Security audit

品牌GEO分析

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it sends business query data to an external service and contains a report bug that can falsely claim there were no negative results.

Review before installing. Use only non-confidential brand, category, competitor, and question data because the skill sends those queries to RedFox-backed external AI search services. Treat the generated report summary carefully until the hard-coded positive-rate/no-negative summary is fixed; cross-check the detailed sentiment sections and raw results.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill directs the agent to use environment variables, read and write local files, and make outbound network requests, but it does not declare permissions or present those capabilities transparently. This can cause users or host systems to grant broader access than expected, increasing the risk of unintended data access, unreviewed external transmission, or unsafe execution in environments that rely on declared permissions for policy enforcement.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The summary HTML hard-codes '正面率 100%（无负面评价）' regardless of the actual computed sentiment counts. In a GEO/brand analysis tool, this can systematically misrepresent negative coverage and mislead users into making business decisions based on false analytics, undermining report integrity.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The README says users can invoke the skill by 'just describ[ing] what you need in natural language' and lists broad trigger concepts like GEO, brand visibility, and AI search analysis. In agent ecosystems that rely on semantic routing, this can cause the skill to activate for loosely related prompts and send user-supplied brand/query data to external services without the user clearly intending to use this specific tool.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The overview explains that the tool automatically submits questions to Doubao, Kimi, and DeepSeek, but it does not clearly warn users that their brand names, categories, and custom questions will be transmitted to third-party AI platforms. This creates a privacy and data-governance risk, especially if users enter confidential campaign plans, unreleased products, or sensitive competitive intelligence.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly sends prompts to multiple third-party AI platforms, but the README does not clearly warn users that brand names, categories, custom questions, and possibly sensitive business context will be transmitted externally. This creates a real privacy and data-governance risk because users may unknowingly submit confidential marketing plans, internal competitive analysis, or regulated data to external services with separate retention and logging policies.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill asks users to configure a REDFOX_API_KEY but does not warn that it is a sensitive secret or explain that it will be used to authenticate outbound requests to third-party services. This raises the chance of users mishandling credentials, storing them insecurely, or providing them without understanding the trust and data-flow implications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill is designed to submit user-provided brand, industry, and generated queries to multiple external AI/search platforms, but it does not provide an explicit privacy or data-transmission warning. Users may unknowingly send sensitive business information, proprietary competitor lists, or confidential research topics to third parties, creating confidentiality and compliance risks.

Static analysis

No suspicious patterns detected.