ClawHub
Back to skill

Security audit

多平台AI信息源

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an AI trend-reporting tool, but it needs Review because subscriptions create persistent scheduled jobs, may store an API key on disk, and the investigation materials broaden into personal/background research.

Install only if you are comfortable using a RedFox API key and sending platform queries to redfox.hk. Avoid enabling the daily subscription unless you accept a LaunchAgent or crontab job running every day; on macOS, inspect the plist because it may contain your API key in plaintext. Treat the generated intelligence sections as leads, not verified investigations, and avoid using the person-background templates for private, reputational, or employment-like screening without clear authorization and safeguards.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (69)

Ae1

High
Category
analysis-evasion
Content
| `scripts/feed_core.py` | 平台配置表与全部共享逻辑（鉴权、日期、取数、归一化、聚类、统计、情报、渲染、订阅） |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `scripts/feed_core.py` | 平台配置表与全部共享逻辑（鉴权、日期、取数、归一化、聚类、统计、情报、渲染、订阅） |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `assets/report_template.html` | 统一多平台报告模板 |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill is described as generating AI multi-platform hot-content reports and investigating top AI topics, but this file defines broad investigation playbooks for competitor intelligence, public-opinion events, person background checks, and generic fact verification. That materially expands operational scope beyond the declared purpose, creating a capability for open-ended intelligence gathering that could be repurposed for surveillance, profiling, or other sensitive investigations without clear authorization boundaries.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The person background investigation section instructs collection of biography, company role, academic history, controversy, lawsuit, and reputation data about individuals. That is not necessary for producing AI multi-platform trend reports and enables targeted profiling of real people, including sensitive or reputation-harming inferences, which increases privacy and misuse risk.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
def print_api_key_help():
    error(f"未检测到 {ENV_KEY}，请先配置 API Key：")
    if sys.platform == "win32":
        print(f"  Windows PowerShell: [Environment]::SetEnvironmentVariable('{ENV_KEY}', 'ak_你的密钥', 'User')")
    else:
        print(f"  macOS/Linux (zsh):  echo 'export {ENV_KEY}=ak_你的密钥' >> ~/.zshrc && source ~/.zshrc")
        print(f"  macOS/Linux (bash): echo 'export {ENV_KEY}=ak_你的密钥' >> ~/.bashrc && source ~/.bashrc")
    print(f"  命令行参数:         --api-key ak_你的密钥")
    print(f"  配置文件:           echo '{{\"api_key\":\"ak_你的密钥\"}}' > {CONFIG_FILE}")
    print(f"  免费注册获取 Key:   {API_KEY_DOC}")
    print()


# ─── 日期与可用性预检 ──────────────────────────────────────────────────────────────
def latest_available_date(update_hour):
    """每日 update_hour
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
script_path = os.path.abspath(Path(__file__).resolve().parent / "multi_ai_feed.py")
    try:
        subprocess.run(
            f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
            shell=True, check=True, capture_output=True,
        )
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
script_path = os.path.abspath(Path(__file__).resolve().parent / "multi_ai_feed.py")
    try:
        out = subprocess.run("crontab -l 2>/dev/null", shell=True, capture_output=True).stdout.decode()
    except Exception:
        out = ""
    lines = [l for l in out.splitlines() if script_path in l]
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium
Confidence
95% confidence
Finding
The README says users can 'just describe what you need in plain language — no commands to memorize,' which encourages very broad activation conditions. In an agent setting, this can cause the skill to trigger on loosely related requests and perform external data retrieval or report generation without sufficiently specific user intent, increasing the risk of overreach and unintended actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Scenario | Role | Example Query | Benefit |
| -------- | ---- | ------------- | ------- |
| Daily cross-platform AI trend tracking | AI researcher / operator | "Generate today's multi-platform AI daily report" | Grasp all five platforms' AI hits and topic distribution at once, without checking each separately |
| Judging whether a trend is genuine | Industry intelligence analyst | "Is the AI Agent topic being discussed everywhere" | Distinguish global trends from platform-local spikes via coverage counts |
| Matching topics to platforms | Content creator | "Which platform is hottest for AI art right now" | Identify the high-momentum platform for that direction and prioritize publishing there |
| Niche direction mining | Content operator | "Find all-platform hits about ComfyUI and Stable Diffusion" | Focus on a specific track with custom keywords to support topic decisions |
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The README says users can 'directly use natural language to describe needs' without needing to remember commands, but it does not define clear trigger boundaries or exclusion conditions. This creates an ambiguous activation scope that could overlap with ordinary conversation and lead to unintended invocation.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to use shell execution, read environment variables and shell profiles for API keys, write reports and subscriptions to local files, and make network requests, yet it declares no explicit tool scope or permissions boundary. This creates an over-privileged, opaque execution surface where an agent may access secrets or modify the filesystem without clear user-auditable constraints, increasing the risk of unintended secret exposure or unsafe command execution.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The markdown mandates a single fixed output template entirely in Chinese and states it is the only legal output format, which effectively forces one language regardless of user preference. This is a natural-language locale policy issue because no opt-in, alternative locale, or justification for restricting output language is provided.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The HTML template sets the page language to `zh-CN`, which hard-codes a specific locale for all generated reports. Under the policy, forcing a language or locale without user opt-in or clear justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The subtitle text is presented only in Chinese and there is no indication in the template that users can choose another language. This suggests the skill enforces a single language in user-facing output without opt-in or documented necessity.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The strategy is written entirely in Chinese and the decision tree routes queries based on whether they contain Chinese keywords, with mandatory use of Chinese platforms for such cases. Because the file does not state that the skill is intentionally China-specific or provide any language/locale opt-in, this creates a natural-language locale policy concern.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This section operationalizes background checks and reputation/risk searches on individuals but provides no safeguards about privacy, consent, data minimization, false positives, or prohibited uses. Without those warnings and constraints, users may over-collect personal data or treat unverified search results as factual, causing privacy harm or unfair reputational impact.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
Manifest将该技能定位为抓取五大平台AI爆款内容、生成AI日报，并对平台TOP话题做AI情报调查；而此文件提供的是通用调查模板集，覆盖竞品情报、舆情事件、人物背景调查和任意信息验证，明显比“AI内容源日报”场景更宽。虽然是模板文档而非执行代码，但它直接体现了技能预期产出能力与宣称用途之间的范围不一致。

Missing User Warnings

Medium
Confidence
94% confidence
Finding
人物背景调查模板明确包含所在地、教育背景、法律诉讼、负面报道等敏感个人信息栏目，并鼓励汇总风险信号，但没有任何隐私边界、合法用途、准确性限制或对未证实信息的默认抑制机制。这会使技能更容易被用于画像、名誉伤害或不当背景审查，尤其在多源搜索与交叉汇总场景下会放大隐私和误报风险。

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
该配置文件将能力描述为“深度情报调查工具”，并明确支持竞品分析、舆情监测、人物背景调查、信息交叉验证。其中“竞品分析”“人物背景调查”是通用情报调查能力，不局限于多平台 AI 热点/日报场景；而父技能清单只声明对各平台 AI 热点与TOP话题执行 AI 情报调查。此处能力表述明显宽于技能宣称用途。

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The configuration includes a remote POST endpoint for saving records and specifies API-key based authentication, but the skill metadata shown to users does not disclose that investigation records may be transmitted to an external service. In a skill that performs multi-engine intelligence gathering, this creates a real data-handling and privacy risk because user queries, targets, or investigation results could be sent off-platform without informed consent.

Session Persistence

Medium
Category
Rogue Agent
Content
SKILL_NAME = "多平台AI信息源"
REPORT_PREFIX = "AI多平台日报"
PLIST_LABEL = "com.qoder.multi-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
SUBSCRIBE_HOUR = 17          # 覆盖 15:00 / 16:00 两个数据更新边界
SUBSCRIBE_MINUTE = 0
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
SKILL_NAME = "多平台AI信息源"
REPORT_PREFIX = "AI多平台日报"
PLIST_LABEL = "com.qoder.multi-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
SUBSCRIBE_HOUR = 17          # 覆盖 15:00 / 16:00 两个数据更新边界
SUBSCRIBE_MINUTE = 0
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
SKILL_NAME = "多平台AI信息源"
REPORT_PREFIX = "AI多平台日报"
PLIST_LABEL = "com.qoder.multi-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
SUBSCRIBE_HOUR = 17          # 覆盖 15:00 / 16:00 两个数据更新边界
SUBSCRIBE_MINUTE = 0
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
SKILL_NAME = "多平台AI信息源"
REPORT_PREFIX = "AI多平台日报"
PLIST_LABEL = "com.qoder.multi-ai-feed"
PLIST_DIR = Path.home() / "Library" / "LaunchAgents"
SUBSCRIBE_HOUR = 17          # 覆盖 15:00 / 16:00 两个数据更新边界
SUBSCRIBE_MINUTE = 0
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/platforms.md:5