Security audit

短剧-小红书信息源

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent report generator for Xiaohongshu short-drama trends, with disclosed API, local report, cache, and browser-opening behavior.

Install only if you are comfortable giving the skill a RedFoxHub API key, allowing it to query RedFoxHub, write reports and cache files locally, and open generated HTML reports that may load remote images and links. For date-specific requests, confirm the exact date before allowing --latest fallback behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation indicates capabilities to read environment variables, access the network, and read/write local files, but it declares no permissions. This weakens user and platform awareness of the skill's actual access surface and can lead to over-trusting a tool that handles API keys, local cache files, generated reports, and browser-opened artifacts.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description says it must not automatically fetch data for unavailable dates and emphasizes confirmation, but the documented behavior also includes automatic querying of the latest available data, automatic browser opening, cache use, and subscription-style persistence. This mismatch can mislead users and orchestrators about when network calls, local writes, and side effects occur, increasing the chance of unauthorized actions or privacy-impacting behavior.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The skill metadata says that when the target date has no data, the user must be informed and the tool must wait for confirmation before fetching fallback data. However, the code permits automatic querying through default, --latest, and custom time paths, which can bypass that consent requirement and violate expected data-access behavior.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The generated HTML embeds remote cover image URLs and external Xiaohongshu links, so opening the local report triggers additional outbound requests to third-party infrastructure. This expands the skill from local report generation into client-side network activity, creating privacy leakage and exposing users to untrusted remote content when the report is viewed.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The date-precheck section requires blocking unavailable dates and waiting for user confirmation, while the `--latest` parameter description says it automatically skips no-data intervals. That conflict can lead agents to silently substitute a different date than the user requested, creating integrity and consent issues and making the report appear to represent a date it did not actually query.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The document says the `source` field is fixed to one value, but the example payload and accompanying note use different fixed strings (`ClawHub` vs `GitHub`). In systems that rely on `source` for provenance, access control, billing, or audit correlation, this inconsistency can cause misattribution, failed requests, or bypass of downstream policy checks.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The date-precheck section requires blocking unavailable dates and waiting for user confirmation, while the `--latest` parameter description says it automatically skips no-data intervals. That conflict can lead agents to silently substitute a different date than the user requested, creating integrity and consent issues and making the report appear to represent a date it did not actually query.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The examples endorse `--latest` as an automatic path that computes and queries the newest date, while the skill metadata explicitly requires the agent to stop, notify the user when the target date has no data, and wait for confirmation before fetching an alternate date. This inconsistency can cause the agent to violate user-consent and data-access constraints by automatically retrieving substitute data the user did not approve.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The 'best practice' guidance tells operators to use `--latest` directly and let the tool handle date logic automatically, which conflicts with the stated rule that missing target-date data requires prior notice and user confirmation. Because best-practice sections are likely to be followed verbatim, this increases the chance of systematic policy bypass and unauthorized automatic retrieval.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README encourages broad natural-language triggering such as 'simply describe your needs' plus multiple generic phrases like 'show me short drama trends' and 'what's trending in short dramas'. In agent environments that select skills by semantic matching, this can cause unintended activation and downstream API calls or side effects when a user’s request is ambiguous or only loosely related.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises 'one-click subscription for automatic daily report delivery to local folder' and later says the visual report is 'automatically opened in your browser', but does not foreground these as explicit side effects requiring user consent. Automatic file writes and browser launches can surprise users, create privacy or workspace risks, and be abused if the skill is triggered unintentionally.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README advertises very broad natural-language triggers such as '查询短剧热点' and '短剧爆款有哪些', which can overlap with ordinary conversation and cause the agent to invoke the skill unexpectedly. Because the skill can query external data, save reports locally, and open generated pages in a browser, over-broad invocation increases the chance of unintended tool use and side effects without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README mentions subscription and later notes that reports are saved locally and opened in a browser, but it does not make these side effects prominent and explicit at the point users are encouraged to enable them. This can lead to users unknowingly authorizing persistence and browser execution-like behavior, which is risky in an agent setting because it affects the local environment beyond simple data retrieval.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger text uses broad phrases like requests for hot topics, trends, or custom topic queries, which can match common user intents beyond the user's explicit request to invoke this skill. Over-broad activation criteria can cause unintended network calls, file creation, or report generation in contexts where the user only wanted general discussion or analysis.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: Automatically opening a generated HTML report in the local browser is a side effect that can surprise users and may expose local activity, invoke browser handlers, or render untrusted remote resources referenced by the HTML. Even if the report is locally generated, undisclosed auto-open behavior increases the attack surface and reduces user control.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The subscription feature is described as creating daily outputs in a local folder, but the persistence and recurring file creation side effects are not prominently warned about. This can lead to silent accumulation of local data, privacy issues, and confusion about ongoing automated behavior, especially in shared or managed environments.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The examples describe generating files and automatically opening a browser without prominently warning about these local side effects beforehand. In an agent setting, undocumented writes and automatic application launches can surprise users, affect privacy, and reduce trust because actions occur on the local machine beyond pure data retrieval.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The subscription example enables recurring report generation and saving into the user's Downloads directory, but the example does not clearly warn that this creates ongoing local writes. Even though the behavior appears intended, silently normalizing automatic persistence can lead to unexpected disk usage, exposure of sensitive usage patterns, or confusion about where files are stored.

Static analysis

No suspicious patterns detected.