ClawHub
Back to skill

Security audit

小红书涨粉数据

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it handles subscriptions and contact delivery with weak safeguards and fetches ranking data over unauthenticated TLS.

Install only after reviewing the privacy and transport risks. Avoid using subscription delivery with real email or WeChat identifiers unless the storage file is protected, and treat generated Excel or email reports as untrusted until the TLS verification, spreadsheet escaping, and HTML escaping issues are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/query_rankings.py:52
Finding

TLS Certificate and Hostname Verification Disabled

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/export_to_excel.py:31
Finding

Spreadsheet Formula Injection in Excel Exports

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/delivery_service.py:170
Finding

Unescaped Data Embedded in HTML Email Reports

Content
View full analysis
body {{ font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; margin: 0; padding: 20px; background: #f5f5f5; }} .container {{ max-width: 800px; margin: 0 auto; background: white; border-radius: 8px; overflow: hidden; box-shadow: 0 2px 8px rgba(0,0,0,0.1); }} .header {{ background: #FF2442; color: white; padding: 30px; text-align: center; }} .header h1 {{ margin: 0; font-size: 24px; }} .header p {{ margin: 10px 0 0; opacity: 0.9; }} .content {{ padding: 30px; }} .chart {{ text-align: center; margin: 20px 0; }} .chart img {{ max-width: 100%; border-radius: 4px; }} table {{ width: 100%; border-collapse: collapse; margin-top: 20px; }} th {{ background: #f8f8f8; padding: 12px; text-align: left; font-weight: 600; color: #333; border-bottom: 2px solid #e0e0e0; }} td {{ padding: 12px; border-bottom: 1px solid #e0e0e0; }} tr:hover {{ background: #f8f8f8; }} .rank {{ font-weight: bold; color: #FF2442; }} .growth {{ color: #52c41a; }} .footer {{ background: #f8f8f8; padding: 20px; text-align: center; color: #999; font-size: 12px; }}

小红书{category}涨粉{type_name}

统计时间：{stat_date}

""" # 添加图表 if chart_path: # 在实际使用时需要将图片转为base64或上传到CDN html += f'

📊 排行榜图表

' # 添加数据表格 html += """
排名账号名称粉丝数
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/subscription_manager.py:77
Finding

Subscriber Personally Identifiable Information Stored in Plaintext

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (35)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill presented as a rankings tool but actually managing subscriptions, pricing tiers, user contact details, delivery scheduling, and send history materially expands the data handling and automation risk. Hidden collection and retention of email/WeChat identifiers can expose users to privacy harm, unwanted outreach, or misuse of stored personal data if the behavior is not clearly disclosed and consented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A skill presented as a rankings tool but actually managing subscriptions, pricing tiers, user contact details, delivery scheduling, and send history materially expands the data handling and automation risk. Hidden collection and retention of email/WeChat identifiers can expose users to privacy harm, unwanted outreach, or misuse of stored personal data if the behavior is not clearly disclosed and consented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

A skill presented as a rankings tool but actually managing subscriptions, pricing tiers, user contact details, delivery scheduling, and send history materially expands the data handling and automation risk. Hidden collection and retention of email/WeChat identifiers can expose users to privacy harm, unwanted outreach, or misuse of stored personal data if the behavior is not clearly disclosed and consented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill presented as a rankings tool but actually managing subscriptions, pricing tiers, user contact details, delivery scheduling, and send history materially expands the data handling and automation risk. Hidden collection and retention of email/WeChat identifiers can expose users to privacy harm, unwanted outreach, or misuse of stored personal data if the behavior is not clearly disclosed and consented.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
python3 scripts/query_rankings.py --category 综合全部 --type daily --limit 20 --output /tmp/rankings.json

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
python3 scripts/query_rankings.py --category 综合全部 --type daily --limit 20 --output /tmp/rankings.json

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.

md
python3 scripts/query_rankings.py --category 综合全部 --type daily --limit 20 --output /tmp/rankings.json

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 437)May include surrounding context.

md
python3 scripts/query_rankings.py --category 综合全部 --type daily --limit 20 --output /tmp/rankings.json

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill documentation advertises functionality that implies network access and local file read/write, but it declares no explicit tool scope or permissions. In an agent environment, this weakens user visibility and platform enforcement, making it easier for the skill to access files or external services without clear consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation encourages automatic push subscriptions but does not clearly warn that the skill may continuously send data to external channels. Ongoing outbound delivery increases privacy and abuse risk because users may not realize recurring communications, destination exposure, or third-party processing are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code retrieves a WeChat access token and posts template message data containing the recipient OpenID and report contents to external WeChat endpoints. Although failures are printed, there is no confirmation prompt or explicit user disclosure warning that user/report data will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The code places the WeChat app secret directly into the token request URL query string. Secrets in URLs can be exposed through logs, proxies, monitoring systems, exception traces, and network tooling, increasing the chance of credential leakage even when HTTPS is used.

Content

Scanner excerpt · scripts/delivery_service.py (reported line 116)May include surrounding context.

python
wechat_config = self.config.get('wechat', {})
            
            # 获取access_token
            token_url = f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={wechat_config.get('appid')}&secret={wechat_config.get('appsecret')}"
            token_resp = requests.get(token_url).json()
            access_token = token_resp.get('access_token')

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The access token is embedded in the message-send URL as a query parameter. Access tokens in URLs are prone to leakage via logs, reverse proxies, analytics, debugging output, and monitoring, which could allow unauthorized API use until the token expires.

Content

Scanner excerpt · scripts/delivery_service.py (reported line 125)May include surrounding context.

python
return False
            
            # 发送模板消息
            msg_url = f"https://api.weixin.qq.com/cgi-bin/message/template/send?access_token={access_token}"
            payload = {
                "touser": openid,
                "template_id": template_id,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/delivery_service.py (reported line 134)May include surrounding context.

python
if url:
                payload["url"] = url
            
            resp = requests.post(msg_url, json=payload).json()
            
            if resp.get('errcode') == 0:
                return True

Tainted flow: 'msg_url' from requests.get (line 125, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/delivery_service.py (reported line 134)May include surrounding context.

python
if url:
                payload["url"] = url
            
            resp = requests.post(msg_url, json=payload).json()
            
            if resp.get('errcode') == 0:
                return True

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains user-facing docstrings, CLI description, help text, and status/error messages exclusively in Chinese. The stated policy flags language or locale constraints when a skill forces a specific language without user opt-in, and this file does not offer any language selection or justify a region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains natural-language descriptions and CLI help text that force a specific language/locale experience for users. Under the policy, language constraints should be optional or clearly justified; here the script presents Chinese-only instructions and labels with no opt-in or explanation that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The command-line interface help strings and status messages are presented exclusively in Chinese, which constitutes a language/locale policy issue when no user choice is offered. Users who do not read Chinese cannot meaningfully understand prompts or outputs, and the file does not document this as a justified locale-specific tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code claims to only omit SNI, but it also disables certificate validation and hostname checking via ssl.CERT_NONE and check_hostname=False. That allows man-in-the-middle interception or spoofing of the remote API, so returned ranking data can be silently modified and any transmitted query parameters exposed to an attacker on the network path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code file performs an outbound HTTPS request to a third-party endpoint using user-supplied parameters such as category, date, and source. Although the code has internal comments/docstrings, there is no user-facing disclosure at the point of execution that the script will contact an external service and transmit request data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for tracking Xiaohongshu follower-growth rankings and generating visual ranking charts. In this file, the implemented behavior is creating, updating, canceling, and listing subscriptions, including storing user contact fields like email and wechat_id, which is a different functional scope than rankings analysis or chart generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file contains user-facing natural language in Chinese in the module docstring and throughout the CLI interface, which effectively forces a specific language for users. The policy allows locale constraints only when the skill offers opt-in language choice or clearly documents a justified region-specific requirement, neither of which is present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script persists subscription records, including email and WeChat ID, to a local JSON file without any user-facing disclosure or visible safeguards. Storing personal data in plaintext local files increases the risk of unauthorized access, accidental leakage, or improper retention, especially because the skill context does not strongly signal that contact-data storage is part of its core purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code collects and stores personal contact data (email and WeChat ID) even though that data collection is not clearly justified by the skill description focused on rankings and charts. Unnecessary collection of personal data expands the privacy attack surface and increases harm if the local storage is exposed or mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

Automatically copying generated images to the desktop creates local files outside the immediate output context and may surprise users in shared or managed environments. While lower severity, unannounced file creation can expose sensitive or proprietary content to other local users, backup systems, or sync services.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/query_rankings.py:53