Security audit
Security checks for vulnerabilities and agentic risk
This search skill needs review because it automatically installs payment software when needed and handles retrieved content in ways that can execute commands or browser code.
Wait for the shell and report-export handling to be fixed before using exports. Require approval before payment-software installation or recharge setup, verify the recipient and amount, and use a reviewed, pinned installer. Search terms are sent to RedFox, so avoid confidential queries.
SKILL.mdReport-export instructions interpolate external JSON into shell syntax
Arbitrary local command execution during the documented export workflow. This is a vulnerable operational instruction, not a shell-execution function in either Python script.
scripts/generate_report.pyExternal post data can terminate the report's inline script
Attacker-controlled JavaScript executes when the generated report is opened. It can alter the report, read its embedded dataset, and attempt outbound requests, subject to browser policy. Arbitrary local-file access is not established.
scripts/generate_report.pyCSV export preserves attacker-controlled spreadsheet formulas
In compatible spreadsheet configurations that permit external functions, opening the export can initiate attacker-directed requests and transmit referenced report-cell values. Formula-generated links or values can also misrepresent the exported content.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}
try:
resp = requests.post(API_URL, json=payload, headers=headers, timeout=15, verify=True)
resp.raise_for_status()
result = resp.json()
except requests.exceptions.HTTPError as e:
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: xiaohongshu-crawler
description: 小红书作品爬取工具。根据关键词爬取小红书热门作品数据，支持按日期范围、排序方式筛选，结果以结构化表格展示。当用户需要爬取小红书作品、查询小红书热门内容、搜索小红书爆款笔记时使用。触发词：小红书爬取、小红书作品、小红书爆款、小红书搜索、小红书热门、小红书笔记查询。当接口返回积分不足（code=3210）时，自动唤起支付宝完成充值后继续查询。
---
# 小红书作品爬取
## 📝 简介
根据关键词爬取小红书热门作品，支
The shown instructions escalate a search request into payment submission based on an external insufficient-credit response, without an explicit spending-authorization gate. The payment amount, cashier URL, and order information originate in that response, so this crosses a financial authority boundary and could cause unauthorized charges; the referenced payment guide is not supplied, so additional safeguards cannot be verified.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow forwards user-derived keywords and search parameters to an external API without explicitly explaining that disclosure. Although API-key setup makes use of a third-party service somewhat apparent, users may still submit sensitive keywords without understanding who receives them or how they are retained.
When the CLI is missing, the workflow instructs the agent to execute a downloaded npm package and install software without first explaining the local changes or obtaining explicit approval. The user's request to retrieve content does not necessarily authorize software installation, and this payment-triggered fallback expands the task into local code execution with the agent's permissions.
The installation command uses @latest rather than an immutable, reviewed version, allowing npm to download and execute code that can change without changes to the skill. Although the text does not establish that this package is an MCP server, the underlying supply-chain risk is real: a compromised release could execute with the agent's local permissions, with heightened sensitivity in a payment-related workflow.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
try:
resp = requests.post(API_URL, json=payload, headers=headers, timeout=15, verify=True)
resp.raise_for_status()
result = resp.json()
except requests.exceptions.HTTPError as e:
No suspicious patterns detected.