全网内容出海信息源

• Outcome: Review
• Latest audit: Jun 26, 2026 · 2:19 AM UTC
• Version: 1.0.1

Overview

This skill mostly does what it claims, but it should be reviewed because it handles an API key and automatically opens generated HTML built from external data without clear safety controls.

Install only if you trust RedFox Hub with your API key and query terms. Treat generated reports as local files that may persist until deleted, avoid printing API keys in the terminal, and prefer disabling browser auto-open or escaping/sanitizing report fields before regular use.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README encourages users to invoke the skill with broad natural-language requests such as 'Generate today's content globalization daily report' and says no commands need to be memorized. In agent ecosystems, overly generic invocation phrases can cause unintended triggering or ambiguous routing, especially if the skill performs side effects like local file writes and browser opening.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The feature description advertises one-click daily subscription and the output example states reports are saved locally and auto-opened in a browser, but the user warning about these side effects is not prominent at the point of enabling the feature. This can lead to users unknowingly authorizing persistent local writes and automatic browser execution contexts, increasing privacy and safety risk.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to invoke the skill with broad natural-language phrases such as '直接用自然语言描述需求，无需记忆命令'. In an agent environment, overly permissive invocation guidance can cause accidental triggering from ambiguous conversation context, leading to unintended API calls, browsing, report generation, or local actions without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill advertises '一键每日订阅' and automatic saving to a local folder, but the README does not clearly warn users that content will be written to disk, where it will be stored, how often, or what retention behavior applies. In an agent setting, silent or poorly disclosed local persistence can create privacy, storage, and data-governance risks, especially if generated reports contain user-supplied query terms or sensitive research topics.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly requires the agent to reply in a rigid Markdown template and forbids any free-form response. That can override user preferences and higher-level assistant behavior, creating prompt-scope confusion where the skill attempts to control output format beyond its legitimate functional needs. In an adversarial or mixed-instruction setting, this kind of mandatory formatting can suppress safety clarifications or force misleadingly authoritative output.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to set an API key with a literal shell command and then print it back with `echo $REDFOX_API_KEY`. This can expose the secret through shell history, terminal scrollback, screen sharing, logs, or shoulder-surfing, making credential leakage more likely even though the file does not directly exfiltrate the key.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def get_api_key():
    """从环境变量获取 API Key"""
    api_key = os.environ.get("REDFOX_API_KEY")
    if not api_key:
        print("❌ 错误:未找到 REDFOX_API_KEY 环境变量")
        print("请先配置:export REDFOX_API_KEY=<你的apikey>")

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def get_api_key():
    """从环境变量获取 API Key"""
    api_key = os.environ.get("REDFOX_API_KEY")
    if not api_key:
        print("❌ 错误:未找到 REDFOX_API_KEY 环境变量")
        print("请先配置:export REDFOX_API_KEY=<你的apikey>")

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Hidden Instructions

High

• Category: Prompt Injection

Content

---
name: multi-content-feed
description: "全网内容出海信息源 — 每日扫描全平台(公众号/抖音/视频号/小红书/快手/B站)内容出海爆款作品,按点赞量筛选Top50,智能聚类题材方向后生成包含平台标签、封面、互动数据与创作洞察的HTML日报。支持按平台、关键词、时间范围定向查询。⚠️数据每日15:00更新前一天数据,目标日期无数据时必须先告知用户并等待确认后才能调用接口,禁止自动获取。当用户需要内容出海日报、内容出海爆款、内容出海热点、内容出海创作趋势或自定义查询时使用。"
---

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# 全网内容出海信息源 - 核心工作流程

## 📋 执行流程概览

• Confidence: 18% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# 全网内容出海信息源 - 使用示例

## 📖 基础用法

• Confidence: 18% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Static analysis

No suspicious patterns detected.