AI视频号信息源

• Outcome: Review
• Latest audit: Jul 23, 2026 · 9:20 AM UTC
• Version: 1.0.2

Overview

The skill mostly does what it advertises, but its subscription mode creates persistent scheduled tasks and can store the API key in a local scheduler file.

Review carefully before installing. Normal one-time report generation is coherent with the skill's purpose, but avoid using --subscribe unless you are comfortable with a daily LaunchAgent or crontab entry and possible local storage of REDFOX_API_KEY. Prefer running with --no-open, inspect generated HTML from trusted data only, and rotate the RedFox API key if it has already been stored in a plist or other scheduler file.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script_path = os.path.abspath(__file__)
        cron_line = f"0 16 * * * /usr/bin/python3 {script_path} --no-open"
        try:
            subprocess.run(
                f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
                shell=True, check=True, capture_output=True
            )

• Confidence: 93% confidence
• Finding: subprocess.run( f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -', shell=True, check=True, capture_output=True )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        script_path = os.path.abspath(__file__)
        try:
            subprocess.run(
                f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
                shell=True, check=True, capture_output=True
            )

• Confidence: 95% confidence
• Finding: subprocess.run( f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -', shell=True, check=True, capture_output=True )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of capabilities including environment-variable access, local file writes, network access, and shell execution, yet it does not declare permissions or present a clear permission model. This can cause users or host systems to invoke code with broader access than expected, reducing transparency and weakening security review for actions like writing reports locally, opening a browser, and installing scheduled tasks.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill installs and removes OS-level scheduled tasks, which is broader than the stated feed/report generation purpose and creates persistence on the host. In an agent-skill context, persistence is especially sensitive because users may not expect long-lived background execution from a content-reporting tool.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code reads an API key from the environment and persists it into a LaunchAgent plist on disk for future execution. Storing credentials in a scheduled-task definition materially increases exposure because local users, backups, logs, or misconfigured permissions may reveal the secret.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The invocation guidance is broad and based on ordinary natural-language phrases such as requesting AI reports, searches, or trend summaries. This can cause the skill to activate in situations the user may not explicitly intend, increasing the chance of unintended data access, external API use, or generation of reports when the user was making a general inquiry.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to invoke the skill with very broad natural-language phrases such as generic requests for 'AI热点' or '日报'. In agentic environments, overly broad invocation guidance can cause the skill to trigger on ordinary user queries that were not intended for this specific integration, leading to unintended external API use, data retrieval, and content generation without clear user consent.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The description uses broad invocation triggers such as when the user needs AI video-channel daily reports or hotspots, without clear boundaries on when the skill should activate. Overbroad routing can cause the skill to be invoked in unintended contexts, leading to unnecessary network calls, local file generation, or prompting users to configure API keys for a third-party service when they did not explicitly request this tool.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The markdown states that the skill generates local HTML files, opens them in a browser, and can install a daily scheduled task, but it does not prominently warn that these actions modify the local system or persist changes. In practice, scheduled-task installation and automatic file/browser actions can surprise users, create persistence, and increase risk if the underlying script behavior changes or is abused.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Subscription setup silently persists the API key to a LaunchAgent plist without warning the user that credentials will be written to disk. This is dangerous because it turns a transient secret into a stored secret, increasing the chance of credential theft and unauthorized API use.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

log_path = str(Path.home() / "Library" / "Logs" / "qoder-wechat-channels-ai-feed.log")

        env_section = ""
        api_key = os.environ.get(ENV_KEY, "").strip()
        if api_key:
            env_section = f"""
        <key>EnvironmentVariables</key>

• Confidence: 96% confidence
• Finding: os.environ.get(ENV_KEY

Unvalidated Output Injection

High

• Category: Output Handling

Content

else:
        script_path = os.path.abspath(__file__)
        try:
            subprocess.run(
                f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
                shell=True, check=True, capture_output=True
            )

• Confidence: 95% confidence
• Finding: subprocess.run( f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -', shell=True, check=True, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

# ── 打开浏览器 ──
    if not args.no_open:
        if sys.platform == "darwin":
            subprocess.run(["open", str(output_path)], check=False)
        elif sys.platform == "linux":
            subprocess.run(["xdg-open", str(output_path)], check=False)
        info(f"浏览器已打开: {output_path}")

• Confidence: 90% confidence
• Finding: subprocess.run(["open", str(output

Unvalidated Output Injection

High

• Category: Output Handling

Content

if sys.platform == "darwin":
            subprocess.run(["open", str(output_path)], check=False)
        elif sys.platform == "linux":
            subprocess.run(["xdg-open", str(output_path)], check=False)
        info(f"浏览器已打开: {output_path}")

    print(f"\n{GREEN}{BOLD}✓ 完成!{RESET}")

• Confidence: 90% confidence
• Finding: subprocess.run(["xdg-open", str(output

Session Persistence

Medium

• Category: Rogue Agent

Content

cron_line = f"0 16 * * * /usr/bin/python3 {script_path} --no-open"
        try:
            subprocess.run(
                f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
                shell=True, check=True, capture_output=True
            )
            info("订阅成功! 每天 16:00 自动生成视频号 AI 日报 (crontab)")

• Confidence: 94% confidence
• Finding: crontab -l

Session Persistence

Medium

• Category: Rogue Agent

Content

def install_subscription():
    """安装定时任务，每天自动生成日报"""
    if sys.platform == "darwin":
        PLIST_DIR.mkdir(parents=True, exist_ok=True)
        plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"

        script_path = os.path.abspath(__file__)

• Confidence: 93% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

"""安装定时任务，每天自动生成日报"""
    if sys.platform == "darwin":
        PLIST_DIR.mkdir(parents=True, exist_ok=True)
        plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"

        script_path = os.path.abspath(__file__)
        log_path = str(Path.home() / "Library" / "Logs" / "qoder-wechat-channels-ai-feed.log")

• Confidence: 93% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

"""安装定时任务，每天自动生成日报"""
    if sys.platform == "darwin":
        PLIST_DIR.mkdir(parents=True, exist_ok=True)
        plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"

        script_path = os.path.abspath(__file__)
        log_path = str(Path.home() / "Library" / "Logs" / "qoder-wechat-channels-ai-feed.log")

• Confidence: 93% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

"""安装定时任务，每天自动生成日报"""
    if sys.platform == "darwin":
        PLIST_DIR.mkdir(parents=True, exist_ok=True)
        plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"

        script_path = os.path.abspath(__file__)
        log_path = str(Path.home() / "Library" / "Logs" / "qoder-wechat-channels-ai-feed.log")

• Confidence: 93% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

"""安装定时任务，每天自动生成日报"""
    if sys.platform == "darwin":
        PLIST_DIR.mkdir(parents=True, exist_ok=True)
        plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"

        script_path = os.path.abspath(__file__)
        log_path = str(Path.home() / "Library" / "Logs" / "qoder-wechat-channels-ai-feed.log")

• Confidence: 93% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

<string>{api_key}</string>
        </dict>"""

        plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>

• Confidence: 96% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>"""

        plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

• Confidence: 91% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>"""

        plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

• Confidence: 91% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>{PLIST_LABEL}</string>

• Confidence: 90% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

<plist version="1.0">
<dict>
    <key>Label</key>
    <string>{PLIST_LABEL}</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/bin/python3</string>

• Confidence: 90% confidence
• Finding: PLIST

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.