ClawHub
Back to skill

Security audit

小红书内容灵感专家

Security checks for vulnerabilities and agentic risk

Overview

The skill provides Xiaohongshu analytics, but it needs Review because it handles API keys and recurring subscriptions in ways that are broader and less safe than necessary.

Install only if you are comfortable giving it a Redfox API key and running local scripts. Prefer setting REDFOX_API_KEY only in the current session or a secure secret store, avoid letting the skill edit shell profiles, do not create subscriptions unless you understand how to disable them, and treat generated HTML reports cautiously because they may load third-party scripts and render API-provided content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:85
Finding

Mandatory Output Manipulation and Subscription Workflow Hijacking

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch_explosive_articles.py:227
Finding

TLS Certificate Validation Disabled While Transmitting an API Key

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/gen_xhs_html.py:626
Finding

Stored HTML and JavaScript Injection in Generated Reports

Content
View full analysis
' + '' + (avatar ? '' : '') + '' + (userUrl && userUrl !== '#' ? '' + userName + '' : userName) + ''; document.getElementById('noteList').innerHTML = html; ``` A separate report generator interpolates fields directly into markup: ```python title = article.get("title", "No title") or "No title" photo_url = article.get("photoJumpUrl", "#") user_name = article.get("userName", "Unknown author") user_url = article.get("userJumpUrl", "#") user_head_url = article.get("userHeadUrl", "") author_html = ( f'
Remediation
View remediation
``` Populate it with HTML-safe serialized JSON and parse its `textContent`. 8. Apply `html.escape(value, quote=True)` to every Python-generated HTML text or attribute value. 9. Add a restrictive Content Security Policy that blocks inline scripts and unauthorized network destinations. 10. Add regression tests for closing-script sequences, quote-breaking payloads, event attributes, and dangerous URL schemes. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crawl_xhs.py:25
Finding

Unnecessary Reading of User Shell Configuration Files for Credential Discovery

Content
View full analysis
str: val = os.environ.get("REDFOX_API_KEY", "").strip() if val: return val for cfg in SHELL_CONFIG_FILES: cfg_path = Path.home() / cfg if cfg_path.is_file(): try: content = cfg_path.read_text( encoding="utf-8", errors="replace", ) match = re.search( r'export\s+REDFOX_API_KEY\s*=\s*["\']?' r'([a-zA-Z0-9_\-]+)["\']?', content, ) if match: return match.group(1) except OSError: continue ``` The broader implementation in `fetch_explosive_articles.py` additionally reads PowerShell profile files on Windows and scans several assignment syntaxes. ### Technical Analysis The Skill only needs access to one credential. Reading the process environment is sufficient and is the conventional least-privilege mechanism for supplying it. Instead, the scripts open entire shell and PowerShell initialization files. Such files commonly contain unrelated API keys, tokens, aliases, executable startup commands, internal paths, and infrastructure details. Although the reviewed code only returns a matching `REDFOX_API_KEY`, the complete file contents are read into the process. This creates an unnecessary local-data acc ...[truncated 1248 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
assets/preview-template.html:8
Finding

Generated Reports Execute Third-Party JavaScript Without Integrity Protection

Content
View full analysis
``` The template dynamically falls back to additional providers: ```javascript script.src = 'https://cdnjs.cloudflare.com/ajax/libs/html2pdf.js/0.10.1/html2pdf.bundle.min.js'; script.src = 'https://unpkg.com/html2pdf.js@0.10.1/dist/html2pdf.bundle.min.js'; ``` Other reports load remote scripts similarly: ```html ``` ### Technical Analysis The generated reports execute JavaScript fetched at report-open time from multiple third-party CDN domains. No Subresource Integrity hashes were observed. Version strings reduce accidental upgrades but do not protect against: - CDN compromise. - Package-account compromise. - DNS or delivery-path compromise. - Replacement of the asset at the referenced URL. - Malicious fallback behavior from any of the configured providers. The fallback chain expands the report's supply-chain trust boundary from one external provider to several. ### Attack Path 1. The Skill generates an HTML report containing remote script references. 2. The user opens the report while connected to the network. 3. The browser requests the dependencies from the configured CDN. 4. A compromised CDN, package asset, or delivery path returns modified JavaScript. 5. The browser executes the modified script in the report context. 6. The script reads or modifies report data and can transmit it over the network. ### Impact Assessment A compromised de ...[truncated 464 chars]
Remediation
View remediation
; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://approved-image-host.example; connect-src 'none'; ``` 5. Verify dependency artifacts during packaging and record their cryptographic hashes. 6. Review and update bundled dependencies through a controlled release process rather than at report-open time. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (92)

Tainted flow: 'req' from os.environ.get (line 111, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_xhs_hot_articles.py (reported line 113)May include surrounding context.

python
body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
            req = urllib.request.Request(url, data=body, headers=headers, method="POST")
            
            with urllib.request.urlopen(req, timeout=30) as resp:
                status_code = resp.status
                raw = resp.read().decode("utf-8")

Tainted flow: 'headers' from os.environ.get (line 196, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gen_xhs_html.py (reported line 207)May include surrounding context.

python
try:
        # 接口仅支持 GET（query 参数）；POST 会返回系统错误
        response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30)
        if response.status_code >= 400:
            return {"fetch_time": rank_date + " 19:00", "query_type": "日榜", "category": category, "hot_list": []}

Tainted flow: 'headers' from os.environ.get (line 175, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/xhs_daily_fetcher.py (reported line 186)May include surrounding context.

python
try:
        # 接口仅支持 GET（query 参数）；POST 会返回系统错误
        response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30)
        if response.status_code >= 400:
            raise Exception(f"HTTP请求失败: {response.status_code}, {response.text}")

Tainted flow: 'req' from os.environ.get (line 312, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

The request sent at this call site includes an API key sourced from environment or shell profile discovery, and the code disables TLS certificate validation before transmitting it. That creates a realistic man-in-the-middle exposure where the credential and query data can be intercepted or redirected to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/xiaohongshu-similar-account.py (reported line 319)May include surrounding context.

python
ssl_ctx.verify_mode = ssl.CERT_NONE

    try:
        with urllib.request.urlopen(req, context=ssl_ctx, timeout=30) as resp:
            result = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        raise Exception(f"HTTP请求失败: {e.code}, {e.read().decode('utf-8', errors='replace')}")

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest repeatedly claims '严禁任何联网搜索' while the skill depends on external Redfox API access, shell-profile scanning, and other capabilities not reflected in the declared behavior. This mismatch is dangerous because operators and downstream agents may trust the documentation and permit execution under false assumptions, leading to unexpected data exfiltration, credential exposure, or policy bypass.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: xiaohongshu-inspiration
description: 小红书内容灵感聚合技能，覆盖选题灵感全链路：关键词爆款笔记搜索（相关性/热度/时效三维评分）、批量获取作品数据（支持 Excel/HTML 导出）、每日爆款 TOP50 爆发榜、低粉爆款挖掘（粉丝<5000 点赞>500）、账号日/周/月榜 TOP50、同阶对标与高阶标杆推荐。当用户需要小红书灵感、爆款搜索、笔记查询、批量获取作品、每日爆款、低粉爆款、账号榜单、涨粉榜、对标账号推荐时使用。触发词：小红书灵感、小红书爆款、小红书搜索、小红书�

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
python3 scripts/fetch_xhs_hot_articles.py --keyword "睫毛膏" --max-items 10

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
python3 scripts/fetch_xhs_hot_articles.py --keyword "睫毛膏" --max-items 10

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
python3 scripts/fetch_explosive_articles.py --keyword "居家装修" --top_n 50

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/preview-template.html (reported line 7)May include surrounding context.

html
<meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>{{KEYWORD}} · 小红书低粉爆款笔记TOP{{TOP_N}}</title>
    <!-- 使用多个CDN源，确保html2pdf.js能够加载 -->
    <script src="https://cdn.jsdelivr.net/npm/html2pdf.js@0.10.1/dist/html2pdf.bundle.min.js"></script>
    <script>
        // 如果第一个CDN加载失败，尝试第二个

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/preview-template.html (reported line 7)May include surrounding context.

html
<meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>{{KEYWORD}} · 小红书低粉爆款笔记TOP{{TOP_N}}</title>
    <!-- 使用多个CDN源,确保html2pdf.js能够加载 -->
    <script src="https://cdn.jsdelivr.net/npm/html2pdf.js@0.10.1/dist/html2pdf.bundle.min.js"></script>
    <script>
        // 如果第一个CDN加载失败,尝试第二个

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document instructs the agent to help permanently modify shell startup files or Windows user environment variables and then verify the secret by echoing it back. For a content-inspiration skill, this is unnecessarily privileged and risks credential exposure, persistence beyond the task, accidental leakage in transcripts, and unintended modification of the user's local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow tells the agent to proactively persist the user's API key without adequate warning about permanence, shell/profile modification, or the risk of secret exposure. In context, this is especially unsafe because the skill's purpose does not justify handling long-lived credentials at the operating-system level.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/m6_account_template.html (reported line 42)May include surrounding context.

html
</head>
<body>
    <div class="container">
        <!-- 开场白 -->
        <div class="intro">
            <div class="intro-text">{{intro_text}}</div>
            <div class="data-note">{{data_note}}</div>

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The HTTPS client explicitly disables hostname checking and certificate validation, making the connection vulnerable to man-in-the-middle interception or spoofing. An attacker on the network path could impersonate the API endpoint, steal the X-API-KEY, and tamper with returned ranking data or injected content that later gets rendered and saved locally.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_rank_report.py (reported line 144)May include surrounding context.

python
for rule in CATEGORY_INFER_RULES:
        for kw in rule["keywords"]:
            if kw.lower() in combined:
                return rule["category"]

    # 3. 兜底关键词
    for category, keywords in FALLBACK_KEYWORDS.items():

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The generated HTML loads html2canvas from a third-party CDN at report view time, which violates the skill's stated 'no networking' constraint and creates a supply-chain risk. Anyone opening the report may trigger external requests that leak usage metadata and, if the CDN content is tampered with, execute untrusted JavaScript in the browser context.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/gen_xhs_html.py:68

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/xhs_daily_fetcher.py:66

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/fetch_explosive_articles.py:272

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/xiaohongshu-similar-account.py:310