Security audit

公众号搜索爬虫

Security checks across malware telemetry and agentic risk

Overview

The skill is a legitimate WeChat article search tool, but it saves the user's API key inside generated HTML reports and runs a local API proxy, creating avoidable credential exposure risk.

Install only if you are comfortable with API-key exposure in generated reports. Use a dedicated, low-limit Redfox key, avoid sharing or syncing the generated HTML files, prefer --csv-only when possible, stop the local server when finished, and rotate the key if you already generated or shared HTML reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The template injects `{{API_KEY}}` into client-side JavaScript, so anyone who opens the generated HTML can recover the credential from page source or browser dev tools. Because the page then uses that key to call a remote API directly, the key can be reused outside the report for unauthorized API access, abuse, quota exhaustion, or data scraping.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The generated HTML embeds the API key directly into client-side JavaScript, which exposes the credential to anyone who can open, inspect, copy, or receive the report file. Because the same page also performs live API searches, the key is not just present passively; it can be reused to make arbitrary API requests outside the intended local script workflow.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill starts a localhost HTTP server that proxies authenticated requests to the upstream API, extending the skill from report generation into an active API service. Although it binds to 127.0.0.1, any local process or malicious webpage leveraging permissive CORS can potentially drive this proxy and consume the user's API-backed capability.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The report is presented as a generated local HTML artifact, but its JavaScript performs new live searches after generation. That hidden behavioral expansion matters because it changes the trust model: opening the report triggers ongoing network-capable behavior rather than simple local viewing.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: The skill automatically exports CSV and HTML artifacts to the local Downloads directory, but this side effect is not surfaced as a clear warning in the user-facing description. Unexpected file creation can expose sensitive search terms, overwrite expectations about local state, and surprise users in managed or shared environments.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill starts a local HTTP service/proxy for the HTML report, but this behavior is not prominently disclosed in the description. Even if intended only for local browser access, opening a listening port increases attack surface and may expose report contents or create conflicts in multi-user, remote, or containerized environments.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This finding is substantively the same issue as above: a secret is placed in browser-visible code with no disclosure, making exposure inevitable. Lack of warning does not create the core risk, but it worsens it by making operators and users less likely to realize credentials are being distributed in exported reports.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Embedding the API key into browser-executed JavaScript without explicit warning or consent leaks credential material into a much broader exposure boundary, including browser devtools, saved files, screenshots, backups, and accidental sharing. In this skill, that key enables continued authenticated use of the upstream search API, so compromise can lead to unauthorized usage and billing/abuse risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.