T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:96- Finding
Mandatory Subscription Promotion Hijacks Normal Ranking Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
抖音每日点赞飙升榜
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Douyin ranking lookup tool that uses a RedFox API key and fixed external API, with some documentation and output-safety issues users should understand before installing.
Install only if you are comfortable using a RedFox API key and sending Douyin ranking query parameters to redfox.hk. Treat REDFOX_API_KEY as a secret. Do not rely on the advertised subscription or auto-push behavior unless the publisher documents a real scheduler, cancellation path, and confirmation flow. Be cautious when clicking generated video links because returned URLs are not strongly validated in the script.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/douyin_daily_increment.py:173- Finding
Untrusted API Fields Are Rendered as Markdown Without Adequate Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation guidance encourages very broad natural-language triggering (e.g., common phrases like 'show me today's Douyin surge ranking'), which can cause the skill to activate unexpectedly in normal conversation. This can lead to unintended external API use, accidental subscriptions, or disclosure of data the user did not explicitly intend to request, though the skill appears limited to ranking lookups rather than high-risk actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes this skill as a query tool for daily Douyin like-surge rankings, but the README expands the scope to include '订阅推送' with automatic daily delivery. No code or implementation lines are provided showing scheduling, persistence, or push delivery behavior, so the documented capability appears to exceed the skill's stated query-focused behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The invocation guidance says users can 'directly use natural language' and provides broad examples without clearly defining trigger boundaries. In an agent environment, overly broad trigger semantics can cause accidental invocation on loosely related requests, leading to unintended external API use, over-collection of user intent context, or surprising actions such as subscription setup.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents use of environment variables and outbound network access to call an external API, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where the runtime may permit broader capability use than users or reviewers expect, reducing transparency around credential access and external data transmission.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad, repetitive, and map to common domain language such as '飙升榜' and '点赞飙升', which increases the chance of accidental invocation during ordinary conversation. Unexpected activation can cause unsolicited external API calls, unintended use of stored credentials, and disclosure of user queries to a third-party service without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
All instructions, trigger phrases, prompts, and output templates are written exclusively in Chinese, and the skill does not state that language choice is optional or region-specific. This creates a natural-language locale constraint without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to configure an API key and send requests to an external service, but it does not clearly warn that user requests and authentication material will be used with a third-party API. This weakens informed consent and can lead to users unknowingly exposing query content or mishandling credentials in environments where secrets may be logged or shared.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例：
bash curl -X POST \ -H "X-API-KEY: $REDFOX_API_KEY" \ -H "Content-Type: application/json" \ -d '{"source": "<见脚本>-ClawHub","type":"美食","startTime":"2026-05-28"}' \
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
All user-facing instructions and examples in the file are presented in Chinese, and the README does not state that the skill is region-specific or provide any language choice. This can constitute a language/locale policy issue when a skill effectively forces one language without explicit opt-in or justification.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest specifically frames the skill as a '每日点赞飙升榜查询工具' focused on daily新增点赞 TOP50, but the README claims precise daily growth data for likes, favorites, comments, and shares. That broadens the described product behavior beyond the manifest's narrower like-surge ranking purpose.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file instructs users to configure an API key and later shows using it directly in a curl header, but it does not include any warning that the key is sensitive or should be kept out of shared shells, logs, or screenshots. Because the file describes handling credentials, a brief user-facing warning about secrecy and safe storage is warranted.
- Content