微博搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:16 AM UTC
• Version: 1.0.0

Overview

The skill mostly performs the advertised Weibo search, but its daily subscription feature creates persistent scheduled tasks with weak controls and an unsafe cron template.

Install only if you are comfortable sending search keywords and metadata to Redfox using your REDFOX_API_KEY. Treat subscriptions carefully: confirm the exact scheduled task before creation, avoid the cron fallback with raw keywords, and make sure you have a clear way to list, disable, and delete any daily push task.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

• Location: SKILL.md:179

Finding

Recurring Scheduled Task Creates Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 179–192
Vulnerability Type: Scheduled-task persistence
Risk Level: Medium

Vulnerable Code

bash

# Linux/macOS crontab
0 10 * * * python3 ~/.agents/skills/weibo-search/scripts/search_weibo.py "<keyword>"

The surrounding instructions also direct the Agent to create a platform-provided scheduled task that runs the same search every day.

Technical Analysis

The Skill instructs the Agent to register either a platform scheduled task or a user crontab entry. This task survives the interaction that created it and executes the search script every day under the scheduler account.

Subscription is part of the declared functionality and requires the user to reply with a confirmation. Therefore, the behavior is disclosed rather than covert. Nevertheless, it is a persistence mechanism because execution continues across sessions until the task is removed.

The instructions do not provide:

• A task identifier that the user can inspect or revoke.
• A cancellation or uninstallation procedure.
• An expiration date or execution limit.
• Guidance for restricting the scheduled task's environment and credentials.
• A verification step showing the exact command before installation.

There is also a schedule discrepancy: the documentation claims execution at 09:00, while 0 10 * * * executes at 10:00 according to standard cron semantics.

Attack Path

1. A search is performed using the Skill.
2. The Skill prompts the user to subscribe to daily results.
3. The user replies with the subscription confirmation.
4. The Agent registers a platform task or installs the supplied crontab entry.
5. The task executes the Python script every day, independently of the original conversation.
6. Execution continues until the scheduled task is manually identified and removed.

Impact Assessment

The persistent task runs with the privileges of the ...[truncated 462 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a platform scheduler that requires explicit user confirmation and displays the complete task definition before creation.
2. Return a stable task ID and provide clear commands or interface instructions for listing, disabling, and deleting the subscription.
3. Add an optional expiration date or bounded execution count rather than creating an indefinite subscription by default.
4. Run the task with a minimal environment and a narrowly scoped, revocable API credential.
5. Avoid modifying the user's crontab automatically. If a cron configuration is offered, present it as a manual option with explicit security warnings.
6. Correct the schedule to 0 9 * * * if the intended local execution time is 09:00, and document the applicable time zone.
7. Record creation, execution, failure, and deletion events without logging the API key.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:187

Finding

Unescaped Keyword Interpolation in Generated Crontab Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 187–191
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash

# Linux/macOS crontab
0 10 * * * python3 ~/.agents/skills/weibo-search/scripts/search_weibo.py "<keyword>"

Technical Analysis

The documented fallback configuration inserts a user-derived keyword directly into a command interpreted by the shell. Wrapping the value in double quotes is insufficient because the instructions do not require escaping embedded quotes, command substitutions, backticks, backslashes, or other shell metacharacters.

For example, a keyword containing a closing quote can terminate the intended argument and introduce additional shell syntax. The injected syntax would then be saved in the crontab and executed by cron.

This vulnerability is in the Skill's command-generation instructions rather than in scripts/search_weibo.py. The Python script uses argparse and does not itself invoke a shell. Exploitation therefore depends on the Agent substituting the raw keyword into the documented cron template and installing the resulting entry.

Attack Path

1. An attacker supplies or persuades the user to search for a keyword containing quote-breaking shell syntax.
2. The keyword becomes the active subscription keyword.
3. The user confirms creation of the subscription.
4. In the absence of a platform scheduler, the Agent substitutes the raw keyword into the crontab template.
5. The resulting command contains attacker-controlled shell operators or command substitution.
6. Cron invokes the entry through a shell at the scheduled time.
7. The injected command executes with the privileges of the account that owns the crontab.

Impact Assessment

Successful exploitation can execute arbitrary shell commands as the scheduler account. Depending on that account's permissions, an attacker could read or modify user-accessible fil ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not interpolate user-controlled keywords into a shell command.
2. Store subscription parameters in a structured data file or scheduler metadata and pass only a generated subscription identifier to a fixed wrapper program.
3. Configure platform schedulers using argument arrays rather than shell command strings whenever supported.
4. If cron is unavoidable, use a fixed executable with no user-controlled shell fragments and retrieve the keyword from a protected structured configuration file.
5. Apply strict length and character validation to subscription keywords as defense in depth, but do not rely on validation as the primary command-injection control.
6. Require the Agent to display the exact generated task and obtain confirmation immediately before installation.
7. Add tests covering embedded quotes, semicolons, newlines, backticks, dollar-sign command substitution, backslashes, and cron-specific control characters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

复「确认订阅」时执行）

优先使用平台内置定时任务能力，若无则提供通用方案：

平台内置定时任务（优先）：

• 任务名称：微博搜索订阅 - <关键词>
• 执行频率：每天 09:00（cron：0 10 * * *）
• 执行内容：运行脚本并将结果按 Step 3~4 格式展示推送到当前对话

通用配置方案：

bash

# Linux/macOS crontab
0 10 * * * python3 ~/.agents/skills/weibo-search/scripts/search_weibo.py "<关键词>"

创建成功后告知用户："已成功订阅关键词「<关键词>」的微博博文推送，每天 09:00 将自动查询最新数据并通知你。"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README promotes daily subscription/push behavior but does not clearly warn at the point of feature description that this creates a recurring automated task. Users may unknowingly authorize ongoing monitoring or scheduled outbound actions, which is especially risky in an agent setting where persistent tasks can continue after the immediate interaction ends.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation guidance is broad enough that common conversational phrases like keyword mentions, follow-up filter changes, or pagination commands could activate the skill without a clear opt-in boundary. In an agent environment, this can cause unintended external queries or stateful actions such as re-running searches or progressing pages based on ambiguous user utterances.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of environment secrets (REDFOX_API_KEY) and network access to an external API, but the manifest declares no tool scope or permission boundaries. This creates an authorization gap: a reviewer or runtime may not understand that the skill needs secret access and outbound network use, increasing the risk of overbroad execution or accidental secret exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes an on-demand search tool, but the documentation expands behavior to include subscription creation and daily push delivery. This scope drift is dangerous because users and platform reviewers may consent to a simple search skill while the skill also establishes ongoing automated actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes creating ongoing daily push subscriptions without any privacy notice or warning about continued automated processing. This is risky because it normalizes persistent monitoring and repeated outbound queries tied to user interests without clearly disclosing retention, frequency, cancellation, or data-handling implications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation states '每天 09:00' but gives cron '0 10 * * *', which runs at 10:00, creating contradictory scheduled behavior. For an automation feature, inconsistent schedule semantics can cause unintended background execution, missed expectations, and difficulty auditing when recurring tasks will run.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language strings in the top-level documentation force a specific language/locale without indicating that the user can choose another language. Under the stated policy, language constraints should either be optional or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The markdown describes a daily automated push feature, which affects user data/notification behavior over time, but it does not include a clear user-facing warning about creating a recurring scheduled task beyond the feature description itself. Since SQP-2 for markdown covers omitted warnings about behaviors that could affect user data or system integrity, this recurring automation should be disclosed more explicitly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The README instructs users with English-only invocation examples such as "Next page" and "Confirm subscription," which may imply a required language for operation. Under SQP-3, language policy concerns arise when a skill appears to require a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes keyword-based Weibo search with category and authentication filtering. The documentation adds an '智能拓展' capability that generates 10 alternative keywords when no results are found, which is an additional semantic feature beyond the stated manifest scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script transmits the user-supplied keyword and related request metadata to a third-party service (redfox.hk), which creates a privacy and data-handling risk if users are unaware their query leaves the local environment. In this skill’s context, network transmission is functionally necessary for a search tool, so the issue is not code execution or injection, but insufficient transparency and consent around external data disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.