Security audit

全网热点追踪

Security checks for vulnerabilities and agentic risk

Overview

The skill is a trend-fetching tool, but it handles an API key insecurely and advertises recurring push behavior without enough controls.

Install only after the publisher fixes TLS verification, removes the unnecessary unpinned dependency, replaces unsafe temp-file creation, repairs the syntax error, and documents subscription confirmation and cancellation. Use a narrowly scoped, revocable RedFox API key if you test it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_hotspot.py:169
Finding: API Credential Transmitted Without TLS Certificate Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_hotspot.py:425
Finding: Unsafe Predictable Temporary File Creation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:64
Finding: Unnecessary and Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/fetch_hotspot.py:370
Finding: Malformed Function Call Prevents Script Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose does not fully disclose sensitive behaviors: external calls to redfox.hk, reading REDFOX_API_KEY from the environment, and saving full data to a local file. Undisclosed capability expansion is dangerous because reviewers and users may trust the skill for simple hotlist aggregation while it also handles secrets and persists fetched data, increasing the chance of unintended data exposure or policy bypass.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger examples include very generic phrases such as "Hot ranking," "trending list," and "all-platform hot search," which can easily overlap with ordinary user conversation. In an agent ecosystem, this can cause unintended invocation of the skill when a user is merely discussing trends, leading to unexpected external API use, data retrieval, or workflow branching without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Subscription phrases like "Subscribe to daily push" and "Subscribe to weekly push" are ambiguous because they do not identify the skill, subject, destination, or confirmation step. If matched loosely, they could trigger persistent scheduled actions from routine conversation, creating unwanted notifications or ongoing API-backed tasks without sufficiently explicit consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises scheduled push subscriptions but does not warn users that this creates ongoing notifications or other persistent user-impacting behavior. Lack of disclosure reduces informed consent and makes accidental enrollment more likely, especially in a skill that otherwise appears focused on passive data lookup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README uses very broad activation examples such as “热点榜 / 热榜 / 全平台热搜”, which overlap with normal user conversation and can cause the skill to trigger when the user did not clearly intend to invoke it. In an assistant environment, ambiguous triggers can lead to unintended data retrieval, context switching, or downstream actions that the user did not explicitly request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The subscription phrase “订阅每日推送” is an action-oriented trigger that can create an ongoing scheduled behavior, but the README does not indicate any confirmation or opt-in safeguards. Ambiguous or one-shot wording for a persistent action increases the risk of accidental subscription and unwanted recurring notifications.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable behavior that reads environment variables, performs outbound network access, and writes files, but it does not declare any corresponding tool scope or permissions. This weakens reviewability and consent boundaries, making it easier for a host agent or user to invoke capabilities they did not clearly authorize.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L022 states the skill '不支持查询特定热词详情，仅提供全网热点榜聚合查询', which narrows the intended capability. However, later sections document --keywords filtering and --expand-keywords behavior for targeted term queries, indicating the skill does in fact support focused keyword-based retrieval. This is an active contradiction in the skill documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill claims subscription/push functionality but provides no consent model, frequency controls, unsubscribe mechanism, or explanation of what user data would be stored to support notifications. Subscription features inherently involve persistence and repeated contact, so vague documentation can lead to privacy issues, unwanted notifications, or unauthorized monitoring workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase "热点榜" is very broad and likely to appear in ordinary user conversation, making accidental invocation plausible. In a skill that is meant to intercept natural-language trend queries, this can cause the agent to route unrelated or ambiguous requests into the skill unexpectedly, reducing user control and increasing the chance of context hijacking or unintended actions such as subscriptions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: "今日热点" is a common conversational phrase, so the skill may activate when a user is simply discussing current events rather than intentionally invoking this capability. Because the skill aggregates information from multiple platforms and may steer the session toward follow-up actions like viewing more or subscribing, ambiguous activation creates an avoidable prompt-routing risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The phrase "最新热榜" is generic and overlaps with everyday requests for the latest trending topics. In an agent environment, broadly matching this phrase can lead to unintentional invocation of the skill, especially when multiple skills or native assistant features could satisfy the same request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The open-ended "搜..." trigger pattern is under-specified and can match a very large class of everyday requests, creating a broad interception surface. Combined with automatic keyword generalization, the skill may transform a narrow user request into a wider query than intended, which increases the risk of surprising behavior and overbroad data retrieval.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file is entirely prescriptive in Chinese and includes fixed Chinese interaction phrases such as reply commands for viewing lists and subscribing. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The entire skill document is written as a Chinese-only specification and the prescribed output examples are also only in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language locale violation unless the regional constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill's natural-language descriptions, warnings, and CLI help text are written exclusively in Chinese, with no indication that users may choose another language. Per the policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest presents this skill as a hot-search aggregation/report/export/subscription tool for users, but does not indicate any need to access host environment secrets. Reading REDFOX_API_KEY from process environment gives the code access to deployment credentials, which is a broader capability than the user-facing purpose implies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code sends user-supplied source, platform, keyword, and date parameters to a remote HTTPS API and includes the REDFOX_API_KEY in the request headers. Although the function has an internal docstring, there is no user-facing disclosure at the CLI boundary that input data will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes the full fetched dataset to a temporary file and then exposes that path in output. This creates unnecessary local data persistence and may disclose more data than the user expected, especially in shared environments where temp files may be readable by other local users or later reused by other components.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Writing full result data to a temp file without explicit user consent increases the chance of unintended local disclosure and over-retention. Because the script also surfaces the file path, another local actor or downstream tool may access data that the user only expected to see in summarized form.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The primary invocation and usage description is presented entirely in Chinese and includes user-facing trigger examples like '问我准没错', '今日热点', and '查看{平台名}完整榜单' without stating that Chinese is optional or that the skill is intentionally limited to a Chinese-language audience. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Natural-language policy review applies to all file types. The skill instructions and command phrases are presented only in Chinese, which effectively forces a specific language/locale for use without any opt-in, multilingual alternative, or documented region-specific justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: "昨天的热点" is still broad conversational language, but it is somewhat more specific than the shorter trigger phrases and therefore slightly less collision-prone. Even so, without clear activation constraints, the skill could still capture ordinary dialogue and perform unintended retrieval behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: "本周热点" is a natural phrase a user might say in many contexts, so it can collide with ordinary assistant requests. The context of this skill makes accidental routing credible because the skill is specifically designed around common trending-topic queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script reads REDFOX_API_KEY from the environment to authenticate outbound requests. While the missing-variable error explains how to set the variable, it does not warn users up front that the skill accesses a credential from the environment as part of its normal operation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/fetch_hotspot.py:180