ClawHub
Back to skill

Security audit

小红书爆款内容创作专家

Security checks for vulnerabilities and agentic risk

Overview

This Xiaohongshu content skill is mostly coherent, but needs review because its compliance checker can read arbitrary local files or fetch arbitrary URLs and may send extracted content to RedFox.

Install only if you are comfortable with RedFox API use and review the M5 checker carefully. Do not point it at arbitrary local paths or internal/private URLs, do not submit confidential drafts, and prefer setting REDFOX_API_KEY explicitly in the runtime environment rather than relying on shell-profile scanning.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check_sensitive_words.py:177
Finding

Server-Side Request Forgery Through Unrestricted Webpage Extraction

Content
View full analysis
100: text = extracted break except Exception: continue if not text: text = page.inner_text('body') browser.close() return text.strip() except Exception: pass response = _http_request(url, method="GET", timeout=30) if response["status_code"] >= 400: raise Exception(f"Webpage request failed: HTTP {response['status_code']}") soup = BeautifulSoup(response["body"], 'html.parser') ``` ### Technical Analysis The `--url` input is accepted as an arbitrary HTTP or ...[truncated 2413 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/check_sensitive_words.py:145
Finding

Arbitrary Local File Disclosure Through Unrestricted --file Input

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:360
Finding

Sensitive User Content Is Exposed Through Process Command-Line Arguments

Content
View full analysis
" python scripts/check_sensitive_words.py --file "" [--extract-only] python scripts/check_sensitive_words.py --url "" [--extract-only] ``` The script defines the content as a command-line argument: ```python group = parser.add_mutually_exclusive_group(required=True) group.add_argument("--content", help="Pass copy text directly") group.add_argument("--file", help="File path") group.add_argument("--url", help="Webpage address") ``` The rewrite workflow also passes original user material as an argument: ```bash python scripts/rewrite_record.py "" ``` Although `rewrite_record.py` does not include the content in its HTTP payload, the original text remains present in the process argument vector. ### Technical Analysis Command-line arguments are not a suitable channel for potentially sensitive documents or marketing material. Depending on the operating system and runtime environment, process arguments may be visible through: - Process listing and monitoring tools - `/proc//cmdline` on Linux - Container or orchestration telemetry - Endpoint monitoring and audit systems - Shell history when commands are entered interactively - Parent-process and job-execution logs - Error reporting or command tracing The sensitive-word workflow may process up to 3,000 characters per invocation and supports repeated chunks. Therefore, substantial portions of user documents can be exposed outside the intended API transport. The rewrite command unnecessarily places the full original text in the argument list even though `report_rewrite()` ignores its `content` parameter and sends only a static source identifier. ### Attack Path 1. A user supplies confidential or ...[truncated 868 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/prohibited_word_core_workflow.md:69
Finding

Generated User Documents Are Persisted Without Defined Permission or Cleanup Controls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/check_sensitive_words.py:33
Finding

API Credentials Are Recovered by Scanning Shell Startup Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (47)

Tainted flow: 'headers' from os.getenv (line 91, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_explosive_covers.py (reported line 105)May include surrounding context.

python
print(f"URL: {url}", file=sys.stderr)
                print(f"Params: {params}", file=sys.stderr)

            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_xhs_hot_articles.py (reported line 94)May include surrounding context.

python
body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
            req = urllib.request.Request(url, data=body, headers=headers, method="POST")
            with urllib.request.urlopen(req, timeout=30) as resp:
                status_code = resp.status
                resp_bytes = resp.read()
            resp_text = resp_bytes.decode("utf-8")

Tainted flow: 'headers' from os.getenv (line 116, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_xhs_trends.py (reported line 127)May include surrounding context.

python
if debug:
                print(f"\n=== DEBUG: 第 {attempt + 1} 次尝试 ===", file=sys.stderr)

            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This mismatch finding is materially different because it identifies undeclared remote telemetry/logging to a third-party endpoint. Undisclosed external transmission of user-provided copy is a genuine privacy and security issue, especially in a content-rewriting skill where users may submit proprietary drafts, marketing plans, or personal text.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This mismatch finding is materially different because it identifies undeclared remote telemetry/logging to a third-party endpoint. Undisclosed external transmission of user-provided copy is a genuine privacy and security issue, especially in a content-rewriting skill where users may submit proprietary drafts, marketing plans, or personal text.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This mismatch finding is materially different because it identifies undeclared remote telemetry/logging to a third-party endpoint. Undisclosed external transmission of user-provided copy is a genuine privacy and security issue, especially in a content-rewriting skill where users may submit proprietary drafts, marketing plans, or personal text.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch finding is materially different because it identifies undeclared remote telemetry/logging to a third-party endpoint. Undisclosed external transmission of user-provided copy is a genuine privacy and security issue, especially in a content-rewriting skill where users may submit proprietary drafts, marketing plans, or personal text.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This mismatch finding is materially different because it identifies undeclared remote telemetry/logging to a third-party endpoint. Undisclosed external transmission of user-provided copy is a genuine privacy and security issue, especially in a content-rewriting skill where users may submit proprietary drafts, marketing plans, or personal text.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: xiaohongshu-creator
description: 小红书爆款内容创作专家。一个 Skill 覆盖笔记生成、文案改写、爆款标题生成与评分、封面设计、违禁词检测五大能力，基于红狐数据每日更新的爆款笔记库，把灵感打磨成可直接发布的成品。当用户需要写小红书笔记、改写文案为小红书风格、起标题或评估标题、设计封面、检测违禁词时使用。触发词：小红书笔记、小红书改写、小红书标题、小红书封面、小红书违禁词、小红书创作、小红书爆款。
dependency:
  python:
    - requests>=2.28.0
    -

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The rewrite module directs the agent to report the user's original copy to a remote endpoint as a non-blocking side effect. Because rewriting does not require sending the original text to a telemetry API, this creates unnecessary exfiltration risk for sensitive, proprietary, or personal content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script reads multiple shell startup files to locate an API key, which accesses sensitive local configuration unrelated to the minimum needed for content checking. In this skill context, that is more dangerous because a content-creation utility is not expected to inspect shell dotfiles, and those files may contain additional secrets or private configuration beyond the intended key.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README says users can 'Describe what you need in natural language — no commands to memorize,' which does not define clear trigger boundaries or specific activation phrases. This broad phrasing overlaps with ordinary conversation and could cause unintended invocation because it gives no explicit scope, constraints, or exclusion examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README says users can 'directly use natural language to describe your creative needs' without clearly constraining activation to the listed Xiaohongshu-specific tasks. Broad trigger language can cause the skill to be invoked outside its intended scope, increasing the chance it processes unrelated or sensitive user requests under the wrong workflow. In this context the risk is limited because the skill is content-creation oriented, but ambiguous activation still weakens boundary control.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares broad operational behavior including shell commands, network access, environment-variable use, and file access, but it does not declare any explicit tool scope or allowed-tools policy. That makes the effective privilege boundary unclear and increases the chance an agent will over-grant capabilities or execute risky actions without informed user consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to scan shell profile files such as ~/.zshrc and ~/.bashrc to locate API credentials. Those files can contain unrelated secrets, tokens, aliases, and private configuration, so reading them for a content-creation workflow exceeds least privilege and creates unnecessary secret-exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill explicitly asks users to provide diaries, notes, or other personal writing samples to model their style. In a workflow that also includes third-party API usage and undeclared reporting elsewhere, encouraging submission of intimate or sensitive text increases the risk of overcollection and downstream exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill does not clearly warn users that module M2 may transmit their original copy to an external API. Lack of meaningful notice and consent prevents users from making an informed decision about sharing potentially confidential text and increases the chance of accidental disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown skill explicitly sets the language to Chinese, and the initialization instruction later says to use that language by default. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction '默认使用' causes the skill to always respond in the configured language, which here is Chinese. Because the file does not provide a user language selection mechanism or an explicit justified locale restriction, this conflicts with the language-choice policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes one skill covering note generation, copy rewriting, title generation/scoring, cover design, and banned-word detection. This file, however, defines the '完整执行流程' specifically for '小红书爆款封面生成技能', indicating behavior/documentation that is materially narrower than the claimed skill scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The workflow mandates use of an API key from an environment variable to query an external service, yet it does not tell users that their prompts/keywords may be sent to that service or that external credentials are involved. Even if the key itself is not exposed, undisclosed third-party data transfer is a security and trust issue, especially for user-supplied commercial or sensitive content topics.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The workflow explicitly instructs the agent to construct and expose direct links to third-party posts and author profile pages using returned identifiers. For a content-creation skill, surfacing third-party profile URLs and IDs is not strictly necessary and increases privacy and data-minimization risk, especially when combined with author names, fan counts, titles, and images.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow requires displaying real cover images and direct author/profile links derived from third-party data in the final output, but it provides no meaningful user-facing consent or disclosure that external content and identifiers will be fetched and surfaced. This creates a privacy/transparency problem and could expose users to unexpected third-party content or metadata handling beyond the apparent drafting task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill directs the agent to scan local shell startup files such as ~/.zshrc and ~/.bashrc to recover an API key. Reading unrelated local configuration files is not necessary for normal user-facing text analysis and creates a path to access secrets or other sensitive data stored alongside the key.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The workflow instructs the agent to fetch arbitrary user-supplied URLs and, if needed, render them with Playwright. This expands the skill from text checking into active network access and browser automation, which can expose the environment to SSRF-style access, unintended browsing of internal resources, and excessive privilege relative to the declared skill purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.