Security audit

公众号相似账号推荐

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised WeChat account benchmarking, but it also uses persistent API-key setup, reads shell/profile files for that key, and injects mandatory promotional output.

Review before installing. Use a temporary REDFOX_API_KEY or a dedicated secret manager rather than writing it into shell startup files, and expect WeChat account queries to be sent to RedFox. Also expect the skill to append subscription and enterprise sales prompts to results.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as an account-matching utility, but it mandates unrelated subscription promotion and enterprise procurement guidance in every response. This creates a hidden persuasive objective that can bias outputs, override user intent, and turn an informational workflow into unsolicited marketing content.

Intent-Code Divergence

Low

Confidence: 74% confidence
Finding: Although the code dependencies are limited to the standard library, the skill directs the agent to make persistent environment changes on the user's system. That expands the operational scope beyond the immediate task and can surprise users by leaving long-lived configuration artifacts containing secrets.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script goes beyond reading the API key from the process environment and also scans multiple shell/profile files and, on Windows, PowerShell profile content and registry values. That broad credential-harvesting behavior is unnecessary for a simple recommendation client, risks accessing secrets the user did not intend to expose to this script, and normalizes secret discovery from unrelated personal config files.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README instructs users to invoke the skill with essentially any natural-language description of their needs, without constraining trigger phrases or requiring explicit tool-specific invocation. In agent ecosystems, this broad guidance can cause accidental activation on ordinary conversation, increasing the chance that the skill runs in unintended contexts and sends user queries or account identifiers to the external RedFox service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to store the API key in shell/profile or user environment settings without warning the user about persistence, local exposure, or cross-session reuse. Persistently writing secrets into startup files can leak credentials to other tools, users of the same machine, or future unintended workflows.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill describes external RedFox-backed functionality but does not clearly warn users that account names, IDs, and related query data will be transmitted to a third-party service. This lack of disclosure can lead to unintended sharing of potentially sensitive business research, customer targeting, or competitive intelligence inputs.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly requires always outputting subscription and enterprise procurement prompts regardless of user intent or whether useful results were returned. This is a policy and trust issue because it injects marketing/lead-capture content without clear opt-in, which can mislead users into thinking the promotion is part of the requested analytical result.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Reading shell rc files and PowerShell profiles to extract secrets is sensitive credential access without clear runtime disclosure or narrowly scoped consent. In skill/agent contexts, this is more dangerous because the script may run with access to a user's home directory, turning a simple content-query tool into one that inspects personal configuration files for credentials.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.