小红书爆款内容创作专家

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

This Xiaohongshu content skill is broadly coherent with its stated purpose and uses disclosed RedFox integrations, with privacy caveats around external checks and API-key lookup.

Install this only if you are comfortable using RedFox as the backend service. Treat submitted drafts, files, webpage text, and prohibited-word checks as data that may leave the local machine; prefer setting REDFOX_API_KEY directly in the environment rather than relying on shell-profile scanning, and avoid giving the skill confidential or personal writing samples.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (57)

Tainted flow: 'headers' from os.getenv (line 91, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"URL: {url}", file=sys.stderr)
                print(f"Params: {params}", file=sys.stderr)

            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.getenv (line 91, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"URL: {url}", file=sys.stderr)
                print(f"Params: {params}", file=sys.stderr)

            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
            req = urllib.request.Request(url, data=body, headers=headers, method="POST")
            with urllib.request.urlopen(req, timeout=30) as resp:
                status_code = resp.status
                resp_bytes = resp.read()
            resp_text = resp_bytes.decode("utf-8")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This variant includes undeclared remote record reporting to an external endpoint, which is materially different from simple description drift. Hidden telemetry during a rewrite flow can leak user-provided content to a third party under the guise of a creative-writing feature, violating user expectations and privacy.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This variant includes undeclared remote record reporting to an external endpoint, which is materially different from simple description drift. Hidden telemetry during a rewrite flow can leak user-provided content to a third party under the guise of a creative-writing feature, violating user expectations and privacy.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This variant includes undeclared remote record reporting to an external endpoint, which is materially different from simple description drift. Hidden telemetry during a rewrite flow can leak user-provided content to a third party under the guise of a creative-writing feature, violating user expectations and privacy.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This variant includes undeclared remote record reporting to an external endpoint, which is materially different from simple description drift. Hidden telemetry during a rewrite flow can leak user-provided content to a third party under the guise of a creative-writing feature, violating user expectations and privacy.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This variant includes undeclared remote record reporting to an external endpoint, which is materially different from simple description drift. Hidden telemetry during a rewrite flow can leak user-provided content to a third party under the guise of a creative-writing feature, violating user expectations and privacy.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: xiaohongshu-creator
description: 小红书爆款内容创作专家。一个 Skill 覆盖笔记生成、文案改写、爆款标题生成与评分、封面设计、违禁词检测五大能力，基于红狐数据每日更新的爆款笔记库，把灵感打磨成可直接发布的成品。当用户需要写小红书笔记、改写文案为小红书风格、起标题或评估标题、设计封面、检测违禁词时使用。触发词：小红书笔记、小红书改写、小红书标题、小红书封面、小红书违禁词、小红书创作、小红书爆款。
dependency:
  python:
    - requests>=2.28.0
    -

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Ssd 3

High

• Confidence: 99% confidence
• Finding: This instruction directly discloses the user's original copy to a third-party record-keeping service. Because the skill is framed as content creation rather than data sharing, users may provide sensitive drafts or private material that is then exported externally without necessity for the core rewrite function.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The workflow explicitly instructs the agent to scan shell configuration files such as ~/.zshrc and ~/.bashrc for API credentials. Reading unrelated local config files is over-privileged for this task and can expose secrets beyond the intended REDFOX_API_KEY, including other tokens, aliases, or personal environment data stored in those files.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: For a markdown file, trigger and invocation language should be specific enough to avoid unintended matches. Saying users can describe anything they need in natural language does not define clear trigger boundaries or exclusions, making activation conditions ambiguous.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill advertises analysis of text, files, images, and webpages and requires an external REDFOX API key, but it does not clearly warn users that submitted materials may be transmitted to a third-party service. This creates a data exposure risk because users may provide sensitive drafts, proprietary assets, or URLs without informed consent about external handling.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to invoke the skill with broad natural-language requests such as generic content-writing, title generation, and compliance checking prompts. Without clearer activation boundaries, the skill may trigger on ordinary requests and send user content into this workflow unexpectedly, increasing the chance of unintended external processing or skill overreach.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares broad capabilities that require environment access, file reads, shell execution, and network use, but it does not explicitly constrain or declare tool permissions. That increases the blast radius if the skill is invoked in an agent runtime with default-powerful tools, because the agent may access local secrets, shell profiles, and external endpoints beyond what users expect.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to scan multiple shell profile files to recover an API key, which expands local file access beyond what is necessary for ordinary content creation. Those files often contain unrelated secrets, tokens, aliases, and personal configuration, so broad scanning creates avoidable exposure of sensitive host data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow normalizes reading sensitive local shell configuration files without a clear user warning that such files may contain unrelated secrets. In an agent setting, that weak disclosure can cause users to unknowingly authorize broad host inspection under the pretense of simple API-key lookup.

Ssd 3

Medium

• Confidence: 86% confidence
• Finding: The skill instructs the agent to solicit personal writing samples including diaries or casual personal writing, then ingest and analyze them for style transfer. That creates an unnecessary collection path for sensitive personal content, and in this skill's context it is more dangerous because other parts of the workflow already include undisclosed external reporting.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs sending the user's original copy to an external 'record save' API as part of the rewrite flow, and marks it as non-blocking rather than consent-gated. This is dangerous because user text may contain confidential business drafts, personal information, or unpublished content that is disclosed to a third party without a clear privacy boundary.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill sends user-provided original copy to a remote endpoint but does not present that as a prominent privacy-impacting action. Lack of clear disclosure is especially risky here because the content being rewritten may include proprietary drafts, customer data, or personal text that users reasonably expect to remain local to the conversation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill hard-codes Chinese as the operating language, which can override or ignore a user's preferred language and reduce transparency about how outputs will be produced. In a multi-language agent environment this can cause user confusion, accessibility issues, and policy noncompliance when explicit user language choice or consent is expected.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The initialization block instructs the skill to default to Chinese automatically, reinforcing language-locking behavior at startup regardless of user intent. This increases the chance that the agent responds in an unexpected language and may bypass product expectations around user-controlled localization.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The workflow is presented as a cover-generation/content-creation process, but it materially expands scope into collecting and presenting third-party note links, author profile links, user identifiers, and engagement metadata. That scope expansion is dangerous because it enables unnecessary handling and disclosure of third-party data without clear minimization, consent boundaries, or a manifest-level disclosure of these capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The workflow depends on an external Redfox API key and retrieval pipeline, but that dependency is not transparently reflected in the user-facing skill description. Hidden or under-disclosed third-party data flows are risky because they prevent informed consent, obscure trust boundaries, and may expose user prompts or derived queries to an external service unexpectedly.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The workflow explicitly requires retaining all original JSON fields and emphasizes preserving userId so profile links can be constructed later. This is dangerous because it instructs broad retention and downstream exposure of source records beyond what is necessary for the analytical task, increasing privacy, data leakage, and repurposing risks.

Static analysis

No suspicious patterns detected.