Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it says, but its local HTML report generation has concrete file-write and HTML-injection risks, and subscriptions persist search details in calendar tasks.
Install only if you are comfortable giving the skill a Redfox API key, allowing it to write local HTML reports, and optionally creating calendar subscriptions. Open generated reports cautiously, avoid sensitive keywords on shared systems, and prefer a fixed safe output directory until the report escaping and filename handling are fixed.
scripts/fetch_xhs_hot_articles.py:225Persistent HTML Injection in Generated Reports
scripts/fetch_xhs_hot_articles.py:616Directory Traversal Through the Default HTML Report Filename
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
req = urllib.request.Request(url, data=body, headers=headers, method="POST")
with urllib.request.urlopen(req, timeout=30) as resp:
status_code = resp.status
raw = resp.read().decode("utf-8")
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Referenced artifact was not completely inspected
| SKILL 定义 | `SKILL.md` | 定义 Skill 元数据、意图理解规则、泛化词拓展策略、展示策略、订阅逻辑、自检清单 |
Line L090 says users can 'Just describe your needs in natural language' without defining boundaries, trigger scope, or negative examples. This is ambiguous for a markdown skill description because many ordinary requests could match, making it unclear when this skill should activate versus other skills.
The entire skill documentation, examples, and interaction wording are presented only in Chinese, with no indication that users may choose another language or locale. This can violate language-choice policy when the skill effectively assumes a fixed language without explicit opt-in or documented regional justification.
The README says users can 'directly use natural language to describe your needs' without any command format, but it does not define clear trigger boundaries, exclusions, or constrained invocation phrases. This is ambiguous enough to overlap with ordinary conversation and could cause unintended activation of the skill.
The skill declares no explicit tool scope or permissions despite clearly requiring environment-variable access, network access to the Redfox API, and local file creation for HTML reports. This weakens least-privilege controls and creates room for unintended tool use or capability expansion if the host agent interprets the document broadly.
The manifest describes a search-and-recommend skill, but the documentation also introduces timed subscription behavior and calendar task creation. This is a scope expansion vulnerability because an agent or user may authorize a search tool without realizing it can persist data and create scheduled actions.
The documentation advertises HTML report generation but does not clearly warn users that running the search writes a local file. Undisclosed file creation can surprise users, leak search terms through filenames, and create residual artifacts on shared or monitored systems.
The skill hard-codes required user replies such as "拓展", "不拓展", and other Chinese response formats throughout the instructions, effectively enforcing a specific language for interaction. There is no opt-in or alternative language handling documented, which is a locale/language policy concern.
The skill instructs the agent to create calendar or scheduled tasks after showing search results, which goes beyond the minimum capability needed for content discovery. Persistent scheduled actions can store user interests and trigger future behavior, increasing privacy and consent risks if users do not fully understand what is being created.
The subscription flow directs use of calendar_create without a clear warning that search keywords, time ranges, and schedule preferences will be stored in a calendar/task system. This creates a transparency and privacy issue because users may disclose sensitive interests without informed consent to persistence.
Documenting a --debug mode that prints raw API responses without any warning encourages logging of full upstream payloads, which may contain API metadata, identifiers, content, or other sensitive business/user data. In this skill context, the tool handles externally sourced content and uses an API key-backed service, so verbose raw-response logging increases the chance of accidental data leakage into terminal history, CI logs, agent traces, or shared artifacts.
The HTML output sets lang="zh-CN", which forces a specific language/locale in generated content. Under the policy, locale constraints should be optional, user-selected, or clearly justified as region-specific; this file does not provide such opt-in or justification.
The manifest describes a search/recommendation tool for discovering hot notes, which implies fetching and returning content data. This script additionally persists a rendered HTML report locally every run, even though file output is not mentioned in the stated skill purpose and is not necessary to perform the search itself.
The documentation first says the agent must not add recommendations or suggestions before outputting results, and elsewhere repeatedly requires proactive recommendation of finer-grained tracks and mandatory subscription prompts after output. This is not merely incomplete wording: the instructions describe incompatible operator intent about whether unsolicited recommendations should be made.
No suspicious patterns detected.