Back to skill

Security audit

公众号文案创作

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches its writing-assistant purpose, but it exposes a real-looking API key and sends user search topics to an external service, so it should be reviewed before installation.

Install only if you are comfortable sending article keywords and timing filters to redfox.hk. Do not provide private diary entries, confidential drafts, customer data, unreleased campaign plans, or regulated information as style samples. The publisher should remove and rotate the exposed API key and disclose or remove the promotional contact line before this is treated as clean.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding
The skill instructs use of environment variables for API keys and performs network-backed data retrieval, but no explicit permission declaration or user-facing boundary is present. This creates a transparency and governance gap: the agent may access secrets and external services without clear least-privilege controls or consent expectations.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior promises analysis and article generation, but the finding indicates the actual implementation may only list articles/basic metrics and may inject unrelated marketing or contact information. That mismatch is dangerous because it can mislead users about what data processing is occurring and can be abused for hidden promotion or data-driven social engineering outside the declared purpose.

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
The documentation contains a hardcoded third-party API key that appears live and usable. Even though this is a reference file, embedding credentials in skill content can enable unauthorized use of the vendor API, quota theft, billing abuse, and possible downstream data-access misuse if the key has broader permissions.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill says users can invoke it by simply describing their need in natural language, without strong trigger boundaries. That makes routing ambiguous and increases the chance the skill is activated for generic writing requests, causing unintended access to external data sources or unintended article generation in contexts where the user did not explicitly request this skill.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The example phrases are broad everyday requests like writing an article or blending a style, which can overlap with many unrelated general-assistant tasks. In an agent environment, this broad scoping can cause accidental invocation of the skill, leading to over-collection of user text samples, unnecessary third-party API usage, or unexpected generated content tied to this integration.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The README explicitly tells users to invoke the skill via unrestricted natural language, which makes activation boundaries loose and increases the chance of accidental or collision-based invocation by unrelated user requests. In an agent ecosystem, broad triggers can cause the skill to run in contexts where the user did not clearly intend to use this tool, potentially exposing user content to the external Redfox service or producing untrusted generated content.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The example phrases are highly generic requests like writing an article or analyzing popular content, which are likely to overlap with ordinary assistant conversations and other writing tools. This raises the risk of prompt-routing collisions and unintended execution, especially because the skill sends requests to an external API and may process user-provided style samples or business content without sufficiently explicit consent.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The trigger conditions are broad enough to match ordinary writing requests, which can cause the skill to activate outside its intended公众号 niche. Overbroad activation increases the chance of unnecessary external data access, irrelevant prompt steering, or accidental collection of user content when a simpler local response would suffice.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly asks users to upload personal writing samples but provides no privacy warning, minimization guidance, or instruction to exclude sensitive information. Because journals, notes, and drafts often contain personal or confidential details, this creates a direct pathway for oversharing and unnecessary exposure of sensitive user data.

Missing User Warnings

High
Confidence
98% confidence
Finding
A live-looking API key is exposed in plaintext without any warning or masking, which materially increases the chance that users, downstream tools, or logs will copy and misuse it. In this skill context, the key is especially risky because the skill is explicitly designed to query a third-party content API, making the credential directly actionable rather than incidental.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The script sends user-supplied keywords and date ranges to an external third-party service, but the code does not provide a clear in-band notice or consent step at the moment of transmission. This matters because user prompts may contain sensitive business topics, content plans, or private research terms that are then disclosed off-host.

Ssd 3

Medium
Confidence
92% confidence
Finding
Beyond merely requesting text, the skill instructs the model to analyze and incorporate personal writings into generated output, which operationalizes collection and reuse of user-provided content. In context, that makes accidental ingestion of sensitive details more likely and can propagate private traits, experiences, or identifiers into downstream content.

External Transmission

Medium
Category
Data Exfiltration
Content
print(f"Params: {json.dumps(params, ensure_ascii=False)}", file=sys.stderr)

    try:
        response = requests.post(base_url, headers=headers, json=params, timeout=60)

        if debug:
            print(f"状态码: {response.status_code}", file=sys.stderr)
Confidence
84% confidence
Finding
requests.post(base_url, headers=headers, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.