Security audit

短剧-公众号信息源

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated reporting purpose, but it automatically opens HTML built from remote API content without escaping it, which creates a real browser-side safety risk.

Review this skill before installing. It needs a RedFoxHub API key, contacts redfox.hk, writes reports and cache files locally, and opens generated reports in your browser. The main risk is that report HTML is built from remote article metadata without escaping, so a compromised or malicious upstream value could inject misleading or active browser content. Prefer using a scoped, revocable API key and avoid the documented --api-key command-line example.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: assets/daily_report.py:205
Finding: Unescaped API Data Allows Active Content Injection in Generated HTML Reports
Content: View full analysis
' # 文章标题改为可点击链接 if url: title_html = f'{title}' else: title_html = f'{title}' # 各项数据为0时不展示该字段 metrics_parts = [] if raw_reads > 0: metrics_parts.append(f'👁 {reads}') if raw_likes > 0: metrics_parts.append(f'👍 {likes}') if raw_comments > 0: metrics_parts.append(f'💬 {comments}') metrics_html = "\n ".join(metrics_parts) if metrics_parts else "" articles_html += f'''
{cover_html}
{title_html}
{author} {metrics_html}
...[truncated 2632 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/playlet_wechat_daily.py:205
Finding: Duplicate Report Generator Inserts Untrusted API Fields into HTML Without Escaping
Content: View full analysis
' # 各项数据为0时不展示该字段 metrics_parts = [] if raw_reads > 0: metrics_parts.append(f'👁 {reads}') if raw_likes > 0: metrics_parts.append(f'👍 {likes}') if raw_comments > 0: metrics_parts.append(f'💬 {comments}') metrics_html = "\n ".join(metrics_parts) if metrics_parts else "" articles_html += f'''
{cover_html}
{title}
{author} {metrics_html}

''' ``` The resulting report is automatically opened at `scripts/playlet_wechat_daily.py:470`: ```python webbrowser.open(f"file://{html_file}") ``` ### Technical Analysis This secondary script duplicates the unsafe report-generation pattern. API-controlled values are treated as trusted HTML: - `title` is inserted into an ...[truncated 1586 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/examples.md:126
Finding: Documented Command-Line API Key Option Exposes Secrets and Is Not Implemented
Content: View full analysis
") sys.exit(1) return api_key ``` ```python parser.add_argument("--api-key", type=str, help="指定 API Key") ``` The duplicate script has the same behavior: ```python def get_api_key(): """从环境变量获取 API Key""" api_key = os.environ.get("REDFOX_API_KEY") if not api_key: print("❌ 错误:未找到 REDFOX_API_KEY 环境变量") print("请先配置:export REDFOX_API_KEY=<你的apikey>") sys.exit(1) return api_key ``` ```python parser.add_argument("--api-key", type=str, help="指定 API Key") ``` ### Technical Analysis The documentation instructs users to place an API key directly in the command line. Command-line arguments are an unsafe channel for long-lived secrets because they can be retained in shell history and may be visible through process-inspection facilities to other local users or monitoring agents. In addition, both scripts parse `--api-key` but never use `args.api_key`. Authentication always calls `get_api_key()`, which reads only `REDFOX_API_KEY`. Consequently, a user can expose a secret in the command line and still receive an error because the environment variable is absent. This behavior also contradicts the project's English security guidance, which says API keys should never be exposed in prompts or logs. ### Attack Path 1. A user ...[truncated 1226 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · assets/daily_report.py (reported line 124)May include surrounding context.
python
method="POST" ) with request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode('utf-8')) # 检查响应状态（红狐API成功码为2000）

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/playlet_wechat_daily.py (reported line 124)May include surrounding context.
python
method="POST" ) with request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode('utf-8')) # 检查响应状态（红狐API成功码为2000）

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A second independently identified description/behavior mismatch reinforces that the skill's declared safety and feature boundaries are unreliable. When a skill says it will not automatically fetch data and will wait for confirmation, but code defaults to automatic retrieval or local file opening, it creates a consent and integrity problem that can cause unauthorized API use, hidden side effects, and incorrect operator trust.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A second independently identified description/behavior mismatch reinforces that the skill's declared safety and feature boundaries are unreliable. When a skill says it will not automatically fetch data and will wait for confirmation, but code defaults to automatic retrieval or local file opening, it creates a consent and integrity problem that can cause unauthorized API use, hidden side effects, and incorrect operator trust.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises subscription and report generation but does not prominently disclose up front that enabling it will write files to local storage and automatically open HTML reports in a browser. Automatic local persistence and browser opening can surprise users, create privacy exposure through stored content, and increase risk if report content ever contains untrusted external resources or links.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says users can 'directly use natural language to describe needs, without memorizing commands,' which provides no clear constraints on when this skill should activate. Because the file does not define narrow trigger scope, exclusions, or negative examples, the invocation conditions are ambiguous for a markdown skill description.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares executable behaviors involving environment variables, filesystem writes/reads, and outbound network access, but does not scope or constrain those capabilities via explicit permissions or allowed-tools metadata. In an agent setting, this increases the chance of overbroad tool access, unintended data exposure, or execution of side effects beyond the user's expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The lack of clear trigger boundaries and negative examples makes it easier for the orchestration layer to invoke this skill on loosely related prompts. In this context, that is risky because the skill is not purely informational; it can access environment-backed credentials, call a remote API, and write/open local HTML output.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The lack of clear trigger boundaries and negative examples makes it easier for the orchestration layer to invoke this skill on loosely related prompts. In this context, that is risky because the skill is not purely informational; it can access environment-backed credentials, call a remote API, and write/open local HTML output.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill metadata explicitly requires that when the requested target date has no data, the user must first be informed and the tool must wait for confirmation before calling the API. This implementation instead defaults missing time bounds to the latest available date, which can cause silent retrieval of data the user did not request and violates an explicit safety/consent constraint in the skill contract.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Custom --start-time/--end-time values overwrite the computed date flow and are used directly without checking whether the requested period exceeds the latest permitted data date. This bypasses the manifest-required no-data confirmation logic and can trigger unauthorized or unintended data fetches for unavailable dates.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file requires the agent to use a single fixed output template written entirely in Chinese and states it is the only legal output format. This enforces a specific language without offering the user any language or locale choice, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The subscription examples describe enabling a daily automated task that continuously generates reports and writes files, but they do not clearly warn that this establishes ongoing background behavior on the local system. In an agent skill context, recurring automation without prominent disclosure can lead to persistent unintended execution, repeated file creation, and user confusion about why the system keeps changing over time.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest focuses on scanning article data, filtering hot content, clustering topics, and generating an HTML daily report, but the code also persists API results under ~/.workbuddy/cache and writes output under ~/Downloads/QoderReports. Persistent filesystem writes are a broader operational behavior than a purely on-demand query/report description suggests.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI help strings and printed messages state that daily subscription can be turned on or off, implying persistent scheduling or state changes. In reality, the code immediately returns after printing confirmation and does not create, store, or remove any subscription configuration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises one-click subscription that automatically generates reports and saves them to a local folder, but it does not clearly warn that the skill will perform filesystem writes on the user's device. Even if the behavior is expected for the feature, undocumented side effects reduce informed consent and can surprise users in restricted or sensitive environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The sample output says the generated HTML report is automatically opened in the browser, but there is no prominent warning that the skill will launch a local application. Auto-opening HTML can trigger unexpected system actions, expose local browsing context, or render untrusted remote content referenced by the report, so users should be warned before this occurs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: A language or locale policy issue exists when a skill effectively forces one language without opt-in or justification. This README is entirely Chinese-language and does not indicate that other languages are supported or that the Chinese-only presentation is an intentional, documented locale constraint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest describes a skill for querying short-drama WeChat article data and generating daily HTML reports. While network access to the upstream API is expected, directly sourcing secrets from process environment variables adds a credential-handling capability that is not mentioned in the skill purpose or manifest description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code creates an output directory and later writes an HTML report under ~/Downloads/QoderReports, and also persists cached API results under ~/.workbuddy/cache. While file generation is part of the script's purpose, there is no prior disclosure in comments/docstrings near the write path that user data and fetched content will be stored locally, which is the kind of warning this rule asks for in code files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The examples explicitly state that running the script will create an HTML file under the user's Downloads directory and automatically open it in a browser, but they do not warn the user about these local side effects before invocation. While this is not inherently malicious, undocumented file writes and application launches reduce informed consent and can surprise users in agent-driven environments where commands may be executed on their behalf.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes a skill for querying WeChat playlet article data and generating reports, but does not mention credential discovery from the runtime environment. Accessing environment variables to obtain secrets is an additional capability that is not directly surfaced in the stated purpose, even though it is used to authenticate API access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs an HTTP POST to a remote service and transmits query parameters such as topic and time range, but there is no explicit user-facing disclosure about the network call beyond ordinary progress output. For a code file, outbound transmission of user- or system-derived data should have some visible warning or confirmation unless clearly disclosed as part of the skill behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.