短剧-B站信息源

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated reporting purpose, but it automatically opens locally generated HTML built from unescaped third-party data, creating a real browser-injection risk.

Review carefully before installing. Only use a revocable RedFoxHub API key, expect queries and the key to be sent to redfox.hk, and avoid automatically opening generated reports until HTML escaping, URL validation, a restrictive CSP, and an option to disable browser auto-open are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/playlet_bili_daily.py:245

Finding

Stored HTML Injection Through Unescaped API Response Fields

Content

View full analysis

0: metrics_parts.append(f'🔗 {format_number(raw_shares)}') if raw_likes > 0: metrics_parts.append(f'👍 {format_number(raw_likes)}') if raw_comments > 0: metrics_parts.append(f'💬 {format_number(raw_comments)}') metrics_html = ''.join(metrics_parts) cover_html = "" if cover: cover_html = f'' # B站链接生成:使用BV号拼接B站视频链接 if photo_id: # photoId是BV号格式(如BV1onEQ6sEiL) url = f"https://www.bilibili.com/video/{photo_id}" title_html = f'{title}' else: title_html = f'{title}' articles_html += f'''

{cover_html}

{title_html}

{author} {metrics_html}

''' ``` The resulting markup is written directly to an HTML file: ```python with open(html_file, 'w', encoding='utf-8') as f: f.write(html_content) return html_file ``` The generated file is then opened automatically: ```python webbrowser.open(f"file://{html_file}") ``` ### Tech ...[truncated 2949 chars]

Remediation

View remediation

``` 6. Remove automatic browser opening or require explicit user confirmation before opening the generated report. 7. When using `target="_blank"`, add `rel="noopener noreferrer"` to prevent opened pages from controlling the report tab. 8. Add regression tests for malicious values in every API-controlled field, including quote-breaking payloads, event-handler injection, script elements, malformed URLs, and unexpected identifier formats. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/playlet_bili_daily.py (reported line 124)May include surrounding context.

python

method="POST"
            )
            
            with request.urlopen(req, timeout=30) as response:
                result = json.loads(response.read().decode('utf-8'))
                
                # 检查响应状态(红狐API成功码为2000)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to interact via unconstrained natural-language requests without defining clear action boundaries, confirmation requirements, or disallowed operations. In an agent setting, this can let ambiguous prompts trigger network access, data retrieval, file generation, or other side effects more broadly than the user intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states that the tool will automatically save reports locally and open an HTML report in the browser, but it does not prominently warn users about these side effects or require consent. Automatic file creation and browser launching can surprise users, expose local paths or sensitive content, and increase risk if generated HTML contains untrusted external resources.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.en.md (reported line 96)May include surrounding context.

md

- Data is updated daily at **15:00** for the previous day's data
- Before 15:00, the latest available date is the day before yesterday (T-2); after 15:00, it is yesterday (T-1)
- When querying the latest data, the system automatically skips periods with no data without consuming API quota
- Historical date data is fixed and can be queried directly without confirmation

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states users can 'directly use natural language to describe needs' without clearly constraining the skill’s accepted intents, inputs, or prohibited operations. Overly broad invocation guidance can cause an agent to route unrelated or risky requests to this skill, increasing the chance of prompt injection, unintended tool use, or processing of out-of-scope user input. In this context, the skill is data-collection/reporting oriented rather than inherently high-risk, which reduces severity somewhat, but the ambiguity still creates a real attack surface for misrouting and unsafe execution paths.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to access environment variables, read and write local files, and make network requests, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an over-privileged, ambiguous execution model where an agent runtime may permit sensitive operations without clear user visibility or policy gating.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown mandates a single fixed output template written entirely in Chinese and says it is the only legal output format, leaving no room for user language preference. This is a natural-language policy concern because the skill imposes a locale/language without documenting user choice or justified regional restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents operations that may affect the user's environment or ongoing behavior, such as turning subscriptions on or off. It also states that the generated HTML report is automatically opened in a browser, but provides no warning about these side effects or how they impact the user system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown states that an HTML daily report is created at a path under the user's Downloads directory, which is a file-system side effect affecting user data/storage. The description presents this as output detail, but does not explicitly warn users beforehand that running the skill will create files on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script silently transmits user-selected query parameters and the REDFOX_API_KEY to an external third-party service without an explicit runtime notice or consent prompt. In a skill/agent context, this can surprise users, leak sensitive search interests or date ranges, and expose credentials to a service boundary they may not realize they are crossing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Natural-language content in this file is written exclusively in Chinese, which effectively forces a specific language for users reading invocation examples and operational guidance. There is no indication that the skill is intentionally region-specific or that users can opt into another language.

Content

No source excerpt is available for this finding.