短剧-抖音信息源

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 1.0.0

Overview

The skill matches its advertised Douyin report purpose, but it writes and automatically opens HTML built from unescaped remote API data, which warrants review before installation.

Review this skill before installing. It needs a RedFoxHub API key, contacts redfox.hk, creates local report/cache files, and opens generated reports in your browser. The main risk is that untrusted API content is placed into HTML without escaping, so install only if you trust the data source and are comfortable with local browser-rendered reports; avoid using it with highly privileged browser sessions until the report generation is hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/playlet_douyin_daily.py:237

Finding

Stored HTML and Attribute Injection Through Untrusted API Response Fields

Content

View full analysis

' # 生成作品链接:优先使用url字段,如果为null则用photoId拼接 if url: title_html = f'{title}' elif photo_id: # 使用抖音作品ID拼接链接 title_html = f'{title}' else: title_html = f'{title}' articles_html += f'''

{cover_html}

{title_html}

{author} 🔗 {shares} 👍 {likes} 💬 {comments}

''' ``` The assembled content is subsequently written directly to an HTML file: ```python with open(html_file, 'w', encoding='utf-8') as f: f.write(html_content) return html_file ``` The generated report is then automa ...[truncated 3250 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/playlet_douyin_daily.py (reported line 124)May include surrounding context.

python

method="POST"
            )
            
            with request.urlopen(req, timeout=30) as response:
                result = json.loads(response.read().decode('utf-8'))
                
                # 检查响应状态（红狐API成功码为2000）

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises local HTML report creation and automatic browser opening, but does not clearly warn users that the skill will write files locally and trigger a local application. In a tool-using agent context, undisclosed side effects reduce informed consent and can surprise users, especially on shared or sensitive systems where file artifacts, links, or browser launches may expose activity or data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to invoke the skill via broad natural-language requests such as 'simply describe your needs,' without clearly constraining when the skill should activate. In an agentic environment, overly broad activation language can cause the tool to run in response to ambiguous requests, leading to unintended API calls, report generation, or subscription behavior that the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README says users can invoke the skill through unrestricted natural-language requests, which can cause the agent to over-trigger on vague prompts and perform external-data retrieval or downstream actions without sufficiently explicit user intent. In this skill’s context, that risk is amplified because the tool can generate local HTML reports, open a browser, and supports subscription-like automation, increasing the chance of unintended execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents capabilities that involve reading environment variables, making network requests, and writing files, but it does not declare any explicit tool scope or permissions boundaries. This creates a least-privilege failure: an agent may be allowed to access broader resources than users or platform policy expect, increasing the risk of secret exposure, unintended network access, or filesystem side effects when the skill is invoked.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill contains inconsistent instructions about date handling: some sections require explicit user confirmation before querying when data is unavailable, while others say the latest mode will auto-skip unavailable dates. Ambiguity in safety-relevant control flow can cause the agent to bypass a required consent check and make unintended API calls, potentially consuming paid quota or violating user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown states that the reply must strictly use a single fixed template, and that template is entirely in Chinese. This forces a specific language for user-facing responses without any opt-in or alternative, which is a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example explicitly says historical date queries require no user confirmation, which conflicts with the skill's stated safety constraint that when the target date has no data, the user must be informed and the agent must wait for confirmation before calling the API. This kind of contradictory guidance can cause an agent to bypass required consent checks and automatically fetch data when it should pause for user approval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation advertises a daily subscription mode that automatically generates reports, but the skill metadata describes an on-demand querying/reporting tool rather than a persistent scheduled automation capability. Expanding behavior beyond the declared scope increases the chance an agent will perform unattended actions the user did not explicitly request for each run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples describe enabling daily subscription and saving reports to a local directory without warning the user about continuous automatic file creation. In an agent setting, that can lead to persistent background writes, storage clutter, and user surprise because the behavior continues beyond a single requested interaction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description explicitly requires that when the target date has no data, the user must be informed and the tool must wait for confirmation before calling the API. However, the implementation lets callers supply custom start/end times after date validation, which can bypass that guard and trigger unauthorized or unintended API queries outside the documented policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill advertises automatic local HTML report creation and automatic browser opening, but does not clearly warn the user at the point of use that files will be written locally and opened automatically. Even if the content is benign, silent file creation and auto-opening are side effects that can surprise users, expose local environment behavior, or create opportunities for unsafe rendering if report content ever includes untrusted data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example introduces automatic daily report generation and writing to a local Downloads directory, which is not obviously necessary for the core purpose of querying and analyzing Douyin short-drama trends. Even if not directly malicious, unnecessary filesystem persistence broadens the skill's operational footprint and can surprise users with ongoing local artifact creation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest focuses on scanning Douyin short-play data, filtering, clustering, and producing HTML reports. Accessing environment variables for credentials is an additional capability not mentioned in the stated purpose, and credential handling is not surfaced as part of the skill's declared user-facing scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated report hard-codes the document language as "zh-CN", which enforces a specific locale in the output. The file also uses Chinese-only user-facing text throughout, but does not offer any language or locale selection or explain why the locale restriction is required.

Content

No source excerpt is available for this finding.