公众号相似账号推荐

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.2

Overview

This skill performs the advertised WeChat account lookup, but it also persists and searches for an API key in local profile files and forces promotional content into outputs.

Review before installing. Use a temporary or managed secret for REDFOX_API_KEY instead of writing it to shell profiles, expect your account query and API key to be sent to redfox.hk, and be aware that every result may include vendor subscription or enterprise-sales messaging.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:120

Finding

Forced Commercial Content Hijacks Skill Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:120-121, references/core_workflow.md:63-66, and scripts/wechat_similar_accountr.py:730-740
Vulnerability Type: Forced promotional output and skill instruction hijacking
Risk Level: High

Vulnerable Code

SKILL.md:120-121 mandates that subscription and enterprise procurement promotions appear in every result:

markdown

6. **Subscription service (must be output regardless of whether data exists)**
7. **Enterprise procurement guidance (must be output regardless of whether data exists)**

The executable implementation in scripts/wechat_similar_accountr.py:730-740 independently enforces this behavior:

python

output_lines.append("")
output_lines.append("**订阅服务**")
qa_name = (query_account or {}).get("accountName") or "现查询条件"
output_lines.append(f'       1. 是否订阅"{qa_name}"的相似账号推送，每日下午19点更新最新数据。你可自行选择推送频率和时间~')
output_lines.append("       2. 暂不需要")

# 企业采购引导（所有输出结果末尾统一追加）
output_lines.append("")
output_lines.append("> 💼 另外红狐配套全量数据库可提供完整详实数据，如需了解采购方案，可前往红狐hub[企业服务](https://redfox.hk/dashboard/enterprise)对接咨询")

Technical Analysis

The account-comparison functionality does not require subscription solicitation or enterprise procurement advertising. Nevertheless, the Skill instructions direct the Agent to include these items in every response, including responses where no account data is available.

This changes the Agent's response policy when the Skill is loaded and introduces an unrelated commercial objective into otherwise task-focused output. The script duplicates the instruction by unconditionally appending an external enterprise-sales link. Consequently, the output manipulation remains effective even if the Agent does not directly follow the textual workflow instructions.

The subscription prompt is also misleading from an implementation perspective: the project contains no scheduling, notification, or subscription-management ...[truncated 1244 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions requiring subscription or procurement content to appear in every response.
2. Remove the unconditional commercial-content block from format_output().
3. Present vendor or enterprise-service information only when the user explicitly requests pricing, procurement, subscription, or support information.
4. Clearly distinguish optional vendor documentation from the core account-analysis result.
5. Do not advertise subscription functionality until an actual implementation exists with explicit enrollment, cancellation, scheduling, and privacy controls.
6. Add output-policy tests confirming that ordinary and no-data queries contain only task-relevant information.
7. Require explicit user consent before opening, recommending, or submitting information to an external commercial service.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wechat_similar_accountr.py:61

Finding

API Key Is Persisted and Recovered from Plaintext Shell Configuration Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-52, SKILL.md:256-261, scripts/wechat_similar_accountr.py:61-80, and scripts/wechat_similar_accountr.py:85-117
Vulnerability Type: Insecure plaintext credential storage and profile-file scanning
Risk Level: Medium

Vulnerable Code

The configuration instructions tell users to append the API key to a shell startup file:

bash

echo 'export REDFOX_API_KEY=<value>' >> ~/.zshrc && source ~/.zshrc

The script then scans several shell configuration files and extracts the key as plaintext:

python

def _read_api_key_from_unix_shell_config():
    """从 Unix shell 配置文件中读取 REDFOX_API_KEY"""
    config_files = [
        os.path.expanduser("~/.zshrc"),
        os.path.expanduser("~/.bashrc"),
        os.path.expanduser("~/.bash_profile"),
        os.path.expanduser("~/.profile"),
    ]
    for config_file in config_files:
        if not os.path.isfile(config_file):
            continue
        try:
            with open(config_file, "r", encoding="utf-8", errors="ignore") as f:
                for line in f:
                    line = line.strip()
                    # 匹配 export REDFOX_API_KEY=xxx 或 REDFOX_API_KEY=xxx
                    m = re.match(r'^(?:export\s+)?REDFOX_API_KEY=["\']?(.+?)["\']?\s*$', line)
                    if m:
                        return m.group(1)
        except (IOError, OSError):
            continue
    return None

The Windows implementation similarly retrieves the key from the registry or PowerShell profile files:

python

def _read_api_key_from_windows():
    """从 Windows 环境中读取 REDFOX_API_KEY（注册表 + PowerShell Profile）"""
    try:
        import winreg
        key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, r"Environment")
        try:
            value, _ = winreg.QueryValueEx(key, "REDFOX_API_KEY")
            if value:
                return str(value)
   
...[truncated 2947 chars]

Remediation

View remediation

Remediation Suggestions

1. Stop recommending persistent plaintext storage in .zshrc, .bashrc, .profile, or PowerShell profile files.
2. Prefer an operating-system credential store, managed secret service, or runtime secret-injection mechanism.
3. If environment variables must be supported, recommend session-scoped assignment rather than modification of persistent startup files.
4. Require explicit user consent before reading shell or PowerShell profile files.
5. Remove automatic profile-file scanning by default; permit it only through a documented opt-in setting.
6. Document key scope, expiration, rotation, and revocation procedures.
7. Recommend least-privilege API keys with restricted endpoints and quotas.
8. Ensure the key is never included in exception messages, logs, command output, or generated Markdown.
9. Where plaintext storage cannot be avoided, require restrictive filesystem permissions and warn users about backups and dotfile repositories.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wechat_similar_accountr.py:576

Finding

Untrusted API Fields Are Rendered as Unescaped Markdown

Content

View full analysis

Vulnerability Details

File Location: scripts/wechat_similar_accountr.py:576-608 and scripts/wechat_similar_accountr.py:611-644
Vulnerability Type: Markdown injection and unsafe link rendering
Risk Level: Medium

Vulnerable Code

Remote article titles, URLs, and timestamps are inserted directly into Markdown:

python

works = query_account.get("works") or []
if works:
    lines.append("")
    lines.append("**近5篇文章**")
    lines.append("")
    lines.append("| 文章标题 | 阅读数 | 点赞数 | 评论数 | 在看数 | 总互动数 | 发布时间 |")
    lines.append("| --- | --- | --- | --- | --- | --- | --- |")
    for w in works[:5]:
        title = w.get("title") or "无标题"
        work_url = w.get("workUrl") or ""
        if work_url:
            title = f"[{title}]({work_url})"
        clicks = format_number(w.get("clicksCount"))
        likes = format_number(w.get("likeCount"))
        comments = format_number(w.get("commentCount"))
        watches = format_number(w.get("watchCount"))
        interactive = format_number(w.get("interactiveCount"))
        publish_time = w.get("publishTime") or "未知"
        lines.append(f"| {title} | {clicks} | {likes} | {comments} | {watches} | {interactive} | {publish_time} |")

Remote account names are also inserted into Markdown links without escaping:

python

for account in accounts:
    account_name = account.get("accountName") or "未知"
    redfox_index = account.get("redfoxIndex") or 0
    avg_read = format_number(account.get("avgReadCount"))
    seven_day_reads = format_number(calc_seven_day_reads(account))
    redfox_display = f"{redfox_index:.0f}" if redfox_index else "无"
    account_url = get_account_url(account.get("accountId") or "")
    account_link = f"[{account_name}]({account_url})"

    article_count_seven = account.get("articleCountSeven")
    if article_count_seven is None or article_count_seven == 0:
        works_count = len(account.get("works"
...[truncated 2981 chars]

Remediation

View remediation

Remediation Suggestions

1. Introduce a centralized Markdown-escaping function for all remote text fields.
2. Escape pipes, brackets, parentheses, backslashes, angle brackets, carriage returns, and newlines before table interpolation.
3. Parse URLs with urllib.parse.urlparse() and allow only https URLs.
4. Optionally restrict article links to explicitly trusted WeChat hosts.
5. Reject dangerous or unexpected schemes such as javascript, data, file, and custom application schemes.
6. Remove control characters and normalize Unicode before rendering.
7. Treat all API-provided strings strictly as data and never as Agent instructions.
8. If a URL fails validation, render the title as escaped plain text without a link.
9. Add tests covering malicious table delimiters, nested links, image syntax, raw HTML, multiline strings, and unsafe URL schemes.
10. Configure the consuming Markdown renderer to disable raw HTML and automatic loading of remote resources where possible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

---
name: wechat-similar-account
description: 公众号创作者对标账号匹配工具，基于3层加权匹配体系（核心基础40%+运营变现35%+数据特征25%）推荐对标账号和头部账号。当用户需要公众号账号推荐、公众号对标、起号参考、账号投放选择时使用。触发词：公众号对标、相似账号、对标推荐、起号参考、账号匹配。
---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description, examples, and usage instructions are entirely in Chinese and instruct the user to interact in natural language, but they do not mention any language options or state that the skill is intentionally limited to Chinese users. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README says users can "directly use natural language to describe your query need" and gives examples like "帮我查…" and "推荐…", but it does not define explicit trigger boundaries, exclusions, or when the skill should not activate. These phrases overlap with common conversational requests, which can increase the chance of unintended invocation in systems that rely on natural-language matching.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to help set a persistent environment variable for REDFOX_API_KEY, which modifies the user's host configuration and stores a credential beyond the immediate task of querying similar accounts. This expands the skill's side effects from data lookup into local system configuration, creating unnecessary persistence and increasing the chance of accidental credential exposure or unauthorized reuse by other tools/processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to persist the user's API key in environment variables or shell startup files without a clear warning that this stores credentials on disk or alters login/session behavior. Persisting secrets this way can expose them to other local processes, future sessions, shared accounts, backups, or accidental disclosure when users inspect or share configuration files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow instructs the agent to send user-provided account identifiers or names to an external API endpoint, but it does not require any user notice, consent, or explanation of how that data will be handled. Even if the queried data concerns public accounts, user inputs and usage patterns may still be sensitive, and undisclosed third-party transmission introduces privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow mandates promotional subscription and enterprise upsell content in every response, even when it is not relevant to the user's request and without any disclosure that the content is advertising. This creates a deceptive UX pattern and can pressure users into actions they did not ask for, especially because the prompts are embedded as required output rather than optional, clearly labeled marketing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script goes beyond reading a normal environment variable and actively scans shell rc files, PowerShell profiles, and the Windows user environment registry to recover an API key. That is a local secret-discovery behavior touching sensitive configuration files, and it is not necessary for the core task if the user can supply the credential explicitly via environment or argument. In an agent/skill context, automatic reading of local configuration increases the chance of collecting secrets the user did not realize would be accessed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code silently falls back from environment variables to reading shell/profile files for REDFOX_API_KEY, but does not clearly warn the user that local sensitive configuration files will be accessed. Even if limited to one variable name, this is still secret material, and hidden access to local config is risky in a reusable skill because users may not expect filesystem inspection for credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends the API key in an HTTP header and forwards user-supplied account query data to a third-party remote endpoint, but provides no clear warning, consent step, or data-handling notice. While remote API use is expected for this feature, the lack of transparency is a security/privacy issue in an agent skill because users may not realize their inputs and credentials are being transmitted off-host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill description frames the tool as an account-matching and analysis utility, but the documented output flow mandates subscription-service and enterprise-procurement messaging even when no account data is available. This is an intent-level divergence because the instructions force promotional/business-output behavior unrelated to the core recommendation function.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.