Security audit

小红书热门账号推荐

Security checks across malware telemetry and agentic risk

Overview

The skill’s ranking and report features are coherent, but its recurring subscription behavior is under-specified and could create persistent scheduled tasks without enough clarity or reversibility.

Install only if you are comfortable giving the skill a RedFox API key, letting it contact the RedFox ranking API, and allowing it to create HTML files. Be especially careful with subscription requests: confirm the exact cadence and understand how to review or delete any created automation/calendar entry.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use environment variables for an API key, write HTML reports to the workspace, and make outbound network requests, but no declared permissions are present. This creates a transparency and policy-enforcement gap: the runtime may still attempt sensitive operations without the user or platform having an explicit permission model to review or constrain them.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill contains conflicting instructions for creating subscriptions: one section says to use automation_update, while another says to use calendar_create. Ambiguous execution paths around persistent actions are dangerous because they can cause the agent to create unintended long-lived tasks in a user's account without predictable behavior or consistent consent handling.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documented 'monthly' subscription rule is actually a weekly recurrence with INTERVAL=4, which does not reliably map to calendar months. This can lead to unexpected task frequency and unauthorized over-delivery, especially for persistent scheduled actions that continue after the initial interaction.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrase set for report download is overly broad ('下载报告、导出榜单、生成报告'), making it easy for ordinary conversation to be interpreted as a command to generate files and perform attachment delivery. Broad triggers increase the chance of unintended side effects, including file creation and outbound actions, without sufficiently clear user intent.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The subscription triggers include common conversational phrases such as '每天发给我', which can be interpreted too loosely as authorization to create a persistent scheduled task. This is dangerous because it can turn casual language into account-level state changes without a clear consent boundary.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs creation of an automation or calendar entry but does not clearly warn the user that a persistent task will be created in their account. Hidden persistence is a meaningful safety issue because users may not realize they are authorizing ongoing actions, repeated notifications, or stored account state.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill asks users to place an API key in local environment/config files but provides no warning about secret handling, storage risks, or least-privilege practices. Poor credential guidance can lead to accidental exposure through shell history, shared config files, logs, or overly broad agent access to sensitive environment data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.