B站关键词搜作品

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.2

Overview

This Bilibili search skill is mostly purpose-aligned, but it pushes users toward a recurring daily subscription that can create persistent scheduled tasks without enough controls.

Install only if you are comfortable sending Bilibili search terms to Redfox with your REDFOX_API_KEY and potentially creating a daily scheduled task. Before enabling subscription, require a specific keyword-bound confirmation and make sure you know how to list, disable, and delete the scheduled task.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:155

Finding

Mandatory Subscription Solicitation Manipulates Agent Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 155-175
Vulnerability Type: Mandatory instruction-driven output manipulation
Risk Level: Medium

Vulnerable Instruction Snippet

The following is an English rendering of the relevant instruction block:

markdown

A1 through A4 are all mandatory and must be completed continuously in the
same response. After A4, immediately append the Step 4 subscription prompt.
If A4 is omitted, treat it as an execution error and add the missing output.

After displaying all content, do not wait; immediately finish the response
and append only the following subscription prompt:

> Would you like to subscribe to the daily push for “XXX”? After subscribing,
> the latest popular videos will be pushed automatically every day at 10:00.
> Reply “Confirm subscription” to create a scheduled task.

Step 5: Create a scheduled task when the user replies “Confirm subscription.”

Technical Analysis

The Skill does not merely define how to render search results. It requires the Agent to append a subscription solicitation to every successful or empty-result search response and treats omission of prescribed output as an execution error.

This behavior modifies the Agent’s response policy whenever the Skill is loaded. It forces engagement-oriented content into responses even when the user requested only a one-time search. The instructions therefore exceed the minimum behavior necessary to perform Bilibili keyword searches.

Although these instructions do not disable safety controls or directly enable local code execution, they constrain the Agent’s current-session goals and final-answer structure. This is best classified as instruction hijacking rather than memory poisoning because the mandatory rule is contained in the loaded Skill text and does not itself write a rule into long-term Agent memory.

Attack Path

1. The Agent loads SKILL.md to handle a Bilibili keyw ...[truncated 1030 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove requirements that every response must include the subscription prompt.
2. Remove language that treats omission of promotional or subscription content as an execution error.
3. Present subscription as an optional capability only when the user asks about monitoring, recurring searches, or notifications.
4. Keep one-time search behavior independent from scheduled-task functionality.
5. Before initiating persistence, provide a separate confirmation dialog that identifies:
   • The keyword being transmitted.
   • The execution frequency.
   • The external API endpoint.
   • Expected API quota usage.
   • The task name and storage location.
   • Instructions for disabling and deleting the task.
6. Ensure higher-priority user instructions, such as requests for concise output or no follow-up solicitation, take precedence over presentation suggestions in the Skill.

T06 · System Persistence

Warning

• Location: SKILL.md:175

Finding

Persistent Daily Execution Through Platform Scheduler or Crontab

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 175-187
Vulnerability Type: Cross-session scheduled-task persistence
Risk Level: Medium

Vulnerable Instruction Snippet

The following is an English rendering of the relevant instruction block, preserving the scheduled command:

markdown

Step 5: Create a scheduled task when the user replies “Confirm subscription.”

Prefer the platform’s built-in scheduled-task capability. If it is
unavailable, provide a generic configuration:

Platform scheduled task:
- Task name: Bilibili Search Subscription - <keyword>
- Frequency: Every day at 10:00 (cron: 0 10 * * *)
- Execution: Run the script and push the formatted results to the current
  conversation.

Generic configuration:
# Linux/macOS crontab
0 10 * * * python3 "$SKILL_PATH/scripts/search_bili_realtime.py" "<keyword>"

Technical Analysis

The instructions establish recurring execution that survives the original Skill invocation. Each scheduled execution runs the search script, reads REDFOX_API_KEY from the environment, and sends the subscribed keyword and search parameters to:

text

https://redfox.hk/story/api/bili/search

Recurring monitoring is a declared optional feature, and the instructions require the user to reply with a confirmation phrase before creation. The persistence is therefore disclosed rather than covert. Nevertheless, it is not required for the Skill’s primary one-time search function and exceeds the minimum privileges needed for that function.

The generic crontab guidance lacks several controls expected for safe persistence management:

• No duplicate-task detection.
• No task identifier suitable for reliable removal.
• No unsubscribe or deletion procedure.
• No expiration date or execution limit.
• No explicit display of the final cron entry immediately before installation.
• No validation that SKILL_PATH resolves to a stable, tr ...[truncated 1964 chars]

Remediation

View remediation

Remediation Suggestions

1. Separate recurring subscriptions from the default one-time search workflow.
2. Prefer a scoped platform scheduler over modifying the user’s crontab.
3. Obtain explicit confirmation immediately before registration and display:
   • The exact command.
   • The absolute script path.
   • The keyword and search filters.
   • The execution identity.
   • The schedule and time zone.
   • The external destination.
4. Do not create a task solely from an ambiguous confirmation phrase if multiple searches or keywords are active.
5. Assign every task a unique, stable identifier and prevent duplicate subscriptions.
6. Provide commands or platform controls to list, pause, resume, and permanently delete subscriptions.
7. Support an expiration date, maximum execution count, or automatic cleanup after inactivity.
8. Validate and resolve SKILL_PATH to a trusted absolute path before task creation.
9. Avoid invoking a shell where possible; configure the scheduler with an argument array or safely quoted fixed arguments.
10. Run the task as an unprivileged user and never request administrator or root access.
11. Apply API quota limits, bounded logging, and clear failure notifications.
12. Remove associated tasks when the Skill is uninstalled or the user revokes the subscription.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises a subscription push capability but does not clearly warn that it creates an ongoing scheduled action with repeated future deliveries. In an agent environment, users may interpret 'confirm subscription' as a one-time retrieval step and unintentionally authorize persistent behavior, leading to unwanted notifications, background processing, or repeated API usage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says users can 'Simply describe your needs in natural language' and provides generic phrases like 'Next page' and 'Confirm subscription' as triggers. These phrases overlap with common conversational language and the document does not define clear scope, exclusions, or negative examples for when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to invoke the skill with unrestricted natural language, which creates overly broad activation semantics. In an agent environment, generic phrasing can cause accidental tool invocation or routing conflicts with unrelated user requests, increasing the chance of unintended external API calls or stateful actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using a generic phrase like “下一页” as a trigger is ambiguous because it overlaps with ordinary conversational navigation. In a multi-skill assistant, this can unintentionally activate pagination behavior for this skill when the user may be referring to another context, leading to confusion, unintended data retrieval, or unauthorized continuation of a prior search session.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The standalone confirmation phrase “确认订阅” is especially risky because it is a common expression that may appear in unrelated conversations. Since this skill supports creating daily push tasks, an ambiguous trigger could cause unintended subscription creation or modification, making the issue more dangerous than ordinary read-only search actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill requires access to environment variables for the API key and network access to query the Redfox service, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes its operational boundary ambiguous and can lead to overbroad execution privileges or unauthorized capability use in hosts that rely on manifest-declared restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises daily automatic push behavior without an explicit up-front warning that it will create ongoing automated activity. Users may not understand that enabling this feature results in repeated future executions and notifications, which can cause surprise automation, unnecessary API usage, or persistent data processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API key setup instructions tell users how to place the REDFOX_API_KEY into config files or shell environment variables but do not warn that the credential is sensitive. This increases the chance of accidental exposure through shared config files, shell history, screenshots, logs, or overbroad file permissions, leading to unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The subscription flow describes creating a recurring scheduled task, including cron syntax, without a prominent warning that this establishes persistent automation. Without a clear confirmation and disclosure of recurrence, users may unintentionally authorize repeated execution, network access, and notifications over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script transmits the user-provided search keyword to the external Redfox API, which is necessary for the feature but still constitutes a privacy-relevant data flow. If users enter sensitive terms, those queries may be disclosed to a third party without any explicit notice or consent, and the skill context does not indicate this transfer to the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.