文旅抖音信息源

• Outcome: Review
• Latest audit: Jul 23, 2026 · 9:20 AM UTC
• Version: 1.0.1

Overview

This skill mostly matches its stated reporting purpose, but its optional daily subscription feature creates persistent scheduled tasks and handles credentials/commands in ways users should review before installing.

Install only if you trust the RedFox API provider and are comfortable with local report files and browser opening. Avoid using the daily subscription feature until the skill stops writing API keys into LaunchAgent files and removes shell=True crontab manipulation; if you do subscribe, inspect the exact LaunchAgent or crontab entry and know how to remove it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script_path = os.path.abspath(__file__)
        cron_line = f"0 9 * * * /usr/bin/python3 {script_path} --keyword {keyword} --no-open"
        try:
            subprocess.run(
                f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
                shell=True, check=True, capture_output=True
            )

• Confidence: 99% confidence
• Finding: This code builds a shell command containing user-controlled keyword data and executes it with shell=True when installing a crontab entry. A crafted keyword containing shell metacharacters or quotes could break out of the intended cron line and execute arbitrary commands on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        script_path = os.path.abspath(__file__)
        try:
            subprocess.run(
                f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
                shell=True, check=True, capture_output=True
            )

• Confidence: 99% confidence
• Finding: This code executes a shell pipeline with shell=True and interpolates script_path into a grep expression. If the path contains shell-significant characters, it can alter command behavior and lead to command execution or incorrect crontab modification.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes capabilities including network access, shell execution, environment variable access, and file read/write, but it does not declare permissions or clearly bound those actions. This weakens user consent and platform policy enforcement, making it easier for the skill to perform side effects such as reading API keys, writing reports, or launching commands without explicit review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose says the skill searches Douyin tourism content and generates a report, but the behavior includes installing/removing system scheduled tasks, auto-opening a browser, emitting structured JSON for other agents, and using a different ranking method than described. Hidden persistence and undisclosed side effects are dangerous because users may trigger system-level changes or data flows they did not knowingly authorize.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill’s primary function is searching Douyin content and generating reports, yet it also installs and removes host-level scheduled tasks. Persistence features expand the blast radius of any compromise and are especially sensitive in an agent skill because they alter the user's system beyond the immediate reporting task.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README tells users to invoke the skill with unrestricted natural language ('Just describe what you need in natural language — no commands to memorize'). In agent ecosystems, broad invocation guidance can cause accidental or overly eager tool selection from ordinary conversation, which may trigger external API calls, generate reports, or set up subscriptions without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill requires automatic browser opening and creates local HTML report files, but the description does not prominently warn users about those side effects. Opening local files and spawning a browser can leak activity context, create unwanted artifacts on disk, and surprise users in constrained or shared environments.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs users to place API keys in environment variables or a local config file without any warning about secret handling, file permissions, or accidental disclosure. In agent and shared-workstation contexts, poor credential hygiene can lead to token theft, misuse of paid APIs, or leakage through logs, shell history, or readable config files.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-douyin-feed.log")

        env_section = ""
        api_key = os.environ.get(ENV_KEY)
        if api_key:
            env_section = (
                '\n        <key>EnvironmentVariables</key>'

• Confidence: 97% confidence
• Finding: The code reads the API key from the environment and embeds it into a LaunchAgent plist so the secret persists on disk in cleartext. That broadens exposure of the credential to other local processes, backups, and anyone with access to the user profile, and it is unnecessary for a content-reporting skill.

Unvalidated Output Injection

High

• Category: Output Handling

Content

else:
        script_path = os.path.abspath(__file__)
        try:
            subprocess.run(
                f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
                shell=True, check=True, capture_output=True
            )

• Confidence: 98% confidence
• Finding: This shell command is assembled from variable content and executed with shell=True, creating an output/command injection surface. Even if script_path is usually trusted, file paths can contain quotes or shell metacharacters, making this a dangerous pattern for host command execution and crontab corruption.

Session Persistence

Medium

• Category: Rogue Agent

Content

cron_line = f"0 9 * * * /usr/bin/python3 {script_path} --keyword {keyword} --no-open"
        try:
            subprocess.run(
                f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
                shell=True, check=True, capture_output=True
            )
            info(f"订阅成功! 每天 09:00 自动生成「{keyword}」文旅抖音日报 (crontab)")

• Confidence: 95% confidence
• Finding: This code installs a recurring crontab entry, creating persistence on the host beyond the immediate task execution. In an agent skill context, persistence is security-relevant because it causes future unattended execution and can repeatedly process data or reopen attack paths if the script or its inputs are later compromised.

Session Persistence

Medium

• Category: Rogue Agent

Content

# ─── 订阅机制 ──────────────────────────────────────────────────────────────────────
def install_subscription(keyword):
    if sys.platform == "darwin":
        PLIST_DIR.mkdir(parents=True, exist_ok=True)
        plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
        script_path = os.path.abspath(__file__)
        log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-douyin-feed.log")

• Confidence: 95% confidence
• Finding: This function initiates installation of a LaunchAgent, which is a persistence mechanism. In a skill intended for content search/reporting, host persistence materially increases security sensitivity because it creates scheduled unattended execution beyond the user’s immediate request.

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>
</plist>'''

        plist_path.write_text(plist_content, encoding="utf-8")
        try:
            subprocess.run(["launchctl", "load", str(plist_path)], check=True, capture_output=True)
            info(f"订阅成功! 每天 09:00 自动生成「{keyword}」文旅抖音日报")

• Confidence: 94% confidence
• Finding: Writing the LaunchAgent plist to disk establishes the persistence artifact that can later be loaded for scheduled execution. In this skill context, that exceeds the minimal privileges expected for a report generator and increases long-term host exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>
</plist>'''

        plist_path.write_text(plist_content, encoding="utf-8")
        try:
            subprocess.run(["launchctl", "load", str(plist_path)], check=True, capture_output=True)
            info(f"订阅成功! 每天 09:00 自动生成「{keyword}」文旅抖音日报")

• Confidence: 94% confidence
• Finding: Writing the LaunchAgent plist to disk establishes the persistence artifact that can later be loaded for scheduled execution. In this skill context, that exceeds the minimal privileges expected for a report generator and increases long-term host exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

plist_path.write_text(plist_content, encoding="utf-8")
        try:
            subprocess.run(["launchctl", "load", str(plist_path)], check=True, capture_output=True)
            info(f"订阅成功! 每天 09:00 自动生成「{keyword}」文旅抖音日报")
            info("日报目录: ~/Downloads/QoderReports/")
            info(f"日志: {log_path}")

• Confidence: 95% confidence
• Finding: Loading the LaunchAgent activates persistent scheduled execution on the host. For an agent skill whose main purpose is data retrieval and HTML reporting, enabling persistence is a meaningful security concern because it causes future unattended runs and broadens the impact of any later compromise.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

else:
        script_path = os.path.abspath(__file__)
        try:
            subprocess.run(
                f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
                shell=True, check=True, capture_output=True
            )

• Confidence: 98% confidence
• Finding: The tool invocation abuses shell=True with interpolated dynamic content while modifying crontab state, a privileged host integration point. Because this skill includes persistence management unrelated to simple report generation, misuse of subprocess parameters here is especially dangerous and can enable arbitrary command execution or destructive crontab edits.

Static analysis

No suspicious patterns detected.