Security audit

公众号爆款文章查询(红狐数据)

Security checks across malware telemetry and agentic risk

Overview

This is mostly a disclosed Redfox-backed WeChat article search skill, but it includes an apparent plaintext API key in documentation and persistent calendar subscription behavior that warrants review.

Install only if you are comfortable sending search keywords to Redfox and using a REDFOX_API_KEY you can revoke. Do not rely on or reuse the key shown in the reference documentation; the publisher should remove and rotate it. Review any calendar subscription before accepting it and confirm you know how to cancel scheduled pushes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no permissions, yet its documented behavior clearly uses environment variables, outbound network access to Redfox, and local file writes for HTML reports. This creates a transparency and consent gap: users or host platforms may invoke the skill without understanding that secrets will be read, data will be sent to a third party, and files may be created on disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The high-level description presents a simple WeChat article search tool, but the documentation reveals materially broader behavior: contacting a third-party service, consuming an API key, performing whole-site and multi-keyword searches, auto-expanding query scope, and writing HTML files locally. That mismatch can mislead users and policy engines, causing unintended external disclosure, broader-than-expected data retrieval, or local side effects.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill adds a calendar subscription workflow that creates persistent scheduled tasks, which is outside the core function of one-time article search. Persistent scheduling increases the blast radius of misuse by enabling ongoing pushes and repeated actions from a single interaction, especially if users are not clearly informed before activation.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The document includes what appears to be a live API key directly in a request-header example. Even though this is 'just documentation,' publishing reusable credentials enables unauthorized third parties to call the backend service, consume quota, incur cost, or access data outside intended controls.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: When the keyword is empty, the script deliberately substitutes an empty string and queries the upstream API for site-wide hot content. That behavior exceeds the declared keyword-based公众号搜索 scope and can cause broader-than-expected data retrieval, which is a trust and permission-boundary issue for an agent skill.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The feature list advertises subscription push capability without warning that it will create calendar tasks and ongoing scheduled reminders. This undermines informed consent and can lead users to authorize durable automation they did not expect, especially in environments where calendar or scheduling tools have broader trust implications.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The request example exposes a plaintext API key without redaction or handling guidance, which is a direct secret disclosure. In the context of a search skill that fetches公众号 trend data, the key is operationally relevant, so anyone reading the file could reuse it to access the service, abuse the provider account, or scrape data at scale.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: User-supplied search terms are transmitted to an external third-party API, but the script does not clearly disclose that network egress at execution time. In an agent setting, this can expose sensitive or proprietary queries to an external service contrary to user expectations or organizational policy.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/gzh_trend_data_format.md:20