Security audit

快手作品搜索

Security checks for vulnerabilities and agentic risk

Overview

This is a real Kuaishou search skill, but it can create ongoing daily scheduled searches with insufficient controls for review, cancellation, and containment.

Install only if you are comfortable sharing Kuaishou search keywords and filters with RedFox, storing a REDFOX_API_KEY for the agent to use, and allowing this skill to create recurring daily searches. Before enabling subscription, confirm the exact keyword, schedule, where the task will be stored, and how you can cancel or audit it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
先）：**

任务名称：快手作品订阅 - <关键词>

执行频率：每天 09:00（cron：0 9 * * *）

执行内容：按 最新发布、不限时间 搜索并推送作品数据到当前对话

脚本调用：python3 ~/.agents/skills/kuaishou-search/scripts/search_ks_work.py "<关键词>" --sort "最新" --note-time "不限"

通用配置方案：

bash
# Linux/macOS crontab 0 9 * * * python3 ~/.agents/skills/kuaishou-search/scripts/search_ks_work.py "<关键词>" --sort "最新" --note-time "不限"

创建成功后告知用户："已成功订阅关键词「<关键词>」的快手作品推送，每天 09:00 将自动推送最新发布的不限时间范围作品。"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says users can 'just describe what you're looking for in natural language' and 'no commands to memorize,' which creates very loose activation boundaries. In an agent environment, broad natural-language activation increases the chance the skill is invoked during ordinary conversation or adjacent requests, causing unintended tool use and data flow to the external Kuaishou/RedFox service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The example queries are everyday phrases like 'Search food content from the past week' and 'Show me the most played World Cup works,' which are likely to overlap with normal user conversation. In a multi-skill assistant, such examples encourage unintended matching and invocation, potentially sending user queries to an external API without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README advertises daily subscription push behavior but does not clearly warn that enabling it creates a persistent automated task and may store the user's keyword preferences. Users may not understand that the action continues beyond the current session, which creates consent, privacy, and surprise-action risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly says users can invoke the skill with unrestricted natural language, which creates broad trigger ambiguity and increases the chance the skill activates during ordinary conversation. In an agent environment, accidental invocation can lead to unintended searches, context capture, or follow-on actions such as navigating results or setting up subscriptions without the user clearly intending to use this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrase '下一页' is extremely generic and highly likely to appear in normal chat or while interacting with other skills, making unintended pagination probable. Because pagination changes tool state and may fetch additional external content, this raises the risk of cross-skill interference and accidental data retrieval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example command '确认订阅' initiates scheduled pushes without warning that user interests or query terms may be retained for future processing. This is dangerous because a short confirmation phrase can create ongoing background behavior with insufficient informed consent, especially in conversational interfaces where users may not realize persistence is involved.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes a local Python script, relies on an API key from environment or local config, and implicitly performs networked queries, but the manifest does not declare any tool scope or permissions. This creates an authorization and review gap: operators cannot clearly see that the skill accesses credentials and external services, increasing the chance of overbroad execution in environments that trust manifest metadata.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description lists trigger phrases such as “快手作品”, “快手热门”, and “搜快手”, which are generic user intents and could match ordinary conversation about Kuaishou rather than a deliberate request to invoke this skill. The file does not provide exclusion conditions or clearer scope boundaries to distinguish when the skill should or should not activate.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest presents the skill as a search/display utility, but the documentation adds recurring subscription behavior that changes the operational scope from one-time retrieval to ongoing automation. This can surprise users and reviewers, because a seemingly simple search skill can create persistent tasks and repeated outbound activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs users to place an API key in local config or environment variables without warning about credential sensitivity, storage risks, or least-privilege handling. In shared or multi-user environments, this can lead to inadvertent exposure of secrets through shell history, config backups, logs, or overbroad agent access to environment variables.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These sections instruct the agent to create scheduled tasks and daily push behavior, which materially expands the skill beyond its stated purpose of Kuaishou search. Persistent automation increases attack surface by enabling repeated execution and potential abuse of credentials, APIs, or user context long after the initial request.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Cron-based automation is broader than the expected context of an interactive content search skill because it establishes persistence on the host or platform. In skill ecosystems, persistence is especially sensitive: even benign commands can become risky when they recur automatically and may continue using stored credentials or generating network traffic without fresh user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Natural-language strings in the docstring, CLI description, help text, and errors are all Chinese, which effectively forces a specific language for users of the skill. Under the stated policy, this is a language/locale constraint unless the skill offers opt-in language choice or clearly documents that it is intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This Python file sends the user's keyword and derived date filters to a remote Redfox API over HTTP POST, but the code does not present a runtime notice or explicit warning that user input will be transmitted off-system. The module docstring says it calls the Redfox API, which documents purpose, but it does not clearly warn about external data transmission or privacy implications for supplied search terms.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.