公众号内容工坊

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 8:59 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed RedFox-backed WeChat content assistant; its API key use, content checks, data queries, and local report files fit its stated purpose.

Install only if you are comfortable using RedFox as the backend for WeChat article data, account diagnostics, and sensitive-word checks. Use a revocable REDFOX_API_KEY, avoid submitting confidential drafts or private account data unless you intend RedFox to process them, and avoid sharing debug logs because one title-query debug path can print request headers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (110)

Tainted flow: 'headers' from os.getenv (line 96, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

last_error = None
    for attempt in range(max_retries + 1):
        try:
            response = requests.post(API_URL, headers=headers, json=payload, timeout=30)

            if response.status_code >= 500 and attempt < max_retries:
                import time

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.getenv (line 88, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"[DEBUG] Body: {json_body}", file=sys.stderr)

    try:
        response = requests.post(base_url, json=json_body, headers=headers, timeout=30)

        if debug:
            print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 109, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"Params: {json.dumps(params, ensure_ascii=False)}", file=sys.stderr)

    try:
        response = requests.post(base_url, headers=headers, json=params, timeout=60)

        if debug:
            print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 63, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"Headers: {headers}", file=sys.stderr)

            # 发送请求
            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 该代码块的主功能非常单一，核心是调用 sensitiveWordSearch 接口做公众号违禁词检测，并支持从 TXT/DOC/DOCX/HTML/网页中抽取文本后送检。虽然“违禁词检测”属于声明功能的一部分，但声明将该 skill 描述为一个多能力聚合技能，涵盖内容创作、标题、改写、封面、榜单、账号诊断等完整链路，而本代码没有体现这些其他核心能力。因此描述与实际代码行为存在明显不一致。另有轻微超出声明的行为：代码可抓取网页并提取正文、支持 extract-only 只提取不检测，但这属于围绕检测的辅助能力，不是主要问题；主要问题仍是声明范围远大于实际实现。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明描述的是一个综合型公众号创作与运营技能，覆盖从灵感发现、内容生产到诊断分析的完整链路。但提供的代码仅实现了对 redfox.hk 接口的 POST 查询，用于检索公众号热门文章数据，并格式化输出结果。它确实与声明中的“10w+ 爆文榜单/爆款数据查询”以及部分“封面”相关场景有一定关联，因为会返回文章及封面图 URL；但并没有实现内容创作、标题生成或评分、改写、违禁词检测、账号诊断等大部分核心功能。另一个细节是所谓“爆款封面设计”在代码里只是提取已有封面链接供分析，并非设计或生成封面。因此，代码的实际主用途明显比声明窄得多，属于描述与行为不符。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 代码的核心功能非常单一：读取 REDFOX_API_KEY，向 https://redfox.hk/story/api/gzh/search/hotArticleNew 发送请求，获取公众号热门文章列表，并输出标题、作者、阅读/点赞/评论等数据。这与描述中的‘10w+爆文榜单/查爆文’部分是吻合的，但并未看到任何用于文章生成、标题生成或评分、改写、违禁词检测、封面设计、账号诊断的实现，也没有改写记录上报逻辑。换言之，描述将一个爆文数据查询工具表述为覆盖公众号创作与运营全链路的聚合技能，属于明显夸大能力范围。资源访问方面，代码只访问红狐数据的爆款文章搜索接口，与‘爆文榜单’一致，但不足以支撑其余声明能力，因此应判定为描述与实际行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents a broad公众号内容创作与运营分析聚合技能 covering multiple creation, editing, compliance, design, and diagnosis functions. The provided code chunk, however, is narrowly focused on one subset: retrieving and displaying 10w+ hot article rankings. Its only analysis is a lightweight heuristic content summary based on keywords. There is no code for generating article正文, generating/scoring titles, rewriting copy, reporting rewrite history, checking forbidden words, designing covers, or diagnosing accounts. This is therefore a material description-behavior mismatch: the declared scope is much broader than what the code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 该描述将技能定位为“聚合技能”，覆盖公众号创作与运营全链路，但提供的代码块功能明显更窄：仅向 redfox.hk 的接口发起 GET 请求，按关键词查询爆款文章数据，并格式化输出榜单结果。从代码可见，核心能力是数据检索、去重、按阅读数排序和 Markdown 报表生成。虽然这与声明中的“查 10w+/爆文榜单”部分部分相关，但远不足以支撑其余创作、改写、检测、设计、诊断类能力。另有细节不一致：代码返回的是 oneWReadingRank 和 originalRank，且主函数 total_count 还错误引用了 tenWReadingRank，说明与“10w+榜单”表述并不完全对齐。代码末尾还额外输出采购联系邮箱，属于声明中未提及的行为。综上，描述显著夸大了实现范围，存在明显不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents a broad end-to-end公众号 content creation/operations skill with many analytical and generative functions. However, this code chunk has a much narrower purpose: formatting already-provided article records into an HTML page and enabling PDF export. Its primary behavior is display/rendering of 10w+ hot article rankings, which matches only one small part of the declared scope. While not every chunk must implement every advertised feature, this chunk’s actual behavior is materially narrower than the declared purpose and lacks most of the named capabilities. Therefore this is a description/behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 描述将该 skill 表述为一个功能非常完整的公众号创作与运营分析聚合工具，但提供的代码只是 rewrite.py 单一脚本，核心行为是读取本地 markdown 规则并打印 prompt，以及向 redfox.hk 接口发送 POST 请求记录改写次数。虽然描述中提到“文案改写（含改写记录自动上报）”，因此‘上报改写记录’这一点与描述部分一致，但代码没有实际进行改写生成，也没有实现其余绝大多数声明能力。除此之外，代码依赖环境变量中的 REDFOX_API_KEY 并访问外部接口，而声明权限为空，资源访问上也与声明不一致。因此该描述不能准确代表该代码片段的实际功能。

Ssd 3

High

• Confidence: 90% confidence
• Finding: The skill description says rewrite records are automatically reported, which implies user-submitted content is transmitted elsewhere as part of normal use. This is reinforced later by explicit workflow language that treats reporting as a background action and tells the agent not to mention it in the output, creating a natural-language data leakage risk rather than a benign logging notice.

Ae1

High

• Category: analysis-evasion

Content

| "10w+ 爆文"、"公众号爆文榜单"、"今日爆文"、"科技数码赛道爆文" | **M1 10w+ 爆文榜单** | `references/m1_category_mapping.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "10w+ 爆文"、"公众号爆文榜单"、"今日爆文"、"科技数码赛道爆文" | **M1 10w+ 爆文榜单** | `references/m1_category_mapping.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "改写成公众号风格"、"这篇文案帮我公众号化" | **M4 文案改写** | `assets/m4_platform_rules.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "改写成公众号风格"、"这篇文案帮我公众号化" | **M4 文案改写** | `assets/m4_platform_rules.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "有没有违禁词"、"检测敏感词"、"公众号合规"、"限流词" | **M5 违禁词检测** | `references/m5_prohibited_word_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "有没有违禁词"、"检测敏感词"、"公众号合规"、"限流词" | **M5 违禁词检测** | `references/m5_prohibited_word_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "设计公众号封面"、"做个推文封面"、"美妆/财经封面" | **M6 封面设计** | `references/m6_report_template.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "设计公众号封面"、"做个推文封面"、"美妆/财经封面" | **M6 封面设计** | `references/m6_report_template.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "诊断 XX 公众号"、"分析 XX 账号"、"对比诊断 A 和 B" | **M7 账号诊断** | `references/m7_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "诊断 XX 公众号"、"分析 XX 账号"、"对比诊断 A 和 B" | **M7 账号诊断** | `references/m7_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python scripts/fetch_hot_articles.py \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python scripts/fetch_hot_articles.py \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- 完整参数与 API 规范见 `references/m1_api_spec.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.