Security audit

公众号10w+文章

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its article-ranking purpose, but one referenced spec tells agents to look in shell profile files for an API key, which is broader credential access than this tool needs.

Install only if you are comfortable providing a Redfox API key, sending article queries to redfox.hk, and keeping generated JSON/HTML reports on disk. Do not allow the agent to search shell profile files for credentials; provide REDFOX_API_KEY through a managed environment or secret setting instead. Be aware that exported HTML reports load a third-party CDN script when opened for PDF export.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes use of environment variables, local file read/write, and outbound network access, but it does not declare permissions or clearly bound those capabilities. Undeclared capabilities make it harder for users and platforms to assess what the skill can access, increasing the risk of silent data exposure, unintended file writes, or network exfiltration if the implementation changes or is abused.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 79% confidence
Finding: The skill’s stated purpose suggests a simple hot-article discovery tool, but the documented behavior expands to third-party API dependence, local persistence in temporary JSON, HTML/PDF generation, and heuristic content analysis. This mismatch can mislead users about data flows and processing, which is security-relevant because users may not realize content and metadata are stored locally or sent to an external service under an API key.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The spec explicitly tells the skill to obtain an API key from shell profile files such as ~/.zshrc or ~/.bash_profile if the environment variable is unset. Reading user shell configuration is unnecessary for a content-retrieval skill, expands access beyond the declared purpose, and can expose unrelated secrets stored in those files. In this context, the instruction is especially suspicious because the skill only needs a configured credential, not filesystem access to discover one.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The script persists fetched article data to a local JSON file even though its primary purpose is retrieval and display. Silent disk persistence increases the data exposure surface: cached content may remain accessible to other local users, later processes, backups, or logs, especially if article metadata or future API responses contain sensitive fields.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs users to place an API key in environment variables or a local config file without warning against exposing it in shared files, terminals, logs, screenshots, or version control. This increases the chance of credential leakage, which could allow unauthorized use of the third-party API, quota theft, billing abuse, or access to associated account data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation describes retrieving an API key from the environment or shell profiles and sending it in the X-API-KEY header, but provides no user warning, consent flow, or clear boundary around credential access and transmission. This creates a risk of silent secret harvesting and exfiltration, especially since shell profile files often contain additional tokens, aliases, and private configuration unrelated to this API. The skill context makes this more dangerous because article lookup does not justify broad credential discovery behavior.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The script stores fetched content on disk without warning the user first, which creates an avoidable privacy and data-handling risk. Even if the content is not highly sensitive, undisclosed local persistence can surprise users and leave residual data in shared or monitored environments.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The generated HTML imports html2pdf.js from a public CDN at runtime, which creates a supply-chain and privacy exposure risk. Anyone opening the generated file will fetch third-party JavaScript that can change over time, and that script executes in the page context where article data and rendered content are present; for an export feature, this also means local/generated content may be processed by unpinned external code.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.