公众号账号诊断

• Outcome: Review
• Latest audit: Aug 6, 2026 · 2:45 AM UTC
• Version: 1.0.2

Overview

The skill largely matches its WeChat account analysis purpose, but it handles API secrets and persistent local configuration in ways users should review before installing.

Review this skill before installing. Use it only if you trust redfox.hk with your API key and queried account identifiers. Prefer setting REDFOX_API_KEY only for the current session or through a secret manager, and avoid letting the Agent edit shell profile files automatically. Check and delete artifact/output files if the reports or raw API data should not remain on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises operational capabilities that imply environment access, file read/write, and network use, but does not declare permissions or clearly scope those powers. This reduces transparency and informed consent, making it easier for the skill to perform sensitive actions such as reading credentials, writing local files, or sending data externally without adequate review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is account diagnosis, but the documented behavior extends to sensitive system interaction and external data handling, including reading shell configuration locations, configuring credentials, persisting raw API output, and generating files. This mismatch can mislead users about the true trust boundary and creates risk of credential exposure, unintended persistence, and third-party data transfer beyond what the description suggests.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documentation tells the agent to help configure a persistent user environment variable, which modifies the user's system outside the core purpose of account analysis. Persistent shell/profile changes can outlive the session, be applied incorrectly, or expose secrets through logs, history, or future processes that inherit the environment.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The workflow adds a subscription feature that persists ongoing tracking of an account, which expands behavior beyond the stated one-time diagnosis capability in the manifest. Hidden or undocumented capability expansion is dangerous because it can trigger repeated data collection or user state changes without explicit consent, undermining least surprise and creating privacy/compliance risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script reads multiple shell startup files and extracts REDFOX_API_KEY automatically, which reaches beyond the minimum data access needed for a公众号 analysis tool. Even if limited to one variable pattern, this behavior silently inspects user configuration files and can access secrets without explicit runtime consent, creating credential exposure and privacy risk.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The skill stores raw API responses and generated report data on disk in an output directory, which expands the exposure window for potentially sensitive account data. While local persistence may be useful for reporting, retaining raw data by default can leak information to other local users, backups, or later processes if file permissions and retention are not controlled.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The README instructs users to invoke the skill with broad natural-language phrases like "Describe your needs in natural language" and examples such as "Diagnose account-name." This can cause the skill to trigger on ambiguous user input or be selected when the user did not intend to use this specific capability, increasing the chance of unintended data lookups or overbroad processing, though the skill’s scope is relatively narrow and read-oriented.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README says users can 'directly use natural language to describe needs' without defining a narrow activation boundary. That makes it more likely the skill will trigger on ordinary conversation or loosely related requests, causing unintended invocation and possible exposure of the skill's data access or actions in contexts where the user did not clearly intend to use it.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Example phrases like '诊断我的公众号', '分析 XX 公众号', and '评估 XX 账号价值' are broad and semantically close to normal discussion, analysis, or advice requests. In an agent environment, ambiguous trigger phrasing can cause over-eager routing to this skill, leading to unintended handling of user prompts and expanding the skill's effective authority beyond a tightly scoped use case.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Overly broad trigger phrases increase the chance that the skill activates in contexts the user did not intend, which is risky for a skill that can access credentials, contact external services, and write files. Accidental activation can lead to unintended data transmission or system guidance without clear user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill discusses automatically configuring permanent environment variables and reading API keys without clearly warning users about the sensitivity of those actions. Missing risk disclosure makes unsafe secret handling more likely, including exposing keys in shell history, screenshots, shared terminals, or persistent profile files.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The workflow instructs automatic retrieval of account data and writes raw/report data to local files without any user-facing disclosure about data handling, retention, or sensitivity. This is risky because even business-account analytics may include metadata, query history, and potentially sensitive operational data that can be stored unexpectedly and exposed through local access, logs, backups, or later reuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Directly reading shell configuration files for credentials without a prominent user-facing warning is unsafe because users may not expect this tool to inspect personal startup files. This creates a covert secret-access pattern that can collect credentials from locations unrelated to the task and undermines informed consent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script sends queried account identifiers and the API key to a remote third-party host, but gives no execution-time disclosure that data will leave the machine. Although remote API usage is expected for this kind of analyzer, the lack of explicit notice and consent increases privacy and secret-handling risk, especially when combined with automatic credential discovery.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Encouraging the agent to proactively configure and handle an API key in persistent environment settings creates a direct risk around credential secrecy and safe handling. Secrets may be disclosed through conversation, command history, shell startup files, or misconfiguration, and the behavior exceeds what should be done automatically by an analysis skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.