公众号原创文章推荐（红狐数据）

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:03 AM UTC
• Version: 1.0.3

Overview

The skill’s main purpose is coherent, but it handles an API key over deliberately unverified HTTPS and generates HTML that loads third-party JavaScript, so it needs Review before installation.

Install only if you trust the RedFox service and are comfortable providing a REDFOX_API_KEY. Before use, the TLS verification bypass should be removed, and generated HTML reports should avoid or clearly disclose third-party CDN JavaScript. Treat subscription behavior as not fully specified by the included code.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation instructs use of environment variables, network access, and local file writes/reads, but no explicit permission model or user-facing disclosure is declared. This creates a real security issue because the skill can access secrets and persist data locally while contacting an external API, reducing transparency and increasing the chance of overbroad execution in hosts that rely on declared permissions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared purpose is article recommendation and subscription, but the documented behavior also includes generating HTML, exporting to PDF, and writing article data to temporary JSON files. This mismatch is dangerous because users and platforms may authorize the skill under narrower assumptions, while the actual workflow expands data handling and local artifact creation beyond what the description promises.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The code explicitly disables TLS certificate validation and hostname checking before calling the remote API. This makes the HTTPS connection vulnerable to man-in-the-middle interception, allowing an attacker on the network path to steal the X-API-KEY, read or alter query data, and tamper with returned article content.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The generated HTML unconditionally loads html2pdf.js from a third-party CDN, which introduces external code execution in every rendered report. If the CDN resource is tampered with, replaced, or blocked, users opening the generated file may execute untrusted JavaScript or experience broken functionality; this exceeds the core need of offline HTML generation.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases include broad everyday terms such as '最近' and '最新', which can easily appear in unrelated conversation. Overly broad invocation criteria can cause unintended execution of networked actions and content retrieval without a sufficiently specific user request.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The startup prompt proactively offers to push content immediately on load, which encourages activation before a precise user intent is established. In a skill that performs external API calls and can initiate subscription-style behavior, this increases the risk of accidental data retrieval or unintended enrollment flows.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents a third-party API endpoint and API-key-based authentication, but it does not clearly warn users that requests are sent to an external commercial service. Lack of transparent disclosure is risky because users may assume the data flow is local to the assistant platform, undermining informed consent and complicating privacy/security review.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The category map uses overly broad trigger keywords such as “生活”, “知识”, and “娱乐”, which are likely to appear in normal user requests unrelated to the intended category. In this skill, that can cause systematic misclassification of user intent and retrieval of the wrong content set, making the skill easier to steer or manipulate through ambiguous phrasing.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The rule '用户输入包含泛化关键词' is underspecified and does not define boundaries, precedence in overlapping matches, or exclusions for generic words. In a content-routing skill like this, ambiguous matching logic can be exploited to force unintended category selection, reducing reliability and potentially causing policy or business-logic bypass in downstream article retrieval.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script transmits an API credential and request parameters over a connection that does not verify the server certificate. In a hostile network environment, an attacker could impersonate the API endpoint, capture the credential, and return malicious or falsified data to the user.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The HTML silently loads a third-party script from cdnjs without any user-facing disclosure, so opening the generated report causes a network request and trust in external JavaScript that users may not expect. In a content-generation skill, this increases supply-chain and privacy risk because the output is no longer self-contained and may expose user environment metadata or run modified code.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

def fetch_articles_api(url: str, params: dict, api_key: str, timeout: int = 30) -> dict:
    """
    使用原生 urllib.request 发 HTTPS POST 请求（verify=False）

    Args:
        url: API 地址

• Confidence: 99% confidence
• Finding: verify=False

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/fetch_articles.py:107