T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_xhs_hot_articles.py:610- Finding
Path Traversal and Arbitrary File Overwrite Through Report Filename
- Content
View full analysis
- Remediation
View remediation
Security audit
小红书爆款笔记查询
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Xiaohongshu search purpose, but it needs review because it can write local report files using unsafe paths and stores search criteria in calendar subscriptions.
Install only if you are comfortable giving the skill a Redfox API key, making external Redfox API calls with your search terms, and creating local HTML reports. Avoid untrusted or path-like keywords, do not use --output-file outside a dedicated reports folder, and treat generated HTML as untrusted. Use calendar subscription only after confirming what search criteria will be stored and how you can cancel it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_xhs_hot_articles.py:213- Finding
HTML Injection Through Unescaped API-Controlled Report Fields
- Content
View full analysis
相关性 {relevance_score} 热度 {popularity_score} 时效 {recency_score} ''' card_html = f'''{idx + 1}. {title}- Remediation
View remediation
``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)
Tainted flow: 'req' from os.environ.get (line 89, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python body = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request(url, data=body, headers=headers, method="POST") with urllib.request.urlopen(req, timeout=30) as resp: status_code = resp.status raw = resp.read().decode("utf-8")
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/fetch_xhs_hot_articles.py --keyword <关键词> --start-date <日期>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | SKILL 定义 | `SKILL.md` | 定义 Skill 元数据、意图理解规则、泛化词拓展策略、展示策略、订阅逻辑、自检清单 |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation guidance says users can 'just describe your needs in natural language,' which is broad enough to trigger the skill during ordinary conversation rather than a clearly intentional tool invocation. In an agent environment, this can cause accidental activation, unintended external API calls, or unnecessary processing based on casual mentions instead of explicit user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises subscription and scheduled push behavior but does not explain what user data is stored, how long subscription criteria are retained, where notifications are sent, or how users can revoke them. This creates privacy and consent risk because users may provide keywords, schedules, or account-linked destinations without clear data-handling boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README says users can 'directly use natural language to describe your needs, without remembering any command format,' which does not define clear activation boundaries or constrained trigger phrases. For a markdown skill description, this is ambiguous enough to risk unintended invocation from ordinary conversational requests.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares no explicit tool/permission scope, yet the documentation clearly indicates use of environment variables, network access to Redfox API, and local file writes for HTML report generation. Without a manifest-level allowlist, an agent may invoke capabilities broader than users expect, increasing the risk of unintended data exfiltration, local file creation, or policy bypass through overly permissive execution.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill metadata describes a search/recommendation tool, but the body adds calendar-based subscription and push behavior, which expands the operational scope into persistence and external scheduling. This creates a consent and capability mismatch: users may authorize a content search skill without realizing it can create long-lived tasks that store and act on their search parameters later.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill provides fixed Chinese reply templates such as
回复「拓展」/回复「不拓展」and repeatedly prescribes Chinese-only output phrasing throughout the document. This imposes a specific language on users without documenting an opt-in or offering alternatives, which matches the language/locale policy violation category.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The subscription workflow instructs the agent to create a calendar task containing the current search parameters, but does not explicitly warn that those parameters will be stored in an external scheduling system. Search topics may reveal business strategy, personal interests, or sensitive research themes, so persisting them externally without clear notice creates privacy and consent risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Most of the document mandates Markdown table output for results, with no requirement for per-item numbering, recommendation reasons, or embedded HTML cards. The self-check section actively instructs the agent to verify those extra fields, creating a direct contradiction with the earlier output rules and examples.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a tool for keyword-based hot-note search and ranking/recommendation, which implies retrieving and returning content data. In addition to that expected behavior, the code always generates and writes a local HTML file, creating a reporting side effect not stated in the skill description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
All user-facing instructions and examples in the skill description are in Chinese, and the README does not indicate that this language choice is optional or region-specific by design. This may violate language/locale policy where skills should not force a specific language without user opt-in or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill states that an HTML report file will be generated, but does not prominently warn users in the top-level description or consent flow that a local filesystem write will occur. Silent file creation can surprise users, leak sensitive search terms into local artifacts, and create persistence on shared or monitored systems.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document instructs users to configure an API credential via environment variable and also exposes a
--debugmode that prints raw API responses, but it does not warn about secret-handling or logging hygiene. In practice, operators may enable debugging in shared environments and inadvertently capture sensitive response data, request metadata, or adjacent configuration details in logs, increasing the chance of credential or data leakage.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L038 的请求示例将
source写为“"小红书爆款笔记洞察-ClawHub"”，但 L049 的参数说明又声明该字段固定值为“"小红书爆款笔记洞察-GitHub"”。这属于文档内部对同一行为的直接矛盾，会误导实现或调用方对实际请求内容的理解。- Content
Static analysis
No suspicious patterns detected.