小红书标题生成

• Outcome: Pass
• Latest audit: Jun 5, 2026 · 3:53 AM UTC
• Version: 1.0.3

Overview

This skill uses a disclosed RedFox API key to fetch Xiaohongshu trend data and generate title suggestions, with some scope and local-file handling notes users should understand.

Install only if you are comfortable giving this skill a RedFox API key and sending selected Xiaohongshu topic keywords to redfox.hk. Use it for explicit title-generation tasks, avoid sensitive personal or confidential prompts, and run it in a workspace where generated Markdown reports and referenced content links are acceptable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises a simple title-generation workflow but instructs the agent to use environment variables, invoke a Python script, make outbound network requests, and write local Markdown files without declaring those capabilities. Undeclared network/file/env access weakens user consent and platform policy enforcement, and can expose secrets or create unexpected side effects during routine use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: There is a clear mismatch between the stated purpose ('generate Xiaohongshu titles') and the actual behavior, which includes contacting an external service, requiring an API key, collecting third-party content metadata, and saving analysis outputs locally. This is dangerous because users and hosts may invoke the skill assuming a low-risk text transformation, while it actually performs authenticated external data access and persistence.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The implementation materially differs from the skill description: instead of only generating Xiaohongshu titles, it fetches third-party trend analytics using an external credentialed service. This expands data access and network behavior beyond user expectations, which can enable unintended data sharing, hidden dependencies, and privilege creep in an agent environment.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The script produces detailed analytical reports, author profile links, note links, and other structured outputs rather than title-generation results promised by the manifest. In an agent ecosystem, this kind of capability mismatch is dangerous because downstream systems or users may grant trust and permissions based on the narrower stated purpose while the code performs broader reconnaissance-like aggregation.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code consumes an external-service API credential despite the manifest describing a title-generation tool that would not obviously require authenticated third-party access. This mismatch increases risk because operators may provision secrets under false assumptions, and the skill gains networked capabilities not transparently disclosed in its advertised scope.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script emits cover-image URLs for downstream 'style analysis', which is an undeclared secondary capability beyond simple title generation. Exposing additional content URLs can facilitate further scraping, profiling, or chained analysis by other tools without explicit user awareness or consent.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The inline comment explicitly states that cover URLs are intended for style analysis, contradicting the manifest's claim that the tool's final goal is always title generation. This inconsistency is a governance and trust issue: it suggests undeclared functionality and increases suspicion that the skill may be used for broader content analysis than advertised.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The usage guidance says users can provide "any information" in plain language and that no commands need to be memorized, which makes the trigger surface extremely broad. In an agent setting, overly permissive invocation criteria can cause the skill to activate on unrelated or sensitive user input, leading to unintended processing, prompt-scope capture, or leakage of context into title-generation behavior.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to invoke the skill with broad natural-language requests such as simply describing a product or topic, which increases the chance of accidental triggering during unrelated conversation. In an agent environment, overly broad activation guidance can cause the skill to engage when the user did not explicitly intend to use it, potentially sending prompts or derived content to external services and producing unexpected actions.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The description says the skill should act on 'any user input,' creating an effectively always-on trigger scope. Overbroad invocation increases the chance that unrelated conversations, sensitive inputs, or unsafe contexts will be redirected into external querying and file-generation behavior without meaningful user intent.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The repeated instruction that 'no matter what the user inputs' the final goal is title generation reinforces an ambiguous, always-on execution policy. In context, this is more dangerous because the skill is not purely generative; it may trigger external API access and local file creation even when the user's message was not intended to authorize those actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill mentions querying hot-note data and generating outputs, but it does not clearly warn users that it will contact an external service and create local Markdown files as side effects. Hidden side effects undermine informed consent and can lead to unintended disclosure, storage, or compliance issues in constrained environments.

Static analysis

No suspicious patterns detected.