中文播客雷达

• Outcome: Review
• Latest audit: May 28, 2026 · 1:10 PM UTC
• Version: 1.0.0

Overview

This podcast analytics skill mostly does what it says, but one tracking script silently creates fake historical subscription data that users could mistake for real trends.

Review before installing if you plan to rely on the trend analysis for decisions: the batch subscription initializer can fabricate past subscriber history without labeling it. Use live API metrics or build history from real future observations, and avoid sending confidential research topics as podcast search terms.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents file read/write, network access, and shell execution capabilities via multiple script and curl/python examples, but declares no permissions or trust boundaries. This creates a transparency and governance gap: users and platforms may invoke a skill that can access local data and make outbound requests without explicit approval or review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior goes beyond the declared purpose by including page scraping of detailed Xiaoyuzhou content and generation of synthetic historical subscription data during initialization. Undisclosed scraping and fabricated analytics are dangerous because they can mislead users about data provenance and cause the agent to collect more content than users reasonably expect.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script claims to fetch real subscription counts, but during initialization it fabricates historical trend data using random values. This creates misleading analytics output that can deceive downstream users into believing the trend history reflects real measurements, undermining trust and potentially driving bad business decisions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill advertises subscription trend tracking and opportunity analysis, but the initialization path seeds 12 weeks of fake history derived from the current value plus randomness. In the context of competitive analysis and content strategy, this is dangerous because users may rely on fabricated growth patterns as if they were factual market intelligence.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### 端点说明

```
GET https://api.xyzrank.top/v1/stats
# 返回所有播客最新订阅统计（含日/月变化）
# 字段: podcast_id, title, latest_count, daily_change, monthly_change

• Confidence: 84% confidence
• Finding: The skill sends user-supplied podcast names/queries and derived identifiers to an external third-party API. External transmission is security-relevant here because the skill does not document consent, data minimization, retention expectations, or any restriction on what user input may be forwarded off-platform.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 返回所有播客最新订阅统计（含日/月变化）
# 字段: podcast_id, title, latest_count, daily_change, monthly_change

GET https://api.xyzrank.top/v1/metrics/{podcast_id}
# 返回单个播客的完整历史趋势（按日期排列）
# 字段: crawl_date, subscriber_count, status_code
# podcast_id 为小宇宙 24 位字符 ID

• Confidence: 84% confidence
• Finding: Historical metrics requests transmit podcast identifiers to an external service and may be combined with user-driven investigative workflows. While expected for this type of tool, the absence of explicit disclosure and controls means user activity and research interests can be exposed to the API provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 字段: crawl_date, subscriber_count, status_code
# podcast_id 为小宇宙 24 位字符 ID

GET https://api.xyzrank.top/v1/podcast/{name}
# 按名称搜索播客，返回匹配列表
# 用于获取 podcast_id
```

• Confidence: 88% confidence
• Finding: The name-search endpoint is more sensitive than static stats because it forwards raw user-entered names/queries to a third party, potentially exposing proprietary research topics or private interests. In a competitive-analysis skill, this context makes external leakage more consequential than a generic public-data lookup.

External Script Fetching

High

• Category: Supply Chain

Content

curl -s "https://api.xyzrank.top/v1/metrics/68981df29e7bcd326eb91d88" | python3 -m json.tool

# 查询所有播客最新统计
curl -s "https://api.xyzrank.top/v1/stats" | python3 -c "import json,sys;d=json.load(sys.stdin);[print(f'{p['title']}: {p['latest_count']:,}') for p in d['data'][:10]]"

# 按名称搜索播客获取 ID
curl -s "https://api.xyzrank.top/v1/podcast/纵横四海" | python3 -m json.tool

• Confidence: 71% confidence
• Finding: This example pipes untrusted network data directly into `python3 -c` over stdin. Even though the shown code appears to parse JSON rather than execute the response, the pattern normalizes combining shell, network, and inline interpreter execution against remote content, which increases the chance of unsafe adaptation and makes review harder.

Static analysis

No suspicious patterns detected.