全网聚合热点榜

• Outcome: Review
• Latest audit: Jun 2, 2026 · 10:27 AM UTC
• Version: 1.0.3

Overview

The skill mainly does what it advertises, but it has under-scoped subscription/keyword-tracking instructions and unsafe HTML report generation that warrant review before installation.

Install only if you are comfortable giving the skill a RedFox API key and allowing it to contact redfox.hk and create local report files. Avoid using the subscription or keyword-tracking flows unless the host clearly asks for confirmation and shows how to cancel them. Treat generated HTML reports as untrusted content because external trend data is inserted into the page without strong sanitization.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documents use of environment variables, local file creation, reading templates/references, and external API access, but it does not declare corresponding permissions. This creates a transparency and consent problem: a host or user may approve the skill based on incomplete capability disclosure, while the skill can still access credentials, write reports locally, and send data to a third-party service.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The declared purpose says the skill provides an aggregated top-10 hotspot view and does not support detailed hotspot queries, but the documented behavior includes direct third-party API access, outputting all fetched hotspot items, and generating analytical HTML reports with predictions. This mismatch can mislead users about the scope of processing, external data transfer, and local artifact generation, undermining informed consent and policy enforcement.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The instruction file advertises capabilities to view specific hot-topic details and create keyword-tracking subscriptions, which exceeds the stated skill boundary that it does not support querying specific topics. This mismatch can mislead users and downstream agents into invoking unsupported or more privacy-sensitive behaviors, increasing the chance of unauthorized data access, unsafe integrations, or policy bypass through prompt routing.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The document presents the skill as a top-level aggregated ranking tool, but later claims single-topic deep-detail and keyword-monitoring features. This internal inconsistency can cause unsafe assumptions by orchestrators or users about what actions and data flows are permitted, making scope enforcement unreliable.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The template instructs the agent to automatically save a JSON file and invoke a local script without user confirmation, which expands behavior beyond the declared read/query function of the skill. This can create unauthorized side effects on the host environment and normalizes arbitrary local file writes and command execution patterns, which become dangerous if similar instructions are followed in more sensitive contexts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill advertises very generic trigger phrases such as 'Hot ranking', 'latest trends', and 'real-time hot topics', which are likely to collide with ordinary user requests unrelated to this specific skill. In an agent environment with multiple skills, this can cause unintended invocation, routing confusion, and data exposure through over-broad activation of external API-backed functionality.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are very broad and map to common requests like '今日热点' or '最新热点', which can cause the skill to activate in conversations where the user did not explicitly intend to invoke this external-data skill. Because the skill may fetch remote data or initiate downstream features such as report generation, overbroad activation increases the risk of unintended tool use and user confusion.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises HTML report generation and subscription push behavior but does not clearly warn users about side effects such as file creation, persistent scheduled actions, or possible outbound communications. In an agent setting, undocumented side effects can lead to unintended writes, recurring notifications, or privacy-impacting operations being triggered without sufficiently informed consent.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill instructs users to place an API key in an environment variable or config file but provides no guidance on secure storage, least privilege, rotation, or avoiding accidental exposure. In practice, this increases the risk of credential leakage through shell history, overly permissive config files, logs, screenshots, or checked-in dotfiles.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Using the bare trigger phrase '订阅' to start subscription flows is overly broad and can be activated during normal conversation without clear user intent. Because subscription changes are stateful and may enable ongoing notifications, ambiguous activation increases the risk of accidental enrollment or consent confusion.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The standalone '订阅' trigger is reused across multiple subscription modes without clear disambiguation, so a generic user utterance may route into the wrong flow. This creates a consent and integrity problem where users can be subscribed to a category they did not explicitly choose.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: A standalone '订阅' trigger for keyword tracking is especially risky because keyword subscriptions may imply storing or monitoring user-specified interests over time. Without explicit parameters and confirmation, the skill could capture sensitive preference data or create persistent tracking unintentionally.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The export command initiates Markdown file generation without warning the user that a file will be created or where its contents may be stored or exposed. File creation is a side effect that can leak aggregated content, surprise the user, or create artifacts that downstream systems treat as trusted outputs.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The subscription commands promise push delivery without warning about persistent notifications, ongoing processing, or the handling of user subscription state. This can undermine informed consent and create privacy or messaging-abuse concerns, especially if subscriptions are easy to trigger and hard to distinguish.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script interpolates untrusted JSON fields such as title, focus, prediction, and topic URLs directly into HTML without escaping or URL validation. If an attacker can influence structured_report.json, they can inject markup or JavaScript into the generated report, leading to stored XSS when the HTML file is opened in a browser; in this skill context, report content is aggregated from external trending platforms, making hostile content more plausible and increasing risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.