短剧-公众号信息源

• Outcome: Review
• Latest audit: Jun 23, 2026 · 8:52 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it says, but it creates and auto-opens local HTML reports using unescaped external data, which makes installation worth review.

Install only if you are comfortable giving the skill a RedFoxHub API key and letting it write report/cache files locally. Treat generated reports as untrusted web content until the HTML escaping and URL validation issue is fixed; avoid opening reports from untrusted or unexpected data sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities that access environment variables, perform network requests, and read/write local files, but no permissions are declared. This creates a transparency and consent gap: a caller may invoke the skill expecting a simple content query while the implementation can access secrets and modify local state. In agent environments, undeclared capabilities materially increase risk because policy enforcement and user review may not account for them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose focuses on querying and generating reports, but the documented behavior also includes automatic browser opening, local cache/report persistence under the user's home directory, and subscription controls that may not be implemented as advertised. This mismatch is dangerous because users and policy engines may authorize the skill for data retrieval while it also performs local system side effects and potentially misleading automation features, undermining informed consent and increasing the chance of unexpected file or execution behavior.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The README states the skill may automatically expand batch queries when data is insufficient, which conflicts with the skill metadata requirement to first notify the user and wait for confirmation when target-date data is unavailable. In a data-fetching skill, this can cause unauthorized external API use, unexpected quota consumption, and behavior that bypasses an explicit user-consent safeguard.

Description-Behavior Mismatch

Low

• Confidence: 85% confidence
• Finding: The README promises behaviors beyond the stated skill scope, including local file persistence and automatically opening a browser. Scope expansion matters because it can cause side effects on the host system that users may not expect from a query/reporting skill, reducing informed consent and making review harder. In this context the behavior is not inherently malicious, but it is a real safety issue because undocumented file writes and app launches can surprise users and bypass least-privilege expectations.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The README says the skill will automatically handle invalid target dates to avoid ineffective API calls, but the manifest requires the agent to first notify the user and wait for confirmation before any fetch when target-date data is unavailable. This mismatch is dangerous because it encourages autonomous behavior that can violate user-consent constraints and potentially trigger unapproved network access or broader fallback queries.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Telling users they can use unrestricted natural language without clearly bounding supported operations makes skill activation overly broad. In an agent environment, vague invocation guidance can cause the model to route unrelated requests into this skill or infer permissions more broadly than intended, which increases the chance of unintended data access, report generation, or network calls.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README describes automatic daily report generation, local file saving, and browser auto-opening without a prominent warning or consent model. Persistent file creation and launching external applications are user-impacting side effects; if triggered unexpectedly, they can leak sensitive workspace paths, clutter storage, or create confusion about what the agent is doing on the machine.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown states that the tool saves HTML reports locally and automatically opens them in a browser, but does not present this as a clear side effect requiring user awareness and consent. Automatic local writes and browser launching can expose sensitive content on-screen, create persistent artifacts on disk, or surprise users in restricted environments, making this more dangerous than a pure read-only reporting tool.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Untrusted external fields such as title, author, cover URL, and article URL are interpolated directly into HTML attributes and element bodies without escaping or URL validation. If the upstream API returns malicious content, opening the generated report could execute script in the browser or load dangerous URLs, creating a stored XSS-style local report injection issue.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The subscription example documents ongoing automated report generation and file writes to the user's Downloads directory without clearly warning that this behavior persists after setup and may also trigger browser-opening side effects. This can lead to unexpected recurring local actions, privacy exposure of generated content, and user surprise in environments where unattended file creation or auto-opening is sensitive.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Passing an API key directly on the command line can expose the credential through shell history, terminal logging, and process listings visible to other local users or monitoring tools. In a skill that accesses external data APIs, leaked keys can be reused to impersonate the user, consume quota, or access associated account resources.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.