全网聚合热点榜

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:01 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches a hot-topic reporting tool, but its generated HTML reports and unsupported subscription instructions create review-worthy security and trust risks.

Install only if you are comfortable giving the skill a Redfox API key, letting it contact Redfox for each query, and reviewing generated HTML reports before sharing or opening them in sensitive browser contexts. Treat subscription and keyword-monitoring features as unsupported unless the publisher provides a real implementation with clear consent and cancellation controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:108

Finding

Mandatory Promotion of an Unsupported Subscription Capability

Content

View full analysis

📬 Subscription Push Service

Want to continuously track trending topics? You can subscribe to the latest ranking, updated every hour, or subscribe to yesterday's data.

``` ### Technical Analysis The Skill requires the agent to append a subscription-service promotion to ordinary ranking requests and embeds the same promotion in every generated report. This instruction is unrelated to the minimum operation necessary to fetch, aggregate, and display trending-topic data. The project contains no implementation for creating, storing, scheduling, listing, or canceling subscriptions. There is no scheduled-task code, persistence layer, notification destination handling, or subscription API integration. Consequently, the mandatory prompt advertises a capability that the supplied code cannot perform. Th ...[truncated 1300 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_html_report.py:122

Finding

Stored HTML and Script Injection in Generated Reports

Content

View full analysis

str: """Generate a TOP10 table row.""" return f''' {rank} {hotspot["title"]} {hotspot["hot_score"]} {hotspot["platform_count"]}个 {hotspot["duration"]} ''' ``` ```python # Build topic links topic_links = [] for t in topics[:3]: title = t.get("title", "") url = t.get("url", "") if url: topic_links.append(f'{title}') else: topic_links.append(title) topics_str = "、".join([f"「{t}」" for t in topic_links]) ``` ```python discussion_items += f'''

{get_platform_emoji(plat)} {plat}

{focus}，如{topics_str}

\n''' ``` Additional fields, including `prediction`, `prediction_emoji`, `hot_score`, `duration`, platform names, `start_date`, and `end_date`, are also inserted into the HTML through direct string interpolation or replacement. ### Technical Analysis The report renderer treats API-derived and agent-produced values as trusted HTML. It does not apply HTML escaping to text nodes or attribute escaping to URLs. It also does not validate URL sc ...[truncated 2443 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: assets/report-template.html:7

Finding

Execution of Remote JavaScript Without Subresource Integrity

Content

View full analysis

``` ### Technical Analysis Every generated report loads and executes `html2canvas` from a third-party CDN when opened. Although the URL contains a version number and uses HTTPS, the script is not protected by a Subresource Integrity hash. The report therefore trusts the CDN, its account and deployment controls, DNS resolution, certificate infrastructure, and delivery path to provide the expected script. If the resource served at that URL is modified or the delivery chain is compromised, arbitrary JavaScript will execute in the report's page context. The dependency is needed only for optional image export, yet it is loaded automatically whenever the report is opened. Loading the resource also discloses network metadata to the CDN, including the user's IP address, request timing, and browser headers. The generated report has no restrictive Content Security Policy to limit the behavior of a compromised dependency. ### Attack Path 1. The CDN resource, CDN account, publishing workflow, DNS path, or delivery infrastructure is compromised. 2. The expected `html2canvas` file is replaced or served with malicious JavaScript. 3. A user opens a generated report while connected to the network. 4. The browser automatically downloads the remote script because it is included in the report header. 5. No integrity hash is available to detect that the script differs from the reviewed dependency. 6. The malicious script executes with access to the report DOM. 7. It reads or alters report content and can transmit information to external endpoints. ### Impact Assessment A compromised dependency can obtain JavaScript-level control over the generated report. It can read the report, man ...[truncated 388 chars]

Remediation

View remediation

``` 4. Generate the integrity value from an independently verified release artifact rather than trusting the CDN response alone. 5. Add a Content Security Policy that permits scripts only from the local report package or the single explicitly approved source. 6. Load the export library only after the user explicitly requests image export, rather than automatically on report opening. 7. Document the dependency source, version, integrity value, update procedure, and review process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tainted flow: 'req' from os.environ.get (line 78, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_hotspot.py (reported line 90)May include surrounding context.

python

# 发送请求
        try:
            response = urllib.request.urlopen(req, timeout=15)
        except urllib.error.HTTPError as e:
            return {
                "status": "error",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The sample output demonstrates single-topic detail views even though the metadata explicitly says the skill does not support querying specific hot topics. This contradiction can cause downstream agents or users to rely on unsupported granular analysis, increasing the chance of prompt-routing errors, unsafe assumptions about data access, or unauthorized feature expansion.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

该代码的核心确实与“获取热点数据”相关，但与声明存在明显行为差异。首先，代码并未自行基于抖音、微博、B站、快手、知乎、头条、百度7个平台做聚合，而是调用一个外部聚合API（source=全平台热搜推荐-ClawHub），因此无法从代码层面确认数据仅来自所述7个平台。其次，代码没有实现“近7天”限制，用户可传入任意 start-date/end-date 进行历史查询。再次，代码在 JSON 输出中返回所有热点项，只在 markdown 测试输出时截取前10条，因此其实际能力不是严格的“全网最热TOP10”。最后，声明说“不支持具体热点查询”，虽然代码没有按关键词检索接口，但它保留 source_keyword 并支持精确时间范围查询，实际查询能力比声明更宽。综合来看，属于描述与实际行为不完全一致，且存在未声明/错误限定的能力。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个“热点聚合查询/分析”技能，核心能力应包括从多个平台获取热点数据、进行聚合计算并返回全网TOP10，以及支持近7天回溯。实际代码却是一个纯展示层脚本：读取现成JSON、校验字段、渲染模板、输出HTML。代码注释也明确说明它不进行数据分析、事件识别、热度计算或趋势预测。因此其主要用途与声明的主要用途存在实质性偏差。虽然代码处理的数据字段与热点报告相关，但它依赖外部已分析好的输入，不具备声明中的核心业务能力，且增加了未声明的HTML导出能力，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill manifest explicitly says it does not support querying specific hot topics, but the instruction file adds per-topic detail mode, trend prediction, and content advice for individual ranked items. This creates a scope mismatch that can mislead the orchestrator or users into invoking unsupported capabilities, potentially causing unauthorized data access paths, fabricated outputs, or unsafe tool routing beyond the declared trust boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README claims capabilities beyond the declared skill scope, including trend prediction, detailed per-topic analysis, HTML report generation, and subscription push. This creates a specification mismatch that can mislead users or orchestrators into granting broader trust, invoking unsupported behaviors, or wiring the skill into higher-risk workflows than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are generic everyday language such as 'latest trends' and 'today's hot topics', which can cause accidental or overly broad invocation by an agent. In multi-skill environments, ambiguous routing increases the risk of the wrong skill being selected, leading to unintended external API use, unnecessary data disclosure, or user confusion about what system is acting.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases such as '热点榜', '全网热点', '今日热点', and similar variants are very broad, natural-language phrases that can easily appear in ordinary conversation. In an agent ecosystem, this increases the chance of unintended invocation, which can cause the skill to run without clear user intent and potentially trigger downstream actions like report generation or external API use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The subscription activation example '订阅每日推送' is a direct, minimally constrained phrase for enabling an ongoing action. Because subscriptions create persistent behavior, ambiguous activation language can lead to accidental enrollment and repeated future notifications or API activity without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documents capabilities that involve environment variables, file reads/writes, and network access, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and transparency gap: a host may grant broader access than users expect, and reviewers cannot easily verify that the skill only uses the minimum privileges necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill description and all invocation guidance are written exclusively in Chinese, and the documented trigger examples and output expectations assume Chinese-language usage. There is no indication that users may choose another language or that the Chinese-only constraint is required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README instructs users to configure an API key for a third-party service but does not clearly warn that user requests and derived hotspot queries will be transmitted to an external API. This weakens informed consent and can expose potentially sensitive query patterns, timestamps, or usage metadata to a third party without adequate disclosure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest says the skill does not support querying specific hotspots, but the bundled data exposes direct per-topic destination URLs for individual trending items. This creates a capability/behavior mismatch that can mislead upstream agents or users, and can be abused to pivot users into unvetted external content despite the declared narrower scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This JSON asset contains user-visible natural-language content entirely in Chinese, including the top-level message value "成功". For a general-purpose skill asset, this imposes a specific language/locale without any indication of user opt-in or a documented region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The HTML document declares lang="zh-CN", and the visible interface text throughout the template is Chinese-only, which indicates the skill is fixed to a specific language/locale. There is no indication in this file that the user can opt into this locale or that the restriction is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Manifest 明确声明“聚合全网最热TOP10热点”“不支持具体热点的查询”，但该模板设计了单个热点的详细卡片、跨平台讨论差异、最高排名和预测内容等具体热点级展示区域。这表明技能实际输出被设计为支持具体热点的细粒度呈现，超出了仅提供聚合榜单且不支持具体热点查询的描述范围。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

All natural-language instructions, commands, and system replies are specified exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. This can violate language or locale policy when the skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

A numeric-only trigger for '1-10' is underspecified and can fire on unrelated numeric input, especially in chats where users mention rankings, dates, counts, or examples. Because it opens a more detailed mode, it can unintentionally expose expanded functionality and create confusing or unsafe state transitions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The command '返回' is a common conversational/navigation term and may collide with host-agent or user-intended navigation rather than this skill's internal state. Ambiguous interception can cause unexpected mode changes, user confusion, or routing errors, though the direct security impact is limited.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The export command promises a Markdown file containing all topic details, which goes beyond a simple aggregated TOP10 display and implies bulk extraction of enriched data. Bulk export increases the chance of over-disclosure, downstream sharing, and misuse, especially when the manifest only advertises aggregate leaderboard functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The subscription instructions describe hourly or daily pushes and keyword monitoring without a clear user-facing warning about ongoing notifications and persistent tracking behavior. Lack of transparent consent increases the risk of deceptive activation, user surprise, and privacy complaints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A bare single-word trigger like '订阅' is highly generic and may match ordinary conversation, causing unintended entry into a subscription flow. In a skill with push features, accidental activation can lead to unwanted notification setup or confusing consent UX.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Keyword-specific tracking subscriptions materially expand the skill from aggregate leaderboard viewing into ongoing monitoring of user-specified subjects. That is outside the stated scope and can introduce privacy, consent, and backend processing risks because users may unknowingly enable persistent tracking behavior not described in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template introduces subscription and push-service behavior that is not described in the skill metadata, creating a mismatch between declared and actual capabilities. Hidden or undeclared interaction patterns are risky because they can mislead users and may trigger persistence-like behavior or follow-on actions outside the expected hotspot-query workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template instructs the agent to go beyond its declared purpose of hotspot aggregation by generating reports, saving structured files, and producing HTML artifacts. This scope expansion can cause the agent to perform side-effecting file operations and artifact creation that users did not explicitly request, increasing the chance of unintended data handling or abuse of the execution environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.