Security audit
Security checks for vulnerabilities and agentic risk
The skill has a real Bilibili report purpose, but its scheduled subscription, credential handling, HTML generation, hardcoded key, and people-investigation mode need Review before use.
Review carefully before installing. Use only a revocable, low-scope RedFox key; avoid enabling subscription until the scheduler and plaintext key storage are fixed; do not share generated reports if they may contain untrusted content; and avoid the person-background investigation mode unless the publisher adds clear privacy safeguards and user controls.
assets/daily_report.py:816Stored HTML and Script Injection in Automatically Opened Reports
assets/daily_report.py:1177Shell Command Injection in Persistent Task Installation and Removal
assets/daily_report.py:1124API Key Stored in Plaintext LaunchAgent Configuration
references/investigator-config.json:5Hardcoded Shared API Key in Distributed Configuration
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
用户配置并退出
error(f"未检测到 {ENV_KEY}，请先配置 API Key：")
if sys.platform == "win32":
print(f" Windows PowerShell: [Environment]::SetEnvironmentVariable('{ENV_KEY}', 'ak_你的密钥', 'User')")
else:
print(f" macOS/Linux (zsh): echo 'export {ENV_KEY}=ak_你的密钥' >> ~/.zshrc && source ~/.zshrc")
print(f" macOS/Linux (bash): echo 'export {ENV_KEY}=ak_你的密钥' >> ~/.bashrc && source ~/.bashrc")
print(f" 免费注册获取 Key: https://redfox.hk/login")
print()
sys.exit(1)
# ─── 数据获取 ──────────────────────────────────────────────────────────────────────
def fetch_batch(session, keywords, keyword, start_time=None, end_time=None):
"""批量获取多关键词的视频数据（新 batch 接口）
Args:
keywords: 关键词
The report-generation path injects the API key into the generated HTML via html.replace("{{API_KEY}}", api_key or ""). This can expose the credential to anyone who opens, shares, uploads, or inspects the report file, turning a local report into a secret-leak vector.
Embedding the API key into HTML without a prominent user-facing warning causes silent credential disclosure. Because the file is saved to a common user directory and then opened in a browser, the chance of accidental sharing or local exposure is substantial.
The subscription installer writes the API key into a LaunchAgent plist EnvironmentVariables block, persisting the secret on disk without clear disclosure. This increases the attack surface because local users, backups, support bundles, or malware may later recover the credential from the plist.
The subprocess call uses shell=True with string interpolation of script_path into a shell pipeline, enabling tool-parameter abuse and command injection if the path contains crafted shell syntax. Because the command rewrites crontab entries, exploitation could both execute arbitrary commands and alter persistence state.
else:
script_path = os.path.abspath(__file__)
try:
subprocess.run(
f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
shell=True, check=True, capture_output=True
)
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>B站AI信息源 - {{DATE}}</title>
<!-- Fonts: Archivo Black (display) + Space Grotesk (body) -->
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Archivo+Black&family=Space+Grotesk:wght@300;400;500;600;700&display=swap" rel="stylesheet">
The '人物背景调查' section explicitly instructs the agent to profile individuals, verify biography and reputation, and search for controversy or lawsuits. For a skill whose stated purpose is Bilibili AI feed/report generation, this is unjustified and materially more dangerous because it enables doxxing-adjacent behavior, reputational screening, and collection of sensitive personal information outside the skill's legitimate scope.
The人物背景调查报告 template introduces a person-investigation capability that is not aligned with a B站 AI information-source skill and can facilitate profiling of individuals, collection of reputation signals, location, education, disputes, and litigation data. In context, this is more dangerous because the skill presents itself as a media/topic intelligence tool, so hidden person-background workflows can be invoked without clear user expectation, consent boundaries, or safeguards against privacy abuse.
The configuration embeds a default API key and a remote record-saving endpoint, indicating that collected investigation data may be transmitted off-platform without clear user-facing disclosure or consent. This is dangerous because sensitive queries, investigation targets, and derived records could be exfiltrated to a third-party service, and the hardcoded default credential may also be abused by anyone with access to the skill artifacts.
The '人物背景调查' mode enables background investigations on individuals, which is not justified by the declared purpose of producing B站 AI content reports. In this context, the capability creates a heightened risk of doxxing, privacy intrusion, profiling, or misuse of the skill for surveillance of real people without meaningful user warning or purpose limitation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Precise Trending Discovery**: Filters high-engagement AI videos from Bilibili, ensuring no important daily AI updates are missed.
- **Auto Topic Clustering**: Intelligently identifies directions such as AI tutorials, large models, and AI art — categories are determined dynamically by the day's content, no manual sorting needed.
- **In-depth Intelligence Investigation**: Automatically performs multi-search-engine cross-validation on hot topics and delivers structured reports with credibility labels.
- **One-click Visualization**: Dark-themed HTML daily report with cover images, engagement data, and video links for a clear overview of daily AI trending content.
**Target Audience**
The feature description mentions daily subscription and cumulative local saving, but it does not prominently warn users that enabling subscription causes automatic recurring local storage. Users may unknowingly create persistent files, consume disk space, or retain potentially sensitive query history and generated reports on the device.
The README instructs users to invoke the skill through open-ended natural language without clearly constraining allowed operations or requiring confirmation for sensitive actions like subscriptions or local file generation. In a tool that can fetch external data, generate HTML, and enable recurring tasks, broad invocation guidance increases the chance of unintended actions, prompt ambiguity, or abuse through overly permissive requests.
The subscription feature is described as automatically generating reports and saving them to a local folder, but the README does not clearly warn users about ongoing background file writes, storage growth, or where data will be written. This reduces transparency and can cause persistent local side effects that users may not expect, especially if reports include externally sourced content or accumulate over time.
The invocation guidance is broad enough that the skill may be triggered for a wide range of loosely related phrases, increasing the chance of accidental activation. In this skill's context, accidental activation could lead to unintended external queries, report generation, or local output creation that the user did not specifically request.
The README instructs the skill to automatically fetch the latest date with available data, which conflicts with the stated requirement that if the requested target date has no data, the user must first be informed and explicit confirmation obtained before any API call. This can cause unauthorized or unexpected data retrieval, violating user-consent and control expectations in a way that may trigger external requests without approval.
The skill invokes shell commands, reads environment variables for API keys, performs network requests, and writes files, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an overly broad and opaque execution boundary: a host agent may enable powerful capabilities without users or reviewers being able to verify what the skill is supposed to access, increasing the risk of command execution, unintended data exposure, and filesystem modification.
The activation text contains broad trigger phrases such as requests related to AI-B站日报, 爆款, 热点, 情报, and custom keyword queries, which can cause the skill to activate for loosely related user requests. In combination with shell and network behavior, ambiguous activation increases the chance of unintended execution, external requests, and data processing when the user did not clearly consent to using this specific skill.
The skill explicitly performs automatic multi-engine web searches and cross-validation based on user topics and clustered report topics, but it does not clearly warn users that their queries or derived topics will be transmitted to external search engines. This is a privacy and consent issue: sensitive interests, internal project names, or proprietary keywords provided by the user could be sent to third-party services without sufficiently explicit notice at the point of use.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 15:00前：最新可用日期 = T-2；15:00后：最新可用日期 = T-1
DATA_UPDATE_HOUR = 15 # 数据更新时间（小时）
PLIST_LABEL = "com.qoder.bili-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 15:00前：最新可用日期 = T-2；15:00后：最新可用日期 = T-1
DATA_UPDATE_HOUR = 15 # 数据更新时间（小时）
PLIST_LABEL = "com.qoder.bili-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 15:00前：最新可用日期 = T-2；15:00后：最新可用日期 = T-1
DATA_UPDATE_HOUR = 15 # 数据更新时间（小时）
PLIST_LABEL = "com.qoder.bili-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 15:00前：最新可用日期 = T-2；15:00后：最新可用日期 = T-1
DATA_UPDATE_HOUR = 15 # 数据更新时间（小时）
PLIST_LABEL = "com.qoder.bili-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 15:00前：最新可用日期 = T-2；15:00后：最新可用日期 = T-1
DATA_UPDATE_HOUR = 15 # 数据更新时间（小时）
PLIST_LABEL = "com.qoder.bili-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 15:00前：最新可用日期 = T-2；15:00后：最新可用日期 = T-1
DATA_UPDATE_HOUR = 15 # 数据更新时间（小时）
PLIST_LABEL = "com.qoder.bili-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
No suspicious patterns detected.