Xhs Note Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it says, but its cover-image workflow tells the agent to download an API-supplied URL through a shell command into a fixed local path without validation.

Review this skill before installing. The RedFoxHub API-key use is disclosed and expected, but the cover-image workflow should be hardened or avoided unless you trust the returned image URLs and are comfortable with the agent making additional outbound requests and local file writes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/core_workflow.md:170

Finding

Unvalidated Remote Cover URL Used in a Shell Command

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'req' from os.environ.get (line 155, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_note_detail.py (reported line 158)May include surrounding context.

python

req = request.Request(url, data=payload, headers=headers, method="POST")

    try:
        with request.urlopen(req, timeout=30) as resp:
            status_code = resp.status
            body = resp.read().decode("utf-8")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述把技能定位为“作品分析助手”，不仅查询详情，还应进行深度内容分析并给出优化建议，同时支持封面视觉分析和账号定位判断。实际代码仅完成笔记ID解析、调用 noteDetail 接口获取详情，以及对返回数据进行简单格式化和字段增强；没有任何图像处理、内容分析、账号定位推断、建议生成或分析逻辑。批量查询能力与“根据ID或链接查询作品完整信息”这部分是匹配的，但核心分析型能力被明显夸大，因此描述与实际行为存在实质性不一致。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to invoke the skill with broad natural-language requests rather than clearly scoped trigger phrases. In agent environments, vague invocation boundaries can cause accidental activation from ordinary conversation, leading the skill to process unintended note links or IDs and make external API calls using configured credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example phrase "Help me analyze this Xiaohongshu note" is generic enough to overlap with normal user conversation. In a shared assistant context, this increases the risk of unintended tool invocation, which could expose note-derived data, trigger unnecessary outbound requests, or consume the REDFOX_API_KEY-backed service without deliberate user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to invoke the skill with very broad natural-language phrases such as general requests to analyze Xiaohongshu content. Overly broad triggers can cause accidental or context-inappropriate activation, increasing the chance that unrelated user input, untrusted links, or bulk content gets sent to the skill and any connected third-party API without clear user intent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation indicates use of environment secrets (REDFOX_API_KEY) and external network access, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. This weakens least-privilege controls and can allow broader-than-expected access if the runtime grants ambient env or network capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad natural-language requests like '小红书作品分析' and '获取小红书笔记数据', which can match ordinary conversation and cause the skill to activate unexpectedly. Unintended activation matters here because the skill can perform network-backed lookups and consume API-backed resources, potentially sending user-supplied content to external services without sufficiently explicit intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow instructs the agent to fetch a remote URL from note metadata and write it to a local file via curl, but it does not require user consent, URL validation, or restrictions on outbound requests. If the upstream coverImage value is attacker-controlled or unexpected, this can create silent network access and local file writes, and may expose the environment to SSRF-style fetches or unsafe handling of untrusted content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The formatting rules explicitly require Unix timestamps to be converted to YYYY-MM-DD HH:mm in CST, which imposes a specific locale/timezone on all users. This is a natural-language locale policy issue because the file does not provide opt-in, configurability, or a justification that the skill is region-limited.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language description, errors, and CLI help are all hard-coded in Chinese, which forces a specific language without presenting the user with a language or locale choice. Under the stated policy, locale or language constraints should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script sends user-provided note IDs or links to a third-party service (redfox.hk) but does not clearly disclose this in CLI help or require explicit confirmation. While this is not code-execution or data-exfiltration beyond the tool's intended purpose, it is a privacy/transparency issue because users may not realize their inputs are transmitted off-device to an external API.

Content

No source excerpt is available for this finding.