抖音账号订阅追踪

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 1.0.2

Overview

This skill has a legitimate Douyin monitoring purpose, but it silently creates recurring automation and has undisclosed local storage plus unsafe auto-opened HTML reports.

Review this skill before installing. Use it only if you are comfortable with daily background monitoring tasks, sharing tracked Douyin account IDs with redfox.hk, and storing subscription/failure state locally under ~/.qoder. Prefer REDFOX_API_KEY from a protected environment or secret store, avoid --api-key, and do not open generated HTML reports automatically until the report escaping issue is fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:129

Finding

Persistent automation prompt injection through unvalidated account identifiers

Content

View full analysis

Silent execution principle: intermediate operations such as fetch validation, subscription addition, and `automation_update` must not produce progress messages. 1. User sends a Douyin ID → Agent silently executes `fetch --accounts "Douyin ID" --html --markdown`. ``` The source instructions explicitly require the Agent to interpolate a user-provided Douyin identifier into the persistent automation task's `prompt` field and into a quoted command string. They do not require validation, escaping, or structured argument construction. ### Technical Analysis The account identifier is an untrusted input. Placing it directly between quotes in a persistent prompt or command allows a crafted value containing quotes, shell metacharacters, line breaks, or instruction-like text to terminate the intended argument and introduce additional content. Two security boundaries may be affected: 1. **Agent instruction boundary:** Injected natural-language instructions can become part of the stored automation prompt and influence future Agent executions. 2. **Command boundary:** If the automation framework ultimately passes the generated command through a shell, quote termination and shell metacharacters can introduce additional commands. Because the modified prompt is store ...[truncated 1431 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/subscribe.py:979

Finding

Stored HTML injection in automatically opened reports

Content

View full analysis

{account_name}' if account_link else account_name html += f"""

📌 {name_html} 粉丝: {fans} | 作品: {len(account_works)} 条

""" for work in account_works: title = work.get("title") or "无标题" video_url = work.get("workUrl") or work.get("videoUrl", "#") collects = format_number(work.get("collectCount")) comments = format_number(work.get("commentCount")) shares = format_number(work.get("shareCount")) likes = format_number(work.get("likeCount")) pub_time = work.get("publishTime") or "-" if len(pub_time) > 16: pub_time = pub_time[:16] title_display = title.replace("\n", " ") html += f"""

作品标题	收藏数	评论数	分享数	点赞数	发布时间
{title_display}	{collects}	{comments}	{shares}	{likes}	{pub_time}

Remediation

View remediation

`, `"`, `'`, `&`, malformed URLs, event handlers, and closing HTML tags. 9. Consider a restrictive Content Security Policy in the generated report, such as disallowing scripts and limiting network destinations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/subscribe.py:73

Finding

API key exposure through command-line arguments

Content

View full analysis

env var. Must be configured or the program exits.""" if cli_key: return cli_key env_key = os.environ.get(ENV_KEY) if env_key: return env_key error("REDFOX_API_KEY was not found. Configure the API key first.") print(f" Option 1: export REDFOX_API_KEY=ak_your_key") print(f" Option 2: command-line argument --api-key ak_your_key") print(f" Acquisition address: https://redfox.hk/settings/api-keys?source=clawhub") sys.exit(1) ``` ```python parser.add_argument("--api-key", help="API Key") ``` The same command-line option is documented in `SKILL.md` at line 91. ### Technical Analysis Command-line arguments are not an appropriate secret-transport mechanism. Depending on the operating system and execution environment, command arguments may be exposed through: - Process inspection utilities and process metadata. - Shell history. - Agent tool-call logs and conversation records. - Automation task definitions and retained prompts. - Monitoring, telemetry, or crash-reporting systems. The implementation gives the command-line value precedence over the environment variable and explicitly recommends the option when the environment variable is missing. This increases the likelihood that users will place a live credential in observable command metadata. ### Attack Path 1. A user or Agent starts the Skill with a live key in `--api-key`. 2. The full command is stored in shell history, tool-call logs, an automation prompt, or process metadata. 3. Another local user, monitoring process, log reader, or party with access to retained Agent records reads the argument. 4. The party reuses the exposed API key against the RedFox API until the key is revoked or expires. ...[truncated 564 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:95

Finding

Unpinned third-party dependency installation

Content

View full analysis

Remediation

View remediation

``` 2. Generate and verify cryptographic hashes, and install with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Lock all transitive dependencies rather than only the direct dependency. 4. Install dependencies in an isolated virtual environment. 5. Explicitly use a trusted package index and prevent unintended fallback to untrusted indexes. 6. Use automated dependency scanning and periodically update the lock file after review and testing. 7. Document the supported Python and dependency versions to make installations reproducible. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior materially differs from the observed behavior: the skill claims no file storage, but analysis indicates persistent local storage, external API dependence, and automatic opening of generated HTML via system commands. Such discrepancies undermine informed consent, bypass operator expectations, and can hide privacy-sensitive persistence or risky side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to invoke the skill with unrestricted natural-language requests such as simply providing a Douyin ID, which can make routing and activation too permissive. In agent ecosystems, overly broad trigger language increases the chance of unintended invocation, misclassification of user intent, or accidental execution of subscription/monitoring actions on ambiguous input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README is entirely written in Chinese and instructs users to interact in Chinese natural-language phrases, such as subscription commands and example requests. There is no indication that other languages are supported, no user opt-in for a locale constraint, and no justification that the skill is region- or language-restricted for compliance reasons.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool scope despite requiring environment access, file operations, network access, and shell execution. This increases the chance of overbroad agent/tool use and makes it harder for users or the platform to understand and constrain what the skill can do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to silently create or modify recurring automation tasks that perform ongoing monitoring. Persistent scheduled surveillance without clear, upfront user-facing confirmation can create unauthorized tracking, surprise background activity, and privacy issues, especially because the monitored account IDs are embedded into automation commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions require silent execution of verification fetches, subscriptions, and automation changes, suppressing disclosure of network calls and persistent task updates. This reduces transparency and weakens user control over actions that may consume credentials, contact third-party services, or establish lasting background processes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description explicitly claims account IDs are embedded in automation commands and do not require file storage, but the implementation persists subscription data under ~/.qoder/douyin_subscriptions.json. This creates an undisclosed local data-retention surface containing tracked account identifiers and metadata, which can expose monitoring targets to other local users, backups, or forensic collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends tracked account identifiers and an API credential to a third-party endpoint (redfox.hk) without an explicit user-facing warning or consent step describing the external transfer. In a competitive-monitoring use case, the list of tracked accounts can itself be sensitive business intelligence, and transmitting it to an external service expands confidentiality and supply-chain risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically launches the generated HTML report via the host OS without requiring an explicit user opt-in. In an agent/tooling context this is risky because opening rendered HTML can trigger active content, external resource loading, browser/session side effects, or simply violate least surprise by causing host interaction outside the stated subscription-tracking purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/subscribe.py (reported line 1347)May include surrounding context.

python

# ── 自动打开 HTML 报告 ──
                try:
                    import subprocess
                    subprocess.Popen(["open", str(html_file)])
                except Exception:
                    pass
                info(f"HTML 报告已生成: {html_file}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON file uses Chinese natural-language strings for test case names and field-mapping labels, such as the example names and keys like "旧→新" and "新API新增字段". Because the file provides no documented language choice, opt-in, or region-specific justification, it presents a locale-specific experience that may violate a language/locale policy requiring neutrality or user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's docstring and all user-facing prompts are written in Chinese, and the generated HTML is explicitly tagged as zh-CN. This creates a language/locale constraint without any opt-in, fallback, or documentation that the tool is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Manifest 重点描述的是按内置账号每日抓取并生成报告，而此处代码实现并持久化了订阅状态管理。虽然这与“订阅追踪”相关，但超出了“账号 ID 直接内置于自动化命令中”的描述方式，形成轻度行为偏移。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.