抖音每日最具影响力账号（红狐数据）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.5

Overview

The skill's Douyin ranking purpose is coherent, but its report generator has under-disclosed active-content and command-execution risks that users should review before installing.

Install only if you trust the RedFox API data source and are comfortable with reports that create local files, may open in your browser automatically, and load remote JavaScript. Treat generated reports like active web pages, especially when data comes from an API or external JSON file, and avoid custom Windows output paths with shell metacharacters.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_report.py:455

Finding

Stored HTML and JavaScript Injection in Generated Reports

Content

View full analysis

{rank} {account_name} {category} {score} {followers} {new_fans} {new_likes} {new_comments} {new_shares} """ ROW_TEMPLATE = """ {rank} {account_name} {score} {followers} {new_fans} {new_likes} {new_comments} {new_shares} """ ``` ```python if is_all_category: account_category = item.get('category', '-') rows.append(ROW_TEMPLATE_CAT.format( rank_class=rank_class, rank=rank, account_name=account_name, profile_url=profile_url or '#', category=account_category, score=score, followers=followers, new_fans=new_fans, new_likes=new_likes, new_comments=new_comments, new_shares=new_shares, )) else: rows.append(ROW_TEMPLATE.format( rank_class=rank_class, rank=rank, account_name=account_name, profile_url=profile_url or '#', score=score, followers=followers, new_fans=new_fans, new_likes=new_likes, ...[truncated 3152 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/generate_report.py:360

Finding

Remote JavaScript Is Retrieved and Executed Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis Every generated report references executable JavaScript hosted by a third-party CDN. The browser retrieves and executes that script whenever the report is opened with network connectivity. Although the package version is fixed, the HTML does not provide a Subresource Integrity hash. Consequently, the browser cannot verify that the retrieved script matches the version reviewed when the Skill was audited. The effective report code can therefore change after installation if the CDN resource, package publication, DNS path, TLS trust chain, or upstream account is compromised. The report also lacks a restrictive Content Security Policy. This increases the consequences of both supply-chain compromise and the separate HTML injection issue. This network request is not necessary for displaying or printing the ranking report. It is only needed for the optional image-export feature and therefore exceeds the minimum network access required for the core report functionality. ### Attack Path 1. An attacker compromises the CDN resource, upstream package, publishing account, or delivery path. 2. A user generates and opens an HTML report. 3. The browser requests `html2canvas.min.js` from the CDN. 4. Because no integrity hash is present, the browser accepts any script returned successfully from that URL. 5. The substituted script executes in the report's browser context. 6. The malicious script can read and alter report content, initiate external requests, display phishing content, or attempt browser-based exploitation. ### Impact Assessment Exploitation affects users who open generated reports while the remote dependency is compromised. It does not ...[truncated 534 chars]

Remediation

View remediation

``` 3. Verify the integrity hash against an independently obtained release artifact. 4. Add a restrictive Content Security Policy that allows scripts only from the required source and prohibits unexpected connections. 5. Consider removing the image-export feature or making it an explicit opt-in feature. 6. Clearly disclose that opening a report causes a request to a third-party CDN. 7. Ensure reports remain fully usable for viewing and printing when offline. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:686

Finding

Windows Report Opening Uses a Shell With a User-Controlled Path

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_rank.py (reported line 75)May include surrounding context.

python

data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(API_URL, data=data, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_report.py (reported line 101)May include surrounding context.

python

for rule in CATEGORY_INFER_RULES:
        for kw in rule["keywords"]:
            if kw.lower() in combined:
                return rule["category"]

    return "全部"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README says users can 'Describe what you need in plain language — no commands to memorize,' which makes activation conditions ambiguous for a markdown skill description. Without clearer scope limits or exclusion examples, this broad phrasing could overlap with ordinary conversation and increase the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable behaviors that require environment access, filesystem reads/writes, network access, and shell execution, but it does not declare an explicit tool scope or permissions boundary. That creates an authorization ambiguity where a hosting agent may grant broader capabilities than users expect, increasing the risk of unintended command execution, API-key exposure, or file creation during normal use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill includes HTML report generation and recurring subscription automation, but the description does not clearly warn users up front that files may be created and ongoing scheduled actions may be set up. This weakens informed consent and can lead to persistent automations or artifact creation that users did not fully anticipate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to match common recommendation, ranking, or discovery queries that may not be intended for this specific skill. Overbroad activation can cause the agent to invoke networked data retrieval or report-generation behavior unexpectedly, exposing users to unintended actions and reducing control over when external tools are used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JSON manifest/config uses Chinese strings throughout the category map and display labels, including canonical category names and aliases, with no indication that the skill is China-specific or that users may choose another language. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The alias lists include broad everyday temporal words such as '今天', '昨日', '本周', and '这个月', which can match many ordinary user utterances and trigger this skill when the user did not explicitly request Douyin ranking data. In an agent-routing context, overly generic triggers can cause unintended activation, mis-handle user intent, and expose the skill in contexts where it should not run.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L021 将 source 示例写为 抖音每日最具影响力账号-ClawHub，但 L025 又明确声明 source 必须为 抖音每日最具影响力账号，使用其他值会返回空数据。这不是信息缺失，而是同一参数的文档说明直接冲突，容易让实现代码按错误值调用接口。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

文档声明“用户任何口语化表达都会自动映射到最匹配的赛道，无法识别时降级为‘全部’”，这属于过于宽泛的触发/匹配条件，缺少明确边界和排除条件。多组关键词如“科技”“健康”“音乐”“车”等与日常对话高度重叠，容易在非明确请求榜单查询时被误判并触发不期望的参数映射。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill specification, including all user-facing prompt text, is written only in Chinese and provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file contains user-facing natural-language instructions and examples only in Chinese, which effectively forces a specific language on users. The policy for natural-language content requires either user choice/opt-in or a clearly documented justification for a locale-specific constraint, neither of which is present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L165 的注释说明月榜应取“offset 期前”的整月区间，但实现里 month_offset = offset - 1 导致 offset=1 时返回当前月的月初到月末，而不是上一月。这不是文档信息缺失，而是注释对函数行为的直接描述与实际逻辑相矛盾。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated report embeds a third-party CDN-hosted script (html2canvas), so opening the local HTML causes a network request and executes remote JavaScript in the user's browser. That exceeds a user's likely expectation for an offline report generator and creates a supply-chain/privacy risk if the CDN content is tampered with or unavailable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The report loads a third-party script from jsDelivr, but users are not informed that opening the report will initiate network access and execute remote code in the browser. In a reporting tool, hidden network behavior is security-relevant because it can leak usage metadata and introduce third-party script risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatically launching the generated HTML opens a local application/browser without explicit user consent and is beyond the minimum needed to generate or download a report. In this skill context, that behavior is more concerning because opening the report also triggers any active content inside the HTML, including external network requests from embedded scripts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 691)May include surrounding context.

python

try:
        system = platform.system()
        if system == "Darwin":  # macOS
            subprocess.run(["open", str(abs_path)], check=True)
        elif system == "Windows":
            subprocess.run(["start", "", str(abs_path)], shell=True, check=True)
        else:  # Linux

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

On Windows, the script invokes subprocess.run with shell=True to launch 'start' on a path influenced by user input via --output. Using the shell unnecessarily increases risk because special shell metacharacters in the resolved path can be interpreted by cmd.exe, potentially causing unintended command execution or argument injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 693)May include surrounding context.

python

if system == "Darwin":  # macOS
            subprocess.run(["open", str(abs_path)], check=True)
        elif system == "Windows":
            subprocess.run(["start", "", str(abs_path)], shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", str(abs_path)], check=True)
        print(f"\n✓ HTML 报告已自动打开: {abs_path}", file=sys.stderr)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 695)May include surrounding context.

python

elif system == "Windows":
            subprocess.run(["start", "", str(abs_path)], shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", str(abs_path)], check=True)
        print(f"\n✓ HTML 报告已自动打开: {abs_path}", file=sys.stderr)
    except Exception as e:
        print(f"\n✓ HTML 报告已生成: {abs_path}", file=sys.stderr)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file contains display labels in Chinese (for example, "日榜", "周榜", and "月榜") and additional Chinese aliases, but there is no indication in this file that the locale is optional or intentionally limited to a China-specific context. This can violate language/locale policy if the skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

该 Markdown 文档明确给出远程接口地址，并说明认证方式为从环境变量读取 REDFOX_API_KEY 后通过 X-API-KEY 发送。这属于会进行网络请求并使用敏感凭据的行为，但文档没有向用户提示会把查询参数发送到第三方服务，也没有提醒依赖本地环境中的密钥配置。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The entire document is written in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

User-facing strings throughout the script and generated HTML are fixed in Chinese, including CLI description, status messages, and report content. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script opens the generated report automatically but does not warn users in its interface or help text. While not inherently exploit code, this surprise execution of a browser/app reduces user control and amplifies the risk of any active content embedded in the report.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.