公众号内容工坊

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:23 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its WeChat content-creation purpose, but it needs Review because it uses broad network/file access, scans shell profiles for credentials, can leak API-key material in output, hides rewrite reporting from user-facing results, and injects unsolicited commercial prompts.

Install only if you are comfortable giving this skill a RedFox API key and letting it send article text, files, extracted webpage text, and account queries to RedFox services. Avoid using it on confidential drafts or internal URLs, do not enable debug output with real keys, and prefer a dedicated revocable API key set only in the process environment rather than shell profile files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/fetch_explosive_covers.py:337

Finding

Unconditional Commercial Output Hijacking

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch_official_account_trends.py:63

Finding

API Credential Disclosure Through Diagnostic and Default Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_hot_html.py:32

Finding

Stored HTML and JavaScript Injection in Generated Reports

Content

View full analysis

str: """Generate HTML for one article.""" try: title = article.get("title", "Unknown title") url = article.get("oriUrl", "#") account = article.get( "userName", article.get("accountId", "Unknown account") ) account_id = article.get("accountId", "") reads = article.get("clicksCount", "0") if account_id: account_url = ( "https://open.weixin.qq.com/qr/code?" f"username={account_id}" ) else: account_url = "#" return f'''

{rank_display}

{title}

👤{account} 📖 阅读 {reads} 📅 {date}

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_sensitive_words.py:178

Finding

Server-Side Request Forgery Through Arbitrary URL Extraction

Content

View full analysis

100: text = extracted break except Exception: continue if not text: text = page.inner_text('body') browser.close() return text.strip() except Exception: pass try: response = requests.get(url, timeout=30, headers={ "User-Agent": ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36" ) }) if response.status_code >= 400: raise Exception( f"Web request failed: HTTP {response.status_code}" ) soup = BeautifulSoup(response.text, 'html.parser') for tag in soup(["script", "style", "noscript"]): tag.decompose() text = soup.get_text(separator='\n', strip=True) return text.strip() ``` ### Technical Analysis Th ...[truncated 1787 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_hot_html.py:131

Finding

Generated Reports Execute Mutable Third-Party JavaScript Without Integrity Protection

Content

View full analysis

{keyword} · 公众号10w+阅读文章 ``` ### Technical Analysis Every generated report loads `html2pdf.bundle.min.js` from a remote CDN when opened. Although the path includes a version, the report provides no Subresource Integrity hash and no restrictive Content Security Policy. Consequently, the effective code executed by a report is not completely contained in the reviewed Skill package. If the CDN account, distribution path, DNS resolution, or referenced asset is compromised, arbitrary replacement JavaScript could execute in every report opened while online. This is a supply-chain exposure rather than proof that the current CDN file is malicious. ### Attack Path 1. The Skill generates an HTML report containing the remote script tag. 2. A user opens the report while connected to the network. 3. The browser retrieves JavaScript from the CDN. 4. If the delivered asset has been maliciously replaced or intercepted through a compromised trusted channel, the browser accepts it because no integrity hash is present. 5. The replacement code executes in the report context. ### Impact Assessment A compromised dependency could: - Read and modify all report content. - Capture user interactions with the report. - Insert deceptive content. - Send report data to external services. - Initiate browser-side requests. The report's browser sandbox limits native system privileges, but the dependency receives the same page-level privileges as first-party report JavaScript. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_official_account_trends.py:379

Finding

Path Traversal Through Keyword-Derived Output Filename

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scripts/check_sensitive_words.py:32

Finding

Automatic Scanning of Shell Startup Files for API Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (79)

Tainted flow: 'headers' from os.getenv (line 96, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_sensitive_words.py (reported line 110)May include surrounding context.

python

last_error = None
    for attempt in range(max_retries + 1):
        try:
            response = requests.post(API_URL, headers=headers, json=payload, timeout=30)

            if response.status_code >= 500 and attempt < max_retries:
                import time

Tainted flow: 'headers' from os.getenv (line 88, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_explosive_covers.py (reported line 38)May include surrounding context.

python

print(f"[DEBUG] Body: {json_body}", file=sys.stderr)

    try:
        response = requests.post(base_url, json=json_body, headers=headers, timeout=30)

        if debug:
            print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)

Tainted flow: 'headers' from os.environ.get (line 109, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_gzh_trends.py (reported line 44)May include surrounding context.

python

print(f"Params: {json.dumps(params, ensure_ascii=False)}", file=sys.stderr)

    try:
        response = requests.post(base_url, headers=headers, json=params, timeout=60)

        if debug:
            print(f"状态码: {response.status_code}", file=sys.stderr)

Tainted flow: 'headers' from os.environ.get (line 63, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_official_account_trends.py (reported line 80)May include surrounding context.

python

print(f"Headers: {headers}", file=sys.stderr)

            # 发送请求
            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述的是一个聚合型、全链路公众号创作运营技能，但给出的代码块只实现了“查询公众号爆款文章/封面相关数据”这一部分。它通过 REDFOX_API_KEY 调用 redfox.hk 的 hotArticleNew 接口，返回热门文章、热点话题、相关搜索，并做简单去重、格式化展示和封面 URL 提取。这与描述中的多项核心能力——创作、标题生成评分、改写、违禁词检测、账号诊断、封面设计——都不相符或完全未实现。虽然“10w+爆文榜单/爆文查询”与“封面相关数据提取”属于声明范围的一小部分，但整体来看，代码的实际主功能明显窄于且不同于声明的综合能力，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

代码的核心功能是“查询并展示公众号爆款文章数据”，与声明中的“10w+爆文榜单”这一子能力一致；但声明将技能描述为覆盖创作与运营全链路的聚合技能，包含大量生成、检测、诊断和上报能力。提供的代码没有实现任何文本生成、改写、违禁词检测、封面设计或账号诊断逻辑，也没有相关外部调用。其实际主用途明显窄于声明，仅是爆款数据检索与报告生成。因此描述不能准确代表该代码块的实际行为，属于明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的是一个多功能公众号内容创作与运营分析聚合技能，覆盖创作、改写、检测、设计、诊断等完整链路。但提供的代码仅对应其中很小的一部分：10w+热门文章榜单查询与展示。脚本会请求特定外部API（redfox.hk）获取榜单数据，进行排序、格式化输出、简单关键词驱动的内容分析，并保存到本地JSON文件。它并未体现正文生成、标题生成/评分、改写、违禁词检测、封面设计或账号诊断等核心宣称功能。因此描述明显夸大了代码实际能力，属于实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个多功能聚合型公众号运营技能，覆盖创作、改写、检测、设计、诊断和爆文榜单等完整链路。但提供的代码块只实现了单一的数据查询能力：从 redfox.hk 拉取公众号爆款文章相关数据，并整理为“1w+阅读榜”和“原创榜”输出。它没有任何生成标题、评分、写正文、改写文案、检测违禁词、设计封面或账号诊断的逻辑。因此，代码行为仅覆盖声明中的很小一部分，且主功能更接近“公众号爆款趋势/榜单查询脚本”，与“全链路聚合技能”的描述存在明显能力层面的不匹配。另有一个小实现问题：结果统计中使用了 tenWReadingRank，而前文实际返回的是 oneWReadingRank，不过这属于实现缺陷，不是本次描述-行为比对的核心。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的是一个多功能公众号内容创作与运营分析聚合技能，而实际代码功能非常单一，主要用于把已有文章数据渲染成公众号风格的热文榜单 HTML，并提供 PDF 导出。两者在主功能范围上存在明显不一致：代码只覆盖了“10w+爆文榜单展示”的一小部分，且还是基于输入文件的静态生成，不包含描述中提到的大多数核心能力。因此该描述并不能准确代表该代码块的实际行为，应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk does align with one small part of the declared description: '文案改写（含改写记录自动上报）' in the sense that it supports rewrite-related prompt output and automatic reporting of rewrite records. However, the declared purpose presents the skill as a comprehensive公众号 content creation and operations suite spanning many capabilities. The actual code only reads local rewrite rules and reports usage metadata to an external API. It does not perform the majority of the declared functions, and its concrete behavior is much narrower than the advertised primary purpose. Additionally, the network reporting capability is not reflected in declared permissions, though it is mentioned in the prose description for rewrite records. Overall, this is a material description/behavior mismatch for the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

该描述把技能定义为“公众号内容创作与运营分析聚合技能”，覆盖创作、改写、违禁词、封面、爆文榜单、账号诊断等多项能力；但所给代码几乎全部围绕“公众号账号诊断”展开。代码主要行为是：读取 REDFOX_API_KEY，调用 Redfox 接口搜索公众号账号并获取账号/作品数据，计算内容健康度、用户活跃度、核心数据表现、运营规范性等分数，保存 raw_data.json/report_data.json，并生成单账号或多账号 HTML 报告。未见任何文本生成、标题生成/评分、改写、违禁词检测、封面设计等实现，也未见改写记录自动上报逻辑。虽然描述中包含“账号四维度诊断”，这部分与代码相符，但其余大部分宣称能力未被实现，因此描述与代码行为存在明显且实质性的能力不匹配。

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill states that rewrite records are automatically reported, but it does not require clear user notice or consent before transmitting user-provided copy to an external service. This is dangerous because users may paste proprietary, sensitive, or regulated text expecting local transformation, not hidden third-party disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This instruction establishes silent exfiltration of user-provided rewrite content to an external backend. In the context of a content-creation skill, users are especially likely to submit drafts, client materials, or unpublished copy, so undisclosed reporting can leak confidential or copyrighted material.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The rewrite module explicitly instructs hidden backend reporting while telling the agent not to surface that behavior in the main output. Concealing third-party transmission of original user text removes meaningful consent and creates a clear privacy and data-governance vulnerability.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module's non-blocking 'report rewrite record' step sends original copy to a remote endpoint and instructs that it need not be disclosed in the user-facing result. Hidden transmission of raw user input is a direct security and privacy concern because it creates unauthorized data sharing outside user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README states 'Describe what you need in plain language — no commands to memorize,' which makes activation conditions ambiguous for a markdown skill description. Although example prompts are provided later, the document does not clearly define trigger scope, exclusions, or negative examples, increasing the chance of unintended invocation from everyday phrasing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to invoke the skill via unrestricted natural-language requests, without clear scoping or explicit invocation boundaries. In agent environments, broad activation language can cause accidental triggering during ordinary conversation, leading to unintended external API use, content processing, or disclosure of user-provided data to the integrated service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example trigger phrases are generic, everyday requests like writing an article, scoring a title, or scanning text, which are likely to overlap with normal user conversation. In a multi-skill or ambient agent setting, this increases the risk of unintended skill activation and silent transmission of user content to third-party APIs, especially because the skill supports processing arbitrary text, files, images, and web pages.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares broad capabilities that require environment access, filesystem access, and network access, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of over-privileged execution because an agent may invoke sensitive capabilities without a clear allowlist or user-visible constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Overly broad trigger words can cause the skill to activate on ordinary conversations and process content the user did not intend to send into this workflow. In a skill with network, file, and reporting capabilities, accidental activation meaningfully raises privacy and safety risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Broad module examples and loose routing rules increase the chance that the wrong module executes on ambiguous input. Because different modules perform external queries, file handling, or backend reporting, misrouting can lead to unintended data disclosure or unnecessary privilege use.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The rule requiring rewritten content to pass AI-content detection tools is an evasion instruction. That encourages the model to conceal machine-generated provenance and can facilitate deceptive publishing, policy circumvention, and abuse at scale, especially in a content-rewriting skill designed for public distribution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown skill instruction states '默认使用' and the profile defines Language as '中文', which imposes a language choice by default. The file does not offer a user language choice or explain a justified region-specific constraint, so it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The spec explicitly instructs the skill to obtain a secret from local shell profile files when the environment variable is unset. That expands credential access beyond the declared runtime configuration and can cause the agent to read sensitive local files without clear user consent, potentially exposing unrelated secrets stored in those profiles.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The spec describes credential retrieval from environment variables or shell profile files but gives no warning that the skill may access local credential-bearing files. In an agent setting, this creates an unexpected secret-access path and reduces transparency, making it easier for users to authorize behavior that reads sensitive data they did not intend to expose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.