content generation from hot-note analysis, but the implementation footprint reportedly includes third-party API access and local HTML file writing that are not clearly disclosed, while several promised AI-analysis behaviors are not actually implemented. This mismatch is dangerous because users and orchestrators may trust the skill for a narrow, low-risk task while it performs broader data handling and local side effects, increasing the chance of undisclosed data exfiltration or artifact creation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README says users can 'Simply describe your needs in natural language' and gives examples centered on broad phrases like 'Help me write...' and 'Find me...'. These common everyday expressions are not narrowly scoped and the document does not provide exclusion conditions or stricter trigger boundaries, which could cause unintended invocation overlap.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README encourages invocation via very broad natural-language phrases such as '帮我写一篇…' and '帮我找最近…', which can overlap with ordinary user conversation and increase the chance of accidental or over-broad skill activation. Because this skill performs external retrieval and content generation, unintended activation could cause unnecessary data access, surprising behavior, or misuse in contexts where the user did not explicitly intend to call this specific capability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes external APIs via a Python script, depends on an environment API key, and static analysis indicates local file-write capability, but the manifest does not declare any tool scope or permissions boundaries. This creates a least-privilege and transparency problem: the agent may execute networked and filesystem-affecting behavior without explicit user- or platform-visible authorization constraints.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.
md
--- name: xiaohongshu-write description: 专为小红书内容创作打造的一站式笔记生成工具，基于全网每日持续收录的2000+条爆款笔记数据，根据用户输入关键词，精准检索查询平台当下热门爆款笔记，通过AI深度复盘爆款内容的结构、开头逻辑、干货密度与互动话术，提炼核心流量密码与创作要点，严格贴合小红书内容生态与传播逻辑，生成通顺、合规、可直接发布的完整笔记文案，降低创作门槛，高效产出流量内容。仅在主Agent中执行,不派发给子Agent。 ---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.
md
--- name: xiaohongshu-write description: 专为小红书内容创作打造的一站式笔记生成工具,基于全网每日持续收录的2000+条爆款笔记数据,根据用户输入关键词,精准检索查询平台当下热门爆款笔记,通过AI深度复盘爆款内容的结构、开头逻辑、干货密度与互动话术,提炼核心流量密码与创作要点,严格贴合小红书内容生态与传播逻辑,生成通顺、合规、可直接发布的完整笔记文案,降低创作门槛,高效产出流量内容。仅在主Agent中执行,不派发给子Agent。 ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill encourages users to upload personal writing samples for style analysis but does not clearly warn that those samples may be analyzed and potentially sent to external services during processing. This is a privacy and consent issue because personal text can contain identifiable, sensitive, or proprietary information, and users are not given enough notice to make an informed choice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to match generic copywriting requests, not just Xiaohongshu-specific tasks. Over-broad activation increases the chance the skill will run in unrelated contexts, causing unnecessary external searches/API calls and accidental transmission of user prompts or writing samples to third-party services.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest emphasizes generating complete Xiaohongshu post copy based on analyzed hot-note patterns, while this file's core behavior is calling a third-party API to search hot notes and return raw trend metadata. Fetching source material can support creation, but this script itself is an external search/reporting component rather than direct note generation as claimed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes generating publishable Xiaohongshu copy for the user, but this script also persists an HTML analysis report locally. Local file creation is a distinct operational behavior not conveyed by the stated one-stop note-generation description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: 对于 markdown 文件，SQP-2 要求在技能说明中提示可能影响用户数据或系统完整性的行为。这里说明了 --output-file 输出文件路径和默认 HTML 文件名，但没有提醒脚本会在本地创建或覆盖文件，可能导致用户在不知情下修改工作目录内容。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: 该文件是 markdown，适用 SQP-2。文档明确要求配置 COZE_REDFORX_XHS_API 环境变量，并且还提供了 --debug 打印原始 API 响应的选项，但没有任何关于凭证保密、避免在日志或共享输出中暴露敏感信息的用户警示。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The generated HTML hard-codes lang="zh-CN", which imposes a specific language/locale on all outputs. Under the policy, locale constraints should either be user-selectable or clearly documented as region-specific and justified; this file does neither.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

小红书热门笔记数据分析报告

SkillSpector

Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)

Tp4

Vague Triggers

Vague Triggers

Undeclared Tool Scope

Session Persistence

Session Persistence

Missing User Warnings

Vague Triggers

Description-Behavior Mismatch

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Static analysis