X (Twitter) 订阅账号推文

• Outcome: Pass
• Latest audit: Sep 24, 2026 · 7:59 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed X/Twitter account subscription reporter with expected API, local report, and daily automation behavior.

Install only if you are comfortable giving the skill a Redfox API key, letting it create daily 9:00 scheduled report tasks for selected public X accounts, and storing generated report files locally. Review or disable HTML auto-open/CDN export behavior if third-party script loading is a concern.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (18)

Tainted flow: 'req' from os.environ.get (line 92, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8")), None
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README promotes automatic daily collection and push reporting but does not prominently warn users that subscriptions create a persistent scheduled task that will continue monitoring accounts until removed. This is risky because users may not realize they are authorizing ongoing automated collection and reporting, which can lead to unintended surveillance behavior, surprise notifications, or persistent processing beyond the user's immediate request.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Allowing invocation through unconstrained natural-language requests makes the skill's activation boundary ambiguous and increases the chance of accidental subscription changes, monitoring, or report generation without sufficiently explicit user intent. In a skill that can create persistent daily automation and monitor up to 100 accounts, vague triggering is more dangerous because ordinary conversational text could be interpreted as authorization for ongoing actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to use shell commands, network access, environment secrets, and local file output, yet it declares no tool scope or permission boundaries. That creates an overprivileged integration where the agent may execute networked automation, write files, and access API keys without an explicit least-privilege contract or user-visible constraint.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list contains broad phrases like 'X订阅', 'Twitter订阅', and related generic wording that can plausibly appear in ordinary conversation. In a skill that performs persistent subscription and automation setup, ambiguous activation increases the chance of unintended execution and accidental enrollment into ongoing monitoring workflows.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description emphasizes convenience and automation but does not clearly warn users up front that it creates persistent daily monitoring tasks and performs scheduled data pulls. This can lead to consent and transparency failures, where users trigger long-lived tracking behavior without understanding that the action is not a one-time fetch.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The natural-language values and keyword mappings are predominantly Chinese, and the file does not indicate that users can choose another language or that the locale restriction is intentionally region-specific. This can constitute a language/locale policy issue when a skill forces a specific language without opt-in or documented justification.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This JSON manifest includes generic activation keywords such as "全部", "综合", "所有", and "不限" for the category entry. In a manifest/config context, these terms are common everyday language and are not scoped with exclusions or negative examples, which can make category triggering ambiguous and overly broad.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The generated HTML unconditionally loads third-party JavaScript from public CDNs when the report is opened, which causes external network access and executes remote code in the viewer's browser. That creates privacy leakage about report viewing and a supply-chain risk: if the CDN, dependency, or connection is compromised, arbitrary script can run in the context of the local report.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not args.no_open:
        try:
            if sys.platform == "darwin":
                subprocess.run(["open", out_path], check=False)
            elif sys.platform.startswith("win"):
                os.startfile(out_path)  # type: ignore[attr-defined]
            else:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif sys.platform.startswith("win"):
                os.startfile(out_path)  # type: ignore[attr-defined]
            else:
                subprocess.run(["xdg-open", out_path], check=False)
        except Exception:  # noqa: BLE001
            pass

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language instructions, help text, and runtime messages that assume Chinese as the only user language. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless clearly justified as region-specific.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if args.html:
        script = os.path.join(_SCRIPT_DIR, "generate_report.py")
        subprocess.run([sys.executable, script, "--data", out_path], check=False)

    if not args.markdown and not args.html:
        print_terminal_summary(result)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: README 全文以中文编写，并在示例话术与说明中默认用户使用中文，但没有提供语言/locale 选择，也没有声明该技能仅面向特定中文场景用户。按规则，强制特定语言而无用户选择可能构成自然语言层面的语言/区域策略问题。

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: 文档说明了“每天 9:00 自动拉取近 24 小时推文”，属于持续性的网络操作与自动化行为，但缺少面向用户的显式提醒，例如会定期访问外部服务、产生持续任务或需要用户自行取消。虽然功能描述中提到了自动执行，但未以警示或注意事项形式说明其持续运行特性及可能影响。

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The instructions require converting tweet timestamps to the “本地时区” for filtering and display, but there is no user opt-in or configurable timezone choice. This is a locale-related policy concern because the skill imposes a locale behavior rather than letting the user select or confirm the preferred timezone.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill generates local HTML/JSON report files and states that the browser will auto-open, but it does not present this as a clear privacy and safety warning before use. Users may not expect artifacts containing monitored account data to be written to disk and opened automatically, which can expose information to other local users or trigger unsafe rendering paths in the browser.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The generated report hard-codes `lang="zh-CN"` and all visible UI text such as the title, buttons, and notices in Chinese. This is a natural-language locale constraint with no user opt-in or configurable language selection, which can violate language/locale policy for general-purpose skills.

Static analysis

No suspicious patterns detected.