ClawHub
Back to skill

Security audit

B站关键词搜作品

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Bilibili search helper that uses a RedFox API key and optionally describes a user-confirmed daily search subscription.

Install only if you are comfortable giving the skill a RedFox API key and sending Bilibili search keywords to redfox.hk. If you enable daily subscription, use a visible scheduler and keep your own record of how to disable the task later.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs use of an environment-stored API key and a network-backed script, but does not declare corresponding permissions. This creates a transparency and governance gap: reviewers and users cannot accurately assess what the skill can access, increasing the chance of over-privileged or unexpected behavior.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Description-Behavior Mismatch

Medium
Confidence
79% confidence
Finding
The documentation advertises automatic daily subscription/push behavior, but only a one-shot search script invocation is actually defined. This mismatch can mislead users and operators into believing persistent automation exists or is supported safely, encouraging ad hoc cron-based persistence without proper review or controls.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The README says users can 'directly use natural language' without clearly defining scope, exclusions, or confirmation boundaries for actions like search, pagination, and especially subscription creation. In an agent setting, overly broad triggering can cause unintended tool invocation or accidental execution of side-effecting actions when a user's request is ambiguous.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation advertises 'daily push/subscription' behavior but does not clearly warn that this creates an ongoing scheduled task and future automatic notifications. Users may unintentionally authorize persistent monitoring or repeated outbound actions without understanding the continuing effect, which is a meaningful consent and transparency issue.

Vague Triggers

Medium
Confidence
72% confidence
Finding
Broad trigger phrases increase the chance that the skill activates on loosely related user requests. In an agent environment, accidental activation can lead to unintended network calls, unnecessary API-key use, and data retrieval outside user intent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill tells users to place a live API key in config files or shell environment without warning about credential sensitivity, storage hygiene, rotation, or sharing risks. This increases the likelihood of accidental exposure through dotfiles, shell history, screenshots, backups, or repository commits.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def get_api_key() -> str:
    val = os.environ.get("REDFOX_API_KEY", "")
    if not val:
        print("[error] 未找到环境变量 REDFOX_API_KEY，请确认已设置 API Key", file=sys.stderr)
        sys.exit(1)
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
```

创建成功后告知用户："已成功订阅关键词「<关键词>」的B站视频推送，每天 10:00 将自动查询最新数据并通知你。"
Confidence
67% confidence
Finding
The documented cron-based subscription method introduces persistence on the host by instructing users to install a recurring scheduled task. While not overtly malicious here, persistence mechanisms are security-sensitive because they can outlive user awareness, repeatedly access network resources, and become a foothold for later abuse if the script or environment is modified.

Static analysis

No suspicious patterns detected.