Security audit

全网内容出海信息源

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its stated report-generation purpose, but it automatically opens HTML reports built from remote content without safe escaping, so users should review it before installing.

Install only if you are comfortable sending query filters and a RedFoxHub API key to redfox.hk and having reports/cache written locally. Review or patch the HTML generation first so API-sourced fields are escaped, URLs are restricted to safe schemes, and browser opening requires explicit consent. Treat the subscription feature as unreliable until its documentation and behavior match.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: assets/daily_report.py:228
Finding: Untrusted API Data Is Embedded in an Automatically Opened HTML Report
Content: View full analysis
👍 {format_number(likes_raw)}') metrics.append(f'💬 {format_number(comments_raw)}') metrics.append(f'🔗 {format_number(shares_raw)}') cover_html = "" if cover: cover_html = f'' title_html = f'{title}' if link_url else f'{title}' html += f'
{cover_html}
#{topic_val}{title_html}
{author}
Remediation: View remediation
``` ```text javascript:alert(1) ``` ```html " autofocus onfocus="alert(1) ``` ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/playlet_xhs_daily.py:228
Finding: Development Script Duplicates the Untrusted HTML Injection Vulnerability
Content: View full analysis
👍 {format_number(likes_raw)}') metrics.append(f'💬 {format_number(comments_raw)}') metrics.append(f'🔗 {format_number(shares_raw)}') cover_html = "" if cover: cover_html = f'' title_html = f'{title}' if link_url else f'{title}' html += f'
{cover_html}
#{topic_val}{title_html}
{author}
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
# 全网内容出海信息源 - 使用示例 ## 📖 基础用法

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/core_workflow.md (reported line 1)May include surrounding context.
md
# 全网内容出海信息源 - 使用示例 ## 📖 基础用法

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/examples.md (reported line 1)May include surrounding context.
md
# 全网内容出海信息源 - 使用示例 ## 📖 基础用法

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises 'one-click daily subscription' and notes that reports are automatically saved locally, but it does not clearly warn about the persistence, frequency, storage location, and ongoing nature of these writes. Users may unknowingly enable recurring local file creation, leading to privacy, storage, and operational risks, especially in automated agent environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to 'simply describe your needs in natural language' without defining clear trigger boundaries or requiring explicit confirmation for actions that fetch external data, generate files, or enable recurring behavior. In an agent setting, this ambiguity can cause overbroad invocation and unintended execution of costly or state-changing operations from loosely phrased prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states that reports may be automatically saved locally and opened in a browser, but it does not present these as potentially system-impacting actions requiring explicit user consent. In an agent environment, writing files or launching applications can create privacy, safety, and usability risks if done automatically or unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is activated through very generic natural-language requests such as asking for a report or analysis, without clear confirmation boundaries or scoped triggers. In an agent setting, overly broad activation increases the chance the skill will run unintentionally on ambiguous user input and perform external data access or side effects the user did not explicitly intend.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction says replies '必须严格按照输出模板输出 md 内容' and forbids any free-form variation. This imposes a fixed output mode on the user interaction without offering a language or locale choice, which fits the policy category for forced language/locale-style constraints in natural-language instructions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The help text for --subscribe/--unsubscribe and the corresponding success messages imply that the script will actually configure or disable an ongoing daily reporting subscription. In reality, the branches at L576-L580 only print confirmation text and return immediately, with no persistence, scheduler integration, or state change.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document sets a hard rule forbidding automatic use of --latest, then later instructs the agent to run --latest after only a vague user confirmation. This inconsistency can cause the agent to bypass the intended date-validation guardrail and query a different date than the user explicitly requested, undermining user consent and predictable tool behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document requires every reply to follow a fixed template written entirely in Chinese and forbids any other wording. This imposes a language/locale choice on all users without offering an opt-in, alternative language, or justification for why the skill must operate only in Chinese.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Lines L228-L230 state that data updates daily at 15:00 with the previous day's data, but then say that on 2026-06-16 before 15:00 the latest queryable date is 2026-06-14. Under the stated rule, the latest available date should be 2026-06-15, so the example's intent/documentation conflicts with the described behavior and the command shown in L236.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code collects user-supplied filters such as keyword, platform selection, and time range, then sends them in a POST request to an external API endpoint with an X-API-KEY header. While the script has internal comments and progress prints, it does not clearly disclose to the user that their query parameters are being transmitted to a remote service.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The command-line help text presents --subscribe and --unsubscribe as enabling or disabling a daily subscription, implying persistent scheduling or state changes. In reality, those branches only print confirmation messages and return, with no scheduler setup, config change, or subscription state stored anywhere.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: All user-facing instructions, examples, and suggested utterances are presented only in Chinese, with no indication that other languages are supported or that Chinese is required for a justified regional purpose. This can be a language-policy issue when a skill constrains interaction language without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code explicitly sets the report document language to zh-CN, and the surrounding UI strings are also fixed in Chinese. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Most command examples invoke assets/daily_report.py or $SKILL_PATH/assets/daily_report.py as the implementation entrypoint. But L373 lists the script filename as playlet_xhs_daily.py, which directly conflicts with the rest of the file's documented behavior and execution path.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The request-body example at L107 specifies source as 全网内容出海信息源-ClawHub, while the parameter description at L119 says the fixed value must be 全网内容出海信息源-GitHub. These two statements cannot both be correct, so the documentation contradicts itself about what the code should send.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: In this markdown file, the skill documents --subscribe and notes the effect that reports are automatically saved to ~/Downloads/QoderReports/. However, it presents this as a feature without an explicit caution that subscription mode performs recurring local file writes and may accumulate generated files over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The fetched API results are persisted via save_cache(), which stores data under ~/.workbuddy/cache for later reuse. Although caching is part of the implementation, users are not clearly warned in the interface or top-level description that remote content data will be stored locally on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This function creates the output directory and writes a report file into ~/Downloads/QoderReports, affecting the user's filesystem. The script later prints the generated path, but there is no clear advance disclosure in the module description or argument help that running the tool will create files in Downloads by default.
Content: No source excerpt is available for this finding.