Security audit

视频号作品查询

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed WeChat Channels search tool with an optional user-confirmed daily subscription feature, not hidden or deceptive behavior.

Install this only if you are comfortable sending WeChat Channels search keywords to RedFox using your REDFOX_API_KEY. Treat daily subscriptions as persistent scheduled jobs: confirm them only for keywords you want queried every day, and remove them with qoder_cron when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a Python script that uses environment variables for authentication, writes output files, and performs outbound network requests, but it does not declare those capabilities or permissions. This creates a transparency and consent gap: an agent or user may treat it as a simple local search utility while it actually sends queries to a third-party API and can write data locally.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill is presented as a search/query tool but also advertises persistent daily subscription pushes, which expands it into unattended automation. That broader behavior can surprise users, create ongoing external requests, and retain task state beyond the original interaction without sufficiently prominent scoping or consent boundaries.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: These instructions direct the agent to use qoder_cron to create a recurring agentTurn job that will automatically execute daily and push results. Persistent scheduled execution is materially more sensitive than an on-demand search because it enables ongoing actions, repeated network access, and continued data processing after the initial request.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README explicitly states the skill can be used through natural-language descriptions with 'no fixed commands to memorize,' which broadens invocation beyond narrowly scoped trigger phrases. In an agent environment, this increases the chance of accidental or opportunistic activation from ordinary conversation, causing the tool to run when the user did not clearly intend to invoke it.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The example phrase uses broad conversational wording ('What funny videos are trending on WeChat Channels?'), which overlaps with ordinary user requests and can match casual discussion rather than deliberate tool use. This makes unintended activation more likely, particularly in multi-skill or assistant settings where routing depends on semantic similarity.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The README advertises daily scheduled subscription pushes and later mentions confirmation, but it does not clearly explain persistence, cancellation, retention period, or notification behavior. This can lead users to unknowingly enable ongoing monitoring/notifications, which creates consent and privacy concerns even if the feature is not overtly malicious.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The API section reveals that user search terms are sent to a third-party endpoint with an API key, but the skill description does not prominently warn users about that outbound transmission. This is a privacy and transparency issue because users may provide sensitive topics assuming a local lookup when their queries are actually disclosed externally.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Although the flow asks the user whether to subscribe, it does not clearly and prominently warn that confirming will create a persistent scheduled job with automatic daily execution. Users may not appreciate that the action has lasting effects, causes repeated outbound requests, and continues until manually removed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.