小红书标题生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:01 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its title-generation purpose, but it needs review because it uses an API key, broad network/file access, and unsafe command/file-writing instructions.

Review before installing. Use it only if you are comfortable giving a RedFox API key and sending Xiaohongshu keyword topics to redfox.hk. Prefer explicit title-generation requests only, run the Python script through argument arrays rather than shell string interpolation, restrict output to a dedicated directory, and pin the requests dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:122

Finding

Potential shell command injection through unquoted keyword substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:122-125
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable code:

bash

# With a category keyword
python scripts/fetch_xhs_trends.py --keyword <关键词> --start-date <日期>

# Without a category keyword
python scripts/fetch_xhs_trends.py --keyword "" --start-date <日期>

Technical Analysis

The Skill instructs the Agent to extract a keyword from user input and substitute it into a shell command. The keyword placeholder in the documented command is not quoted, and the instructions do not require use of a structured process API that bypasses shell parsing.

If an Agent constructs and executes this command through a shell, a keyword containing shell metacharacters such as command separators, substitutions, redirections, or pipelines may be interpreted as shell syntax rather than as a single argument. Python's argparse does not mitigate this issue because exploitation occurs in the shell before the Python process receives its arguments.

The Python script itself does not invoke a shell. The vulnerability is in the Skill's command-construction instructions and therefore depends on the host Agent interpolating user input into the documented command.

Attack Path

1. An attacker submits a title-generation request containing a keyword with embedded shell syntax.
2. The Agent extracts that attacker-controlled text as the keyword.
3. Following SKILL.md, the Agent substitutes the keyword directly into the unquoted command template.
4. The Agent executes the constructed string through a shell.
5. The shell parses the injected syntax and executes attacker-selected commands in addition to the intended Python script.

Impact Assessment

Successful exploitation could execute arbitrary local commands with the same operating-system privileges as the Agent. Depending on those privileges, the attacker could read or modif ...[truncated 268 chars]

Remediation

View remediation

Remediation Suggestions

• Require invocation through a process API using an argument array, with shell execution disabled. For example:

  python

  subprocess.run(
      [
          sys.executable,
          "scripts/fetch_xhs_trends.py",
          "--keyword",
          keyword,
          "--start-date",
          start_date,
      ],
      shell=False,
      check=True,
  )
  

• If a shell command must be displayed for manual use, require platform-appropriate escaping and quote every substituted argument.
• Validate start-date against a strict YYYY-MM-DD format before invocation.
• Reject control characters and document that user-derived values must never be concatenated into executable command strings.
• Prefer calling fetch_xhs_trends() directly from Python rather than launching a subprocess.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_xhs_trends.py:507

Finding

Arbitrary file creation or overwrite through unsanitized output paths

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_xhs_trends.py:507-515
Vulnerability Type: Path traversal and unsafe file overwrite
Risk Level: Medium

Vulnerable code:

python

# Determine the output file path
output_file = args.output_file
if output_file is None and args.output_format == 'markdown':
    # Default filename is derived directly from the keyword
    output_file = f"{args.keyword}_爆款数据.md"

# Write to a file or the console
if output_file:
    with open(output_file, 'w', encoding='utf-8') as f:
        f.write(output_content)

Technical Analysis

The --output-file argument is accepted without path validation. When no explicit path is provided, the script constructs the output filename directly from the user-controlled keyword. Neither path is restricted to a dedicated output directory.

Python's open(..., 'w') follows absolute paths and relative traversal components and truncates an existing file before writing. Consequently, values containing absolute paths or ../ components can target any file writable by the process. The default keyword-derived path can also create unintended subdirectories or paths when the keyword contains separators, provided the referenced directories exist.

No canonicalization, directory-containment check, safe filename conversion, collision protection, or overwrite confirmation is implemented.

Attack Path

1. An attacker influences the keyword passed to the script or causes an explicit --output-file value to be supplied.
2. The value names an existing writable file or traverses outside the intended project directory.
3. The script assigns that value directly to output_file.
4. open(output_file, 'w') creates or truncates the selected file.
5. The generated report content replaces the previous contents of the target file.

Impact Assessment

Exploitation permits file creation and destructive overwrite within the filesys ...[truncated 395 chars]

Remediation

View remediation

Remediation Suggestions

• Create a dedicated output directory and resolve every destination relative to it.
• Canonicalize the destination and verify that it remains inside the approved directory:

  python

  from pathlib import Path
  
  output_root = Path("output").resolve()
  output_root.mkdir(parents=True, exist_ok=True)
  
  safe_name = sanitize_filename(args.keyword) + "_trends.md"
  destination = (output_root / safe_name).resolve()
  
  if output_root not in destination.parents:
      raise ValueError("Output path escapes the approved directory")
  

• Replace directory separators, traversal sequences, control characters, and platform-reserved filename characters in keyword-derived filenames.
• Remove arbitrary --output-file support unless it is required, or restrict it to a filename rather than an unrestricted path.
• Use exclusive creation mode ('x') by default, or require explicit confirmation before replacing an existing file.
• Consider applying file-size and filename-length limits.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:62

Finding

Unpinned third-party dependency installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:62
Vulnerability Type: Uncontrolled dependency resolution
Risk Level: Low

Vulnerable code:

bash

pip install requests

Technical Analysis

The installation instructions direct users to install requests without specifying a reviewed version, package hash, lockfile, or trusted package index. The documentation also incorrectly describes requests as part of the Python standard library, even though it is a third-party package.

Unpinned resolution makes installations non-reproducible and allows future package releases to be selected without project review. The package retrieved also depends on the user's pip index configuration. Although the package name is spelled correctly and no malicious package was identified in the audited project, the installation procedure does not provide supply-chain integrity controls.

Attack Path

1. A user follows the documented installation command.
2. pip resolves requests and its transitive dependencies from the user's configured package index.
3. The latest version satisfying pip's resolution rules is downloaded without hash verification.
4. A compromised index, compromised future release, or unsafe dependency update could introduce malicious or incompatible code.
5. Installed code runs during normal import or package operation with the user's privileges.

Impact Assessment

The potential impact is bounded by the privileges of the user performing installation or running the Skill. A compromised dependency could access files and environment variables available to the process, including REDFOX_API_KEY, and could perform arbitrary network operations. No compromised dependency or active dependency-confusion package was confirmed during this static audit, so this is a supply-chain hardening deficiency rather than evidence of an embedded malicious dependency.

Remediation

View remediation

Remediation Suggestions

• Declare requests in a dependency manifest and pin it to a reviewed version or constrained version range.
• Produce a lockfile containing transitive dependency versions.
• Use hash verification, such as a requirements file generated with --generate-hashes and installed with pip install --require-hashes.
• Document the approved package index and avoid untrusted mirrors.
• Integrate dependency vulnerability and update scanning into release procedures.
• Correct the documentation to state that requests is a third-party Python package, not part of the standard library.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (17)

Tainted flow: 'headers' from os.getenv (line 47, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_xhs_trends.py (reported line 61)May include surrounding context.

python

if debug:
                print(f"\n=== DEBUG: 第 {attempt + 1} 次尝试 ===", file=sys.stderr)

            response = requests.get(url, params=params, headers=headers, timeout=30)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The manifest presents the skill as a title-generation tool, but the instructions materially expand behavior into authenticated third-party API access, local file generation, and collection/exposure of external content links and metadata. This mismatch weakens user consent and security review because the operational surface is much broader than the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says that regardless of what the user inputs, the skill’s final goal is to generate Xiaohongshu titles. That creates an overbroad activation scope that can hijack unrelated conversations and force tool use or data access in contexts where the user did not intend to invoke this skill.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

The YARA hit appears driven by manifest/metadata patterns associated with tool or routing poisoning, especially the overreaching description that claims applicability to any user input. In this context, the risk is not hidden malware but metadata that can bias agent selection and cause the skill to inappropriately intercept broad classes of requests.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: xiaohongshu-title
description: 基于用户输入的任何信息生成小红书爆款标题的专业工具。无论用户输入什么，最终目标都是生成小红书爆款标题。
dependency:
  python:
  system:
---

# 小红书标题生成

## 1. 简介

基于用户输入的任何信息生成小红书爆款标题的专业工具 -- 通过查询小红书平台真实爆款数据，分析爆款标题的共同特征，结合用户输入的核心主题，自动生成 10 个高匹配度的小红书爆款标题，每个标题附带匹配指数、参考爆款和详细推荐理由。

**适用对象**�

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The core instructions repeat that no matter what the user says, the workflow must proceed toward title generation. In an agent setting, this can override user intent and create prompt-routing or scope-poisoning behavior, making the skill more dangerous because it persistently tries to capture arbitrary requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata claims a narrow purpose of generating Xiaohongshu titles from arbitrary user input, but the code instead performs authenticated trend scraping/analytics retrieval, report generation, and local file output. This capability mismatch is dangerous because it expands data access and network behavior beyond what a user or platform reviewer would reasonably expect, weakening informed consent and trust controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script makes authenticated outbound requests to a third-party service even though the manifest presents the skill as a direct title-generation tool. In skill ecosystems, undisclosed network exfiltration paths are risky because user inputs and operational metadata can be sent off-platform to an external provider without clear expectation or approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The usage guidance says users can 'just describe' their need in plain language, making invocation boundaries very broad and likely to overlap with ordinary conversation. In an agent environment, this can cause the skill to activate unintentionally on unrelated user input, leading to undesired data handling or actions under the skill's prompt logic.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.en.md (reported line 51)May include surrounding context.

md

### Quick-Reference Phrases

| Intent                  | Example                                                                                            | What You Get                                                                |
| ----------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Title for a single item | "Write some viral Xiaohongshu titles for a sunscreen — key selling point: lightweight, non-greasy" | Aligns with viral samples by keyword, analyzes then outputs 10 candidates   |
| Regular track updates   | "Outfit track — want to post about fall/winter coats, give me a title set"                         | Extracts same-track patterns to iterate your title library                  |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example request about wanting to do beauty content but not having decided a direction is a common conversational statement rather than a precise tool invocation. Because the skill's stated goal is to turn essentially any user input into title generation, this increases the chance of accidental triggering and prompt capture from benign dialogue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

For a markdown file, vague trigger language should be flagged when activation conditions are broad or unclear. The statement that users can 'directly use natural language' and need not remember fixed commands does not define trigger boundaries, exclusions, or scope, increasing the chance of unintended invocation from ordinary conversation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities that imply environment-variable access, local file writes, and outbound network use, but it does not constrain them with explicit tool scope or permissions metadata. In an agent ecosystem, this increases the chance that the skill can access secrets, write artifacts, or make network requests beyond what reviewers and users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The wording rules require all outputs to avoid certain Chinese terms and substitute another Chinese term instead, effectively imposing a language-specific output policy. The file does not offer the user a language choice or explain a justified locale restriction for this behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code loads a third-party API credential for an analytics-fetching feature that is not justified by the stated title-generation-only purpose. Unnecessary secret use increases blast radius: a seemingly simple content tool now depends on privileged external access that could be abused or unexpectedly exposed through downstream integrations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code writes fetched analytics reports to local files by default for markdown output, which exceeds the narrow advertised purpose of title generation. Unnecessary persistence increases the chance of sensitive or proprietary fetched data being retained, mishandled, or later accessed by other processes or users on the host.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Several example utterances use broad conversational phrasing such as '帮我...' and '来一组标题', which are common expressions rather than clearly bounded commands. Without explicit activation constraints or exclusion examples, these samples can imply that many ordinary requests may invoke the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The request headers hard-code Accept-Language: zh-CN,zh;q=0.9, which imposes a specific language/locale behavior for all users. The file does not offer a language choice or explain why a China-specific locale is required, so this is a natural-language policy concern.

Content

No source excerpt is available for this finding.