抖音每日TOP账号

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 1.0.3

Overview

This skill mostly matches its Douyin ranking purpose, but its HTML report workflow has unsafe automatic opening, unescaped report data, external JavaScript, and a Windows shell-opening risk.

Install only if you are comfortable giving the skill a Redfox API key and letting it create and open local HTML reports. Treat report files as untrusted until the author escapes all report fields, validates links, removes default auto-open behavior, avoids Windows shell invocation, and bundles or integrity-pins the JavaScript dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_report.py:442

Finding

Stored HTML Injection in Generated Ranking Reports

Content

View full analysis

{rank} {account_name} {category} {score} {followers} {new_fans} {new_likes} {new_comments} {new_shares} """ ROW_TEMPLATE = """ {rank} {account_name} {score} {followers} {new_fans} {new_likes} {new_comments} {new_shares} """ ``` The templates are populated without escaping: ```python account_name = item.get('accountName', '') profile_url = item.get('profileUrl', '') rows.append(ROW_TEMPLATE.format( rank_class=rank_class, rank=rank, account_name=account_name, profile_url=profile_url or '#', score=score, followers=followers, new_fans=new_fans, new_likes=new_likes, new_comments=new_comments, new_shares=new_shares, )) ``` The resulting content is then written as an HTML document: ```python with open(output_path, "w", encoding="utf-8") as f: f.write(html) ``` ### Technical Analy ...[truncated 2297 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_report.py:360

Finding

Generated Reports Execute Unpinned Third-Party JavaScript

Content

View full analysis

``` The remotely loaded library is subsequently used by report functionality: ```javascript async function downloadAsImage() { const btn = document.getElementById('downloadImgBtn'); btn.textContent = '⏳ 生成中...'; btn.disabled = true; try { const element = document.querySelector('.table-wrap'); const canvas = await html2canvas(element, { scale: 2, backgroundColor: '#ffffff', useCORS: true }); const link = document.createElement('a'); link.download = '抖音榜单_{date}.png'; link.href = canvas.toDataURL('image/png'); link.click(); } catch (e) { alert('生成图片失败，请尝试使用浏览器截图'); } } ``` ### Technical Analysis Each generated report references JavaScript hosted by jsDelivr. When the report is opened, the browser contacts that third-party service and executes the response as code. Although the URL includes a library version, the report does not include a Subresource Integrity hash. Consequently, the browser does not cryptographically verify that the retrieved JavaScript is the exact artifact reviewed by the Skill author. The report also lacks a Content Security Policy that restricts script sources and other network activity. This creates a supply-chain trust boundary outside the packaged Skill. A compromise or unexpected modification affecting the CDN, package distribution, or dependency artifact could change the code executed by existing reports. Opening a report also discloses network metadata, including the user's IP address and browser request headers, to the CDN. ### Attack Path 1. The Skill generates an HTML report containing the external script reference. 2. The program automatically opens the report, or the user op ...[truncated 1103 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_report.py:682

Finding

User-Controlled Output Path Passed to the Windows Command Shell

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_rank.py (reported line 75)May include surrounding context.

python

data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(API_URL, data=data, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_report.py (reported line 101)May include surrounding context.

python

for rule in CATEGORY_INFER_RULES:
        for kw in rule["keywords"]:
            if kw.lower() in combined:
                return rule["category"]

    return "全部"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage guidance says users can describe needs in plain language with no commands to memorize, but it does not define clear boundaries for when this skill should or should not be invoked. In an agent environment, overly broad trigger language can cause accidental activation on loosely related requests, leading to unintended API calls, report generation, or subscription workflows without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly says users can invoke the skill by 'directly using natural language' without remembering any command format, which broadens activation scope and increases the chance the skill is triggered by ordinary conversation rather than deliberate invocation. In agentic environments, ambiguous routing can cause unintended external API use, report generation, or subscription/task creation without sufficiently clear user intent boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The sample trigger phrases are generic, conversational requests like asking for rankings or reports, which are likely to overlap with normal user discussion and therefore can be misinterpreted as tool invocations. This creates prompt/intent ambiguity that may lead an orchestrator to invoke the skill unexpectedly, causing unintended data retrieval, file generation, or creation of recurring subscription workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs use of environment variables, local file reads/writes, network access to the Redfox API, and shell execution of Python scripts, but it does not declare any explicit tool scope or permissions boundary. That mismatch increases the chance the runtime grants broader capabilities than users or reviewers expect, weakening least-privilege controls and making misuse or prompt-triggered side effects harder to govern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad and overlap with ordinary recommendation or ranking queries, so the skill may activate when a user did not intend to invoke a tool-backed workflow. In this skill, unintended invocation can lead to external API calls, file creation, and possible subscription setup flows, turning a routing problem into unnecessary side effects and data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

文档声明“用户任何口语化表达都会自动映射到最匹配的赛道，无法识别时降级为‘全部’”，并列出大量日常高频词如“健康”“音乐”“车”“老师”等作为触发映射。这种描述缺少明确边界、排除条件和不应触发的负例，容易把普通对话误判为技能调用或错误分类。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file specifies fixed Chinese response text for out-of-range and date-boundary scenarios, which imposes a language/locale behavior on the skill. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level docstring, usage examples, and later CLI help/output strings consistently force Chinese-language interaction. Under the policy, a skill should not mandate a specific language or locale unless it offers user opt-in or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L165-L166 的注释说明 month 分支应返回“offset 期前”的月榜区间，且调用方多处把默认 offset=1 当作“上一期”使用；但实现里 month_offset = offset - 1 导致 offset=1 时返回当前月的月初到月末，而不是上月。这与注释和脚本围绕“最新可用上一期榜单”的意图直接矛盾。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing natural language that is entirely fixed to Chinese, including the script description and generated report labels, with no option for users to select another language. The policy category explicitly covers language/locale constraints across all file types, and there is no visible opt-in or documented regional justification in this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The generated HTML pulls html2canvas from a third-party CDN at runtime, introducing a supply-chain and privacy risk whenever the report is opened. If the CDN asset is compromised, changed, blocked, or monitored, the report may execute untrusted JavaScript or leak access patterns to an external party.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The report-generation script automatically opens the generated HTML in the system browser or file handler, which is outside the core requirement of generating a report and creates an unexpected execution side effect. Because the HTML content is built from JSON fields without escaping, this auto-launch can amplify risk by immediately rendering potentially unsafe content in a browser context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 691)May include surrounding context.

python

try:
        system = platform.system()
        if system == "Darwin":  # macOS
            subprocess.run(["open", str(abs_path)], check=True)
        elif system == "Windows":
            subprocess.run(["start", "", str(abs_path)], shell=True, check=True)
        else:  # Linux

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

This Windows branch uses subprocess.run(..., shell=True) while incorporating a path derived from user-controlled input (--output or data-derived filename). On Windows, shell=True delegates to the shell and increases the risk of command/argument interpretation issues or unexpected execution behavior if a crafted path contains special characters.

Content

Scanner excerpt · scripts/generate_report.py (reported line 693)May include surrounding context.

python

if system == "Darwin":  # macOS
            subprocess.run(["open", str(abs_path)], check=True)
        elif system == "Windows":
            subprocess.run(["start", "", str(abs_path)], shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", str(abs_path)], check=True)
        print(f"\n✓ HTML 报告已自动打开: {abs_path}", file=sys.stderr)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 695)May include surrounding context.

python

elif system == "Windows":
            subprocess.run(["start", "", str(abs_path)], shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", str(abs_path)], check=True)
        print(f"\n✓ HTML 报告已自动打开: {abs_path}", file=sys.stderr)
    except Exception as e:
        print(f"\n✓ HTML 报告已生成: {abs_path}", file=sys.stderr)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The subscription feature is advertised, but the documentation does not warn users that enabling it creates an ongoing scheduled notification or explain what data is stored and how it will be used. In practice, this can lead to users unintentionally authorizing recurring actions or not understanding retention and delivery implications for their ranking preferences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill directs generation of HTML reports written to the workspace but does not clearly warn users that local files will be created. This reduces transparency around side effects and can surprise users or downstream systems, especially in shared workspaces or environments with storage/sensitivity constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON file defines all categories and display labels exclusively in Chinese, including canonical values and user-facing display text. Because the file provides no alternate locale options or indication that the skill is intentionally region-specific, it appears to hard-code a single language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The period labels are hard-coded in Chinese (日榜, 周榜, 月榜), and additional aliases and update-time strings elsewhere in the file also assume a Chinese locale. For a general-purpose skill, forcing a specific language/locale in user-facing text without documented opt-in can violate language or locale policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON manifest defines long aliases such as "today", "yesterday", "this week", and "this month" equivalents (e.g. 今日, 今天, 昨日, 本周, 这周, 本月) without any visible exclusion conditions or scope constraints. In a manifest file, these broad everyday phrases can overlap with normal user speech and may cause unintended activation or misclassification if used as trigger terms.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Manifest 声称日榜“回溯7天”，但该配置将 day 的 window_days 设为 9。这属于文档/声明的预期行为与实际配置生效行为不一致，会导致技能实际可查询范围超出描述。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L021 将 source 示例写为 抖音每日最具影响力账号-ClawHub 且标注为固定值，但 L025 又明确说明必须为 抖音每日最具影响力账号，使用其他值会返回空数据。这属于文档内部对调用意图的直接矛盾，会误导代码实现者按错误参数调用接口。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file contains user-facing natural language exclusively in Chinese, including category names and handling instructions, without offering an opt-in language choice or documenting that the skill is intended only for Chinese-speaking users. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.