多平台账号主页视频提取器

• Outcome: Review
• Latest audit: Aug 4, 2026 · 7:39 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it enables bulk watermark-free downloading of third-party videos with weak scoping and compliance warnings.

Install only if you are comfortable sending target account IDs, video URLs, and your REDFOX_API_KEY to redfox.hk. Use it only for content you own, are authorized to download, or may lawfully process, and avoid exposing full generated download links in shared chats or logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill directs execution of a Python script that reads environment variables, performs network requests to a third-party API, and writes downloaded media to local storage, yet it declares no permissions or equivalent capability disclosure. This creates a transparency and governance gap: users or hosting systems cannot accurately assess that secrets, local files, and outbound network access are required before invocation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly promotes watermark removal, bulk downloading, offline hoarding, and reuse for secondary creation, but it does not present clear legal, privacy, copyright, or platform-terms warnings. In this context, the omission materially increases misuse risk by normalizing potentially unauthorized mass acquisition and redistribution of content, especially across multiple platforms.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The top-level trigger phrases are broad enough to match ordinary requests like '视频保存' or generic '批量下载视频', which can cause unintended activation in contexts where the user did not mean to invoke a bulk scraping/downloading tool. Because this skill performs third-party content retrieval and downloading, accidental activation increases the risk of privacy, copyright, and policy violations.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The agent trigger examples include vague phrases like '帮我下载 xxx 的主页视频', which are too ambiguous for a high-impact skill that bulk extracts and downloads account content. In context, such ambiguity is more dangerous because the skill is designed for mass retrieval across multiple platforms and can operationalize questionable content collection with minimal friction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description actively promotes bulk downloading, competitor analysis, offline hoarding of tutorials, and secondary editing of others' content, but provides no warning about privacy, copyright, terms-of-service, or lawful-use constraints. In this context, the omission materially increases misuse risk by normalizing potentially non-compliant collection and reuse of third-party account content.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The skill mandates that the agent always display complete downloadable resource links for every work and forbids minimization or summarization. Exposing raw direct-download URLs in chat can leak access-controlled or ephemeral media links to users, logs, or downstream systems, and it unnecessarily maximizes data disclosure beyond what is needed to fulfill many requests.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The function comment explicitly instructs callers to display complete output, including full resource download links and all rows without omission. In this skill's context, those links may be signed, user-specific, temporary, or otherwise sensitive URLs, so forcing verbatim disclosure increases the chance of leaking access tokens or exposing copyrighted/private media endpoints in chat transcripts.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

• Confidence: 86% confidence
• Finding: requests.post(url, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "download_url": None, "title": None, "cover": None,

• Confidence: 85% confidence
• Finding: requests.post(url, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

• Confidence: 89% confidence
• Finding: requests.post(url, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "download_url": None, "title": None, "cover": None,

• Confidence: 90% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.