小红书爆款笔记查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.4

Overview

The skill largely matches its Xiaohongshu trend-search purpose, but its bundled report generator has unsafe local file and HTML handling that should be reviewed before installation.

Install only if you are comfortable sending search keywords and date filters to Redfox and configuring a revocable REDFOX_API_KEY. Avoid sensitive query terms, avoid custom output paths, treat generated HTML reports as untrusted, and create calendar subscriptions only when you are comfortable storing the search terms and schedule in a reminder system.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch_xhs_hot_articles.py:225

Finding

Stored HTML Injection in Generated Reports

Content

View full analysis

{idx + 1}. {title}

{author_name}（{fuzzy_count(fans)}粉） · 发布日期：{pub_time}

{scores_html}

🔥 {interactive_count}互动 👍{like_count} ⭐{collect_count} 查看作品 ↗

''' ``` The user-supplied keyword is also inserted directly into the report: ```python

关键词：{keyword} | 时间范围：{time_range}

``` ### Technical Analysis The generated HTML interpolates values from two untrusted sources: 1. The command-line keyword supplied by the user or calling Agent. 2. Fields returned by the remote Redfox API, including `authorNickname` and `shareInfoLink`. These values are inserted into HTML text and attribute contexts without context-aware escaping. In particular: - `keyword` and `author_name` can inject HTML elements or event handlers. - `note_link` is placed in an `href` at ...[truncated 1529 chars]

Remediation

View remediation

``` 6. Add tests using payloads containing quotation marks, angle brackets, event handlers, and dangerous URL schemes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_xhs_hot_articles.py:612

Finding

Arbitrary File Write and Overwrite Through Unrestricted Report Paths

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tainted flow: 'req' from os.environ.get (line 89, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_xhs_hot_articles.py (reported line 91)May include surrounding context.

python

body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
            req = urllib.request.Request(url, data=body, headers=headers, method="POST")
            
            with urllib.request.urlopen(req, timeout=30) as resp:
                status_code = resp.status
                raw = resp.read().decode("utf-8")

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 459)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 461)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 462)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 523)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 529)May include surrounding context.

md

python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 525)May include surrounding context.

md

| SKILL 定义 | `SKILL.md` | 定义 Skill 元数据、意图理解规则、泛化词拓展策略、展示策略、订阅逻辑、自检清单 |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says users can 'Just describe your needs in natural language' without defining clear activation boundaries, constraints, or exclusion examples. For a markdown skill description, this is a vague trigger pattern that can overlap with many ordinary requests and may cause unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README says users can directly describe needs in natural language, but it does not define clear activation boundaries, exclusions, or confirmation requirements. In a main-agent execution context, this can cause the skill to trigger on ordinary conversation and perform unintended external searches or subscription actions, increasing the risk of overbroad tool invocation and data disclosure to a third-party API.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example trigger '看看小红书最近热门' is broad and close to normal conversational phrasing, so it may be matched when a user is merely discussing trends rather than explicitly requesting tool use. Because the skill queries an external service and may return ranked content or lead into follow-on actions, ambiguous triggers raise the chance of accidental invocation and unintended third-party data sharing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool/permission scope while its documented behavior requires access to environment variables, network, and local file writing. That mismatch weakens least-privilege boundaries and can let a host agent grant broader capabilities than users expect, especially since the skill also writes local HTML reports and calls an external API.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill expands from search/recommendation into persistent subscription creation, which changes it from a read-only retrieval tool into one that can create future actions on the user's behalf. That scope expansion increases risk because it introduces side effects and persistence not implied by the core search function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The examples and mandatory output wording instruct the agent to use fixed Chinese response phrases such as replying with 拓展/不拓展, and the document repeatedly mandates exact output formats in Chinese. There is no indication that the skill should adapt to the user's preferred language or obtain opt-in for this locale constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow mandates use of an external calendar_create tool to create recurring tasks using current query parameters, introducing cross-tool action beyond the stated search scope. This is dangerous because it can persist user interests, automate future behavior, and store query details in another system without strong scoping or privacy safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The subscription flow stores current search parameters in calendar entries and sets up automatic future pushes, but it does not provide a privacy warning or explain the retention/sharing implications. Query terms may reveal business strategy, health interests, or other sensitive topics, so silently persisting them in another tool creates avoidable privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes sending user-supplied search keywords and related parameters to a third-party API without clearly warning users that their input leaves the local environment. In a content-research skill, keywords may reveal business plans, campaign themes, or other sensitive interests; undisclosed transmission creates a real privacy and data-governance risk even if no code execution is involved.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a tool for keyword search and ranking/recommending hot Xiaohongshu notes based on data. In addition to returning structured search data, the code always generates and writes a local HTML report file, which is a broader output side effect not stated in the skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Natural-language policy review applies to all file types. The README consistently presents the skill in Chinese only, including headings, instructions, and example utterances, without offering users a language/locale choice or documenting that the Chinese-only interface is a justified regional constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill generates a local HTML report as a side effect but does not clearly warn users up front in the description. Undisclosed file creation is a transparency and safety issue because it can surprise users, leak sensitive query terms in filenames, or leave artifacts on shared systems.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The core rule explicitly says that for generalized terms the agent must not call scripts and must stop after outputting expansion recommendations. But the later example says '已查询近期热门趋势' while presenting the pre-query recommendation step, which contradicts the documented no-script/no-query requirement for that stage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.