今日头条爆款查询

• Outcome: Review
• Latest audit: Jul 20, 2026 · 1:49 PM UTC
• Version: 1.0.1

Overview

This skill does what it advertises, but it exposes the user's Redfox API key in generated reports and through an unauthenticated local proxy.

Review this skill before installing. Use it only with a low-privilege Redfox API key, avoid sensitive search terms unless you are comfortable sending them to Redfox, do not share generated HTML reports, and stop the local server when finished. Prefer CSV-only mode or a revised version that removes API-key embedding and protects the local proxy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation instructs use of environment variables, filesystem output, network access, and shell commands, but it does not declare permissions or clearly scope those capabilities. This weakens reviewability and informed consent, because users and platforms cannot easily assess that the skill will read secrets, contact an external service, and write files locally before use.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill starts a localhost HTTP proxy that forwards requests to upstream APIs using the user's API key, expanding the skill from simple search/export into an API gateway. Any local webpage or process can invoke this proxy because it allows unauthenticated requests and returns data with permissive CORS, which can enable unauthorized use of the user's key-backed access.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Embedding a localhost proxy capability is not clearly necessary for a content-search/report skill and materially increases attack surface. The proxy accepts client-triggered search/detail requests and relays them with the stored API key, turning a reporting tool into a reusable privileged API endpoint for other local content.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The generated HTML includes the raw API key by replacing {{API_KEY}} in the page content, which exposes a secret to any script running in the page, anyone with access to the file, browser extensions, or accidental sharing of the report. In this skill context, the API key is the credential protecting the upstream data service, so embedding it in export artifacts is highly dangerous and unnecessary.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill asks users to provide arbitrary search keywords and uses an external API, but the description does not prominently warn that those user-provided queries are transmitted off-platform. This can expose sensitive business, personal, or investigative queries to a third-party service without sufficiently explicit notice, which is especially risky for monitoring, competitor tracking, or public-opinion workflows.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Placing the API key into client-side report content without an explicit warning or consent leaks a sensitive credential into a broadly accessible medium. Since the report is intended to be opened in a browser and potentially saved or shared, this creates a realistic path for credential compromise and downstream API abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _do_proxy_request(self, url, payload):
        try:
            resp = requests.post(url, json=payload,
                headers={"Content-Type": "application/json", "X-API-KEY": self.api_key}, timeout=15)
            self._send_json(resp.json())
        except Exception as e:

• Confidence: 90% confidence
• Finding: External transmission is expected for a search skill that calls a remote API, but this specific transmission is part of the local proxy path that forwards requests using the user's API key. In combination with the proxy design, it increases risk because third-party local callers can cause authenticated outbound requests without directly possessing the credential.

Static analysis

No suspicious patterns detected.