Security audit
Security checks for vulnerabilities and agentic risk
This trend-reporting skill needs review because it automatically initiates recharge workflows, exposes API keys during setup, and generates HTML that can execute untrusted content.
Require approval of the verified recipient and amount before each recharge, and approve a pinned payment-tool installation separately. Keep the API key scoped to this skill and never print it; rotate any key already exposed. Avoid opening generated HTML until escaping is fixed. Expect delayed daily rankings.
scripts/gen_xhs_html.pyThird-party note content becomes executable code in generated HTML
Attacker-supplied JavaScript can alter the report, impersonate report controls, read report contents, and send browser-accessible report data to an external destination. This does not establish access to local API credentials or arbitrary operating-system files.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
try:
# 接口仅支持 GET（query 参数）；POST 会返回系统错误
response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30)
if response.status_code >= 400:
return {"fetch_time": rank_date + " 19:00", "query_type": "日榜", "category": category, "hot_list": []}
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
try:
# 接口仅支持 GET（query 参数）；POST 会返回系统错误
response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30)
if response.status_code >= 400:
raise Exception(f"HTTP请求失败: {response.status_code}, {response.text}")
Category-based ranking retrieval aligns with the description, but several central advertised capabilities are not implemented in the supplied code. The date-selection logic explicitly defaults to older data rather than today's rankings. There is no cross-time trend analysis or forecasting, and the keyword-based analysis helpers are not called by main(). Payment-related output describes a possible external workflow, not actions this script actually executes. Reading the API key from environment or shell configuration and optionally writing a requested cache file are supporting implementation details, not independent mismatches. No unrelated execution or data exfiltration is evident in this chunk.
The code supports the category-ranking lookup portion of the description, but its implemented scope is a delayed daily-ranking report generator rather than a real-time trend-analysis and creative-ideation system. The generated page also describes its ranking as growth between a note's second and third days, not simply today's highest-popularity notes. Payment handling delegates the remaining workflow to an external agent rather than executing it. API authentication, local report generation, and export dependencies are supporting implementation details, not independent mismatches. These conclusions apply only to the supplied code chunk; other skill components could implement the missing workflows.
An insufficient-credit API response causes the script to print imperative instructions directing the agent into a payment workflow using API-supplied payment links, amounts, and merchant information, without an explicit user-approval step. This crosses the boundary between retrieving trends and initiating a financial action, allowing a compromised or malicious response to steer payment initiation or present a fraudulent destination. The supplied file does not establish that funds can be transferred without downstream authorization, but the automatic handoff is unsafe even if Alipay later requires confirmation.
On an insufficient-credit response, the script instructs the agent to initiate a payment workflow using API-supplied cashierUrl, amount, and goodsName without requiring explicit user approval or validating the payment destination. In a data-query skill, this crosses a sensitive financial-action boundary and could steer the agent toward an unexpected or attacker-controlled payment request, although the shown Python code does not itself complete a charge.
The skill declares no tool scope while directing the agent to read credentials, write files, make network requests, and orchestrate payment tools. These capabilities largely support its advertised purpose, but unrestricted inherited tools could amplify compromised instructions or untrusted API output into unrelated file access or financial actions; actual exposure depends on the host's permission enforcement.
The workflow directs the agent to install a missing CLI automatically without first disclosing the local changes or obtaining approval. A request to retrieve trending content does not necessarily authorize installing executable software, and a remote insufficient-credit response can lead the agent into this installation path.
The installation command uses @latest, so npx -y downloads and executes a mutable package release without interactive confirmation. Although this is a CLI rather than an MCP server, the supply-chain concern is valid: a compromised future release could execute code with the agent's permissions, access local secrets, or interfere with the payment workflow.
This failure-handling bullet repeats the same mutable @latest installation command identified at line 62. It documents the same supply-chain vulnerability rather than introducing another execution step; the payment context increases the consequences of a compromised dependency.
The workflow directs the agent to persist the API key in shell startup files or user-wide environment settings specifically so other skills can access it. This unnecessarily expands credential availability beyond the requesting skill and session, increasing the chance of disclosure through unrelated agents, inherited process environments, configuration backups, or diagnostic collection.
Verifying configuration with echo prints the complete API key into terminal or tool output, where it may be retained in agent transcripts and logs. Combined with plaintext persistence, this can expose a credential that permits unauthorized API consumption and depletion of paid credits; it overlaps with the SDI-2 finding rather than representing a separate attack chain.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
**💡热门内容分析**
| 内容分类 | 内容特征 | 实际效果 | 参考笔记 |
| :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------ | :--------------------------------- |
| 封面设计 | 采用高清摄影或设计软件精心制作的封面图，画面构图饱满、色彩搭配协调，同时加入醒目的文字标题或标签，突出核心卖点或吸引眼球的元素，通过强烈的视觉冲击力在用户快速浏览时瞬间抓住注意力 | 点击率提升45% | [笔记标题链接1]<br>[笔记标题链接2] |
| 内容创作 | 围绕用户痛点或情感共鸣点展开叙事，采用第一人称视角分享真实经历或心得，结合表情符号和分段排版增强可读性，适当设置悬念或反转，激发用户的情感共鸣和参与欲望 | 互动率提升50% | [笔记标题链接3]<br>[笔记标题链接4] |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
**📈爆款标题分析**
| 标题类型 | 标题特征 | 标题模版 | 发布规律 | 参考标题 |
| :------- | :----------------------------------------------------------------------------------------------------------------- | :--------------- | :------------------- | :----------------------- |
| 提问式 | 标题以疑问句开头，设置悬念或提出用户关心的问题，引发用户的好奇心和思考欲望，激发点击阅读或评论互动 | "你还在XX吗？" | 工作日早高峰效果最佳 | 这个方法你还在用吗？ |
| 数字式 | 标题中包含具体的数字、数量或统计数据，利用人们对量化信息的偏好，增强内容的可信度和专业感，让用户觉得内容有价值 | "XX个XX技巧" | 午餐时间点击率高 | 5个快速提升XX的技巧 |
The manifest promises real-time heat monitoring and the current day's hottest notes, but the workflow defaults to yesterday's data after 19:00 and the day before yesterday's data before 19:00. L017 confirms that the daily update contains the previous day's rankings, so these instructions cannot deliver the advertised current-day coverage.
The manifest explicitly describes monitoring real-time popularity and querying today's hottest notes. At L132–L140, automatic date selection instead chooses yesterday after 19:00 and two days ago before 19:00; the main execution path uses this selection at L887 and L900. Consequently, the default workflow supplies historical rankings rather than the advertised same-day view.
The manifest promises current-day popular notes and real-time trend monitoring, but L130–L138 default to yesterday's rankings after 19:00 and rankings from two days ago before 19:00. Although the script prints the actual query date, its default data selection does not fulfill the manifest's same-day freshness claim.
Detected: suspicious.exposed_secret_literal