Security audit

快手作品搜索

Security checks for vulnerabilities and agentic risk

Overview

This skill searches Kuaishou through RedFox as described, but it also includes a recurring subscription flow with a raw cron fallback that needs review before use.

Install only if you are comfortable giving the skill a RedFox API key and sending your search terms to RedFox. Treat the daily subscription feature carefully: prefer a platform-managed scheduler, avoid the raw crontab fallback unless you intend host-level recurring execution, and confirm you know how to list and remove any created task.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs use of an API key from the environment and invokes an external Python script that performs networked searches, but no permissions are declared. This creates an authorization and transparency gap: the agent may access secrets and external services without an explicit capability contract, making review and containment harder.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is presented as a one-shot search tool, but its documented features include daily subscription/push behavior. That expands the skill from transient retrieval into persistence and ongoing actions, which changes the trust and risk profile and can surprise users or platforms that only approved search behavior.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The workflow directs the agent to create scheduled tasks after user confirmation, which is materially different from the stated purpose of searching/querying Kuaishou content. Scheduled execution persists beyond the current interaction and can be abused for repeated actions or unwanted notifications if not tightly constrained.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Providing a raw crontab line gives the skill a path to establish host-level persistence outside the platform's managed task system. Even though the example payload is a search command, cron-based persistence is dangerous in skill content because it normalizes and enables recurring execution on the user's machine with access to local environment and network.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises a daily subscription/push feature, but the documentation does not clearly emphasize that enabling it creates an ongoing recurring action until cancelled. Users may unknowingly consent to persistent notifications or monitoring behavior, which can cause privacy, consent, and trust issues, especially in conversational environments where 'confirm subscription' may be triggered casually.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README explicitly says users can invoke the skill with unrestricted natural language, without requiring a clear scoped command or explicit invocation boundary. This increases the chance of accidental activation from ordinary conversation, which could trigger external searches or stateful actions like subscriptions without the user intending to use this skill.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase '下一页' is extremely generic and commonly appears in normal conversation across many contexts. If the platform uses these examples to guide routing or intent detection, the skill may hijack unrelated user requests and continue paginated access to external content the user did not intend to browse.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: '确认订阅' is an ambiguous phrase tied to a state-changing action that enables daily push notifications. Because it is generic and affirmative, it could be matched during unrelated conversations and cause unintended subscription enrollment, creating unwanted persistent actions and possible privacy or notification abuse.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Content: ``` 创建成功后告知用户："已成功订阅关键词「<关键词>」的快手作品推送，每天 **09:00** 将自动推送**最新发布**的**不限时间**范围作品。"
Confidence: 88% confidence
Finding: The YARA hit is driven by inclusion of a crontab example, which is not malware by itself, but it does represent persistence guidance embedded in a non-administrative search skill. In context, the danger is not a backdoor payload but the encouragement of unmanaged scheduled execution, which can outlive the session and operate with the user's environment and network access.

Static analysis

No suspicious patterns detected.