微博搜索

• Outcome: Review
• Latest audit: Jul 13, 2026 · 8:13 AM UTC
• Version: 1.0.0

Overview

This is a real Weibo search skill, but its daily subscription feature creates persistent scheduled automation without enough scoping or cancellation controls.

Review this before installing if you plan to use subscriptions. The basic search script is narrow, but daily push may create a recurring task on your machine or platform account; confirm where it is stored, how to disable it, what timezone it uses, and protect or rotate the Redfox API key if needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill requires network access and reads an API key from environment/config, but it does not declare these capabilities or permissions explicitly. Hidden or undeclared capabilities reduce transparency and prevent proper consent and policy enforcement, especially for a skill that can access external services with stored credentials.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The README advertises automatic keyword expansion and daily subscription push features that are not reflected in the stated skill scope. This creates a security-relevant documentation mismatch: users and orchestrators may permit broader data handling, persistence, or scheduled execution than the reviewed skill actually declares, increasing the risk of hidden behavior or unreviewed backend actions.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: Presenting paging and scheduled push as core features when they are not described in the manifest is another scope discrepancy. Paging alone is usually low risk, but scheduled push implies persistence and autonomous future actions, which can bypass user expectations and platform review boundaries if not formally declared.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill is presented as a Weibo search tool, but its documented features include daily subscription push behavior, which changes it from a one-shot search utility into a persistence-capable automation tool. This scope expansion is risky because users may enable recurring actions without understanding that the skill can continue operating after the initial interaction.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: These instructions directly guide the agent to create scheduled tasks, including cron-based automation, which exceeds the declared purpose of searching Weibo posts. A skill that can establish recurring execution introduces persistence and a larger attack surface, especially if later modified to run different commands or abuse stored credentials.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Adding system-level scheduled task or crontab capability to a search skill is disproportionate to its stated function and creates persistence on the host. Persistence mechanisms are security-sensitive because they can be repurposed to run arbitrary code regularly, leak data over time, or survive beyond the user's immediate intent.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The README advertises creation of a scheduled daily push task at 09:00 AM, but does not clearly warn users that this sets up ongoing automated behavior and persistent notifications until canceled. In an agent setting, weak disclosure around recurring actions can cause unintended background activity, surprise data processing, or unwanted notification spam, especially if the user interprets 'confirm subscription' as a one-time action rather than durable automation.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The natural-language trigger guidance is overly broad and can overlap with ordinary conversation, making accidental invocation more likely. In a skill that calls an external search API, misfires can cause unintended outbound requests, unexpected data disclosure in prompts, and user confusion about why the tool activated.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Using vague commands like '下一页' and '确认订阅' without strong context binding allows the skill to interpret generic chat messages as tool actions. This is especially risky for subscription creation because it can trigger persistent or scheduled behavior from an ambiguous user utterance rather than a clearly scoped consent flow.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation tells users to place an API key in environment/config but gives no warning about the sensitivity of that credential, least-privilege handling, or risks of accidental exposure. Poor secret-handling guidance increases the chance of credential leakage through shell history, shared config files, logs, screenshots, or over-broad file permissions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The subscription flow does not adequately warn users that confirming subscription creates an automatic daily task that will continue to run and push results. Insufficient disclosure around recurring execution undermines informed consent and can lead to unexpected background activity, resource consumption, and continued use of stored credentials.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends the user-provided search keyword directly to a third-party Redfox API, which creates a real privacy exposure because potentially sensitive queries leave the local environment without any explicit warning, consent, or minimization. In a search skill, this data flow is functionally necessary, but it is still a legitimate privacy/security concern because users may not realize their input is being disclosed to an external service.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.