全网热搜榜查询 - 聚合数据

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it claims, but it handles the required API key insecurely by sending it over plaintext HTTP and documenting risky key-passing methods.

Review before installing. Prefer using the JUHE_HOTSEARCH_KEY environment variable, avoid passing the key on the command line, do not commit scripts/.env, and be aware that this version sends the key to Juhe over plaintext HTTP unless the endpoint is changed to HTTPS.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/network_hot_list.py:26

Finding

API Credential Transmitted over Plaintext HTTP

Content

View full analysis

dict: """Query the network hot list.""" params = urllib.parse.urlencode({"key": api_key}) url = f"{API_URL}?{params}" try: with urllib.request.urlopen(url, timeout=10) as resp: data = json.loads(resp.read().decode("utf-8")) ``` The insecure endpoint is also explicitly documented at `SKILL.md:69`: ```text GET http://apis.juhe.cn/fapigx/networkhot/query?key=YOUR_KEY ``` ### Technical Analysis The script embeds the API key in a URL query parameter and sends the request to an `http://` endpoint. HTTP does not provide transport encryption, server authentication, or integrity protection. Consequently, the API credential and response are visible to systems located along the network path. Query-string credentials can also be retained in HTTP proxy logs, gateway logs, monitoring systems, and server access logs. Although communicating with the Juhe API is necessary for the Skill's declared hot-list functionality, transmitting the credential without TLS exceeds acceptable risk and is not necessary if an HTTPS endpoint is available. The lack of response integrity protection also allows an active network attacker to modify the returned JSON. While the response is only formatted and displayed rather than executed, manipulated data could mislead users or downstream programs consuming the script's JSON output. ### Attack Path 1. A user configures a valid `JUHE_HOTSEARCH_KEY` and runs the Skill. 2. The script constructs a URL containing the credential, such as: `http://apis.juhe.cn/fapigx/networkhot/query?key=SECRET`. 3. The request crosses a network controlle ...[truncated 1068 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/network_hot_list.py:154

Finding

API Key Exposed through Command-Line Arguments

Content

View full analysis

str: """Load the API key according to configuration priority.""" if cli_key: return cli_key env_key = os.environ.get("JUHE_HOTSEARCH_KEY", "").strip() if env_key: return env_key ``` ### Technical Analysis Command-line arguments are not an appropriate channel for secrets. Depending on the operating system and execution environment, process arguments may be visible to other local users through process-inspection facilities. They may also be captured by shell history, terminal logging, job schedulers, endpoint monitoring tools, audit systems, CI/CD logs, or orchestration telemetry. This exposure is avoidable because the script already supports the `JUHE_HOTSEARCH_KEY` environment variable and a local `.env` file. Therefore, the command-line credential option is not required for the Skill's core functionality and unnecessarily expands the credential's exposure surface. ### Attack Path 1. A user follows the documented example and starts the script with `--key SECRET`. 2. The shell may save the complete command in its history file. 3. While the process is running, another local user or monitoring process may inspect its argument list. 4. Alternatively, an automation, CI/CD, or endpoint-monitoring system records the process command line in logs. ...[truncated 819 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly instructs users to place an API key into scripts/.env, which is a credential-bearing local file that may be accidentally committed, shared, or read by other tooling if not protected. In the context of an agent skill, normalized instructions for storing secrets in project files materially increase credential exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

# 方式一：环境变量（推荐，一次配置永久生效）
export JUHE_HOTSEARCH_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_HOTSEARCH_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The example command passes the API key directly as a CLI argument, which can leak secrets via shell history, process inspection, logs, and job-control tooling. This is a well-known insecure credential pattern and is more dangerous in shared or multi-user environments.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

export JUHE_HOTSEARCH_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_HOTSEARCH_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/network_hot_list.py --key 你的 AppKey

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/network_hot_list.py (reported line 14)May include surrounding context.

python

API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python network_hot_list.py --key your_api_key
    2. 环境变量：export JUHE_HOTSEARCH_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_HOTSEARCH_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/739
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/network_hot_list.py (reported line 183)May include surrounding context.

python

API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python network_hot_list.py --key your_api_key
    2. 环境变量：export JUHE_HOTSEARCH_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_HOTSEARCH_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/739
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/network_hot_list.py (reported line 39)May include surrounding context.

python

if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents and implicitly requires network access, environment-variable access, and local file interaction, but it does not declare an explicit tool/permission scope. That weakens least-privilege controls and can cause the agent to invoke broader capabilities than users or the platform expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad everyday-language requests like '查热搜' and '现在什么最火', which can cause the skill to activate in contexts where the user did not intend a third-party network call. This increases the chance of surprising behavior, unnecessary data transmission, and accidental invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends requests to a third-party API but does not clearly instruct the agent to disclose that user requests will be transmitted off-platform. Missing privacy and network disclosure can prevent informed consent and may expose user query content to an external provider unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

All user-facing descriptions, activation examples, and operating instructions are written exclusively in Chinese, which effectively forces a specific language for use of the skill. The file does not indicate that this is an intentional region-specific tool or offer any opt-in or alternative language handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The documentation shows multiple ways to supply the API key, including command-line arguments and writing to a local .env file, but it does not warn that these methods can expose credentials through shell history, process listings, or accidental file inclusion. This creates avoidable credential-handling risk for users following the examples verbatim.

Content

No source excerpt is available for this finding.