皮皮虾社区数据采集

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 3.6.1

Overview

The skill mostly matches a PiPiXia data-query purpose, but it contradicts its read-only promise by advertising view-count manipulation and includes unrelated fallback routes.

Review this skill before installing. It is not clearly malicious, but the read-only promise is unreliable because the package advertises a view-count increase tool and includes non-PiPiXia fallback routes. Use it only with a MaxHub API key you are comfortable scoping to this provider, avoid submitting private or token-bearing URLs to the short-link feature, and do not rely on it as a purely read-only data assistant unless those mismatched parts are removed or clarified.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/api-search-trending.md:116

Finding

Arbitrary URLs May Be Disclosed to the External API Provider

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:78

Finding

Read-Only Security Declaration Contradicts Advertised View-Count Manipulation

Content

View full analysis

- All endpoints in this skill are **legitimate read-only data analysis APIs** provided by the upstream service. > - This skill performs **read-only data queries** only. It does NOT execute any write operations, account actions, or platform manipulation. ``` The English README advertises a tool that changes engagement metrics: ```markdown ## Features - **Post & User** — fetch_single_video, fetch_post_statistics, fetch_post_comments, fetch_user_info, fetch_user_posts, fetch_user_following, fetch_user_followers - **Search & Trending** — fetch_search, fetch_hot_search_board_list, fetch_hot_search_board_detail, fetch_hot_search_words, fetch_hashtag_detail, fetch_hashtag_posts, fetch_home_feed, fetch_home_short_drama - **Tools** — generate_short_url, increase_post_view_count ``` The API reference at `references/api-post-user.md:111-134` additionally contains an orphaned parameter block for a post ID and post type whose documented purpose is to increase a post's view count. That block lacks an operation heading and callable path. ### Technical Analysis Increasing a post's view count is a state-changing engagement operation. It is neither read-only analysis nor passive data collection. Advertising that capability directly contradicts the security declaration on which users and an Agent may rely when deciding whether to authorize the Skill. The capability also exceeds the minimum privileges required for the declared functionality of querying posts, users, search results, trends, comments, and topics. Engagement modification is not necessary to retrieve or analyze that informatio ...[truncated 1699 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate hidden-instruction finding is also valid because the skill relies on concealed comment-based path directives for request construction. Such hidden control channels make it easier to hide unexpected routing behavior or alter execution semantics without clear reviewer visibility.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate hidden-instruction finding is also valid because the skill relies on concealed comment-based path directives for request construction. Such hidden control channels make it easier to hide unexpected routing behavior or alter execution semantics without clear reviewer visibility.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The security declaration claims all endpoints are legitimate read-only PiPiXia APIs, but the document later instructs use of unrelated platform endpoints. This is dangerous because it misrepresents the skill’s actual behavior and can cause operators or users to approve broader data access than intended.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

| "analyze" / "分析一下" | Switch to analyze mode |
| "compare with X" / "和X对比" | Add X as second query |

## Output Guidelines

1. **Language consistency** — ALL output matches user's detected language.
2. **Markdown links** — All URLs in `[text](url)` format.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is presented as a PiPiXia-only assistant, but its fallback logic references unrelated Douyin and Xiaohongshu endpoints. This broadens the operational scope beyond what is disclosed, creating a capability mismatch that can route user data and queries to unintended platforms and undermines trust in the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 11)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_hashtag_detail`

<!-- Full path: /api/v1/pipixia/app/fetch_hashtag_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 75)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_hot_search_board_detail`

<!-- Full path: /api/v1/pipixia/app/fetch_hot_search_board_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 143)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_post_comment_list`

<!-- Full path: /api/v1/pipixia/app/fetch_post_comment_list -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 172)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_post_detail`

<!-- Full path: /api/v1/pipixia/app/fetch_post_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 199)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_post_statistics`

<!-- Full path: /api/v1/pipixia/app/fetch_post_statistics -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 224)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_user_follower_list`

<!-- Full path: /api/v1/pipixia/app/fetch_user_follower_list -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 278)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_user_info`

<!-- Full path: /api/v1/pipixia/app/fetch_user_info -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search-trending.md (reported line 11)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_home_feed`

<!-- Full path: /api/v1/pipixia/app/fetch_home_feed -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search-trending.md (reported line 61)May include surrounding context.

md

`GET /api/v1/pipixia/app/fetch_hot_search_words`

<!-- Full path: /api/v1/pipixia/app/fetch_hot_search_words -->

### Parameters

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation instruction uses npx clawhub without pinning an exact package version, which allows the latest published package to be fetched at execution time. If the upstream package is compromised, typosquatted, or updated with malicious code, users installing this skill could execute attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README lists an increase_post_view_count tool but does not warn that it changes external state and may have policy, abuse, or account-impact consequences. Omitting this context can mislead users into invoking a manipulation-oriented function without understanding the risks, which is more dangerous in a social-media automation skill than in a purely informational tool.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx clawhub install maxhub-pipixia without pinning a specific version. This creates a supply-chain risk because users may fetch whatever package version is current at execution time, including a compromised or malicious update. In a skill-installation context, this is more dangerous because installation commands are likely to be copied and executed directly by users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger words are extremely broad terms such as '作品', '用户', '搜索', '热搜', '短链接', and '浏览'. Such generic triggers can overlap with normal conversation and cause unintended invocation of the skill or execution of side-effecting functions. This is especially risky here because the skill exposes actions like short-link generation and view-count increase, so accidental triggering is more consequential than in a read-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill advertises comment collection and user/profile analysis without meaningful privacy guidance or limits on handling user-generated data. In a data-collection context, this can normalize broad profiling or scraping behavior and increase the risk of processing personal data without adequate notice or minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

# GET example
curl -s "https://www.aconfig.cn/api/v1/pipixia/{endpoint}?{params}" \
  -H "$maxhub_auth_header"

# POST example

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction says all output must match the user's detected language, which imposes a language policy automatically rather than letting the user choose. This can violate locale/language choice requirements because no opt-in or override mechanism is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document structure is inconsistent: under the hot-search-board-list area it appears to introduce a different behavior that increases post views. This mismatch can mislead an agent into selecting the wrong endpoint or obscure the fact that the operation is mutating rather than read-only, increasing the chance of accidental misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section documents an operation that increases a post's view count, which goes beyond the skill's stated purpose of data querying and crosses into state-changing engagement manipulation. Even though this is only documentation, it can cause an agent or integrator to invoke the endpoint as if it were a normal read API, leading to unauthorized or deceptive platform interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation describes increasing a post's view count without any warning that it changes platform-visible engagement data. In an agent setting, omission of that warning is dangerous because the model may treat it like benign analytics retrieval and trigger deceptive or policy-violating behavior without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents use of Authorization: Bearer $MAXHUB_API_KEY, which involves a sensitive credential. The file does not include any warning or handling guidance about protecting the API key, avoiding accidental exposure, or ensuring users understand credential use when calling these endpoints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.