公众号爆款选题雷达

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

This looks like a legitimate hot-topic reporting skill, but it should be reviewed because generated reports can execute untrusted collected content and mutable remote JavaScript.

Review before installing. The skill's goal is reasonable, but it contacts third-party services and creates local HTML reports that currently load remote JavaScript and render collected text without escaping. Safer use would require HTTPS-only sources, HTML escaping or templating with autoescape, pinned dependencies, and locally bundled or integrity-pinned Plotly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/report_generator.py:550

Finding

Stored HTML and JavaScript Injection Through Untrusted Topic Data

Content

View full analysis

str: """Generate detailed analysis HTML.""" html = "" for i, analysis in enumerate(analyses, 1): topic = analysis.original_topic score = analysis.heat_score html += f'''

{i}. {topic.title}

{score.total_score}分

📱 {topic.platform} 🔥 {topic.hot_score:.0f} 热度 {f'👁 {topic.read_count} 阅读' if topic.read_count else ''} {f'❤️ {topic.like_count} 点赞' if topic.like_count else ''} {f'📂 {topic.category}' if topic.category else ''}

''' if analysis.angles: html += '

' html += '

🎯 推荐切入角度

' for angle in analysis.angles[:2]: html += f'''

{angle['type']} - {angle['suggested_title']}

💡 {angle['hook'][:50]}... | 目标情绪: {angle['target_emotion']}

''' html += '

' if analysis.differentiation: diff = analysis.differentiation html += '

Remediation

View remediation

`, ``, quotes, angle brackets, and encoded variants. Verify that generated reports display these strings as text rather than executable markup. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enhanced_collector.py:92

Finding

Primary Hotspot API Uses Unauthenticated Plaintext HTTP

Content

View full analysis

List[HotTopic]: """Collect data from the XiaoChen API.""" try: url = f"{self.API_BASE}?type={self.type_code}" response = self.session.get(url, timeout=10) response.raise_for_status() data = response.json() ``` ### Technical Analysis The primary collector for most supported platforms connects to `api.xcvts.cn` over HTTP. Plaintext HTTP provides neither server authentication nor response integrity. An attacker positioned on the network path can impersonate the server or modify responses. JSON parsing confirms only that the response is syntactically valid; it does not establish its origin or integrity. The returned values are subsequently trusted for scoring, analysis, JSON export, and HTML report generation. This issue materially increases the exploitability of the stored HTML injection vulnerabi ...[truncated 1378 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/report_generator.py:169

Finding

Mutable External JavaScript and Unbounded Dependency Versions

Content

View full analysis

公众号爆款选题雷达报告 ``` From `requirements.txt`: ```text # 公众号爆款选题雷达 - Python依赖 # 数据采集 requests>=2.28.0 urllib3>=1.26.0 # 数据分析 numpy>=1.21.0 pandas>=1.3.0 # 中文分词 jieba>=0.42.1 # 可视化 plotly>=5.0.0 # 配置解析 pyyaml>=6.0 # 工具库 python-dateutil>=2.8.0 ``` ### Technical Analysis Generated reports load `plotly-latest.min.js`, a mutable CDN resource whose effective content can change after the project has been reviewed. No exact version, Subresource Integrity hash, or local trusted copy is used. Consequently, report behavior depends on code delivered at viewing time rather than code contained in the audited package. The Python requirements specify only lower bounds. A future installation may select any newer release, making builds non-reproducible and allowing unreviewed behavior changes to enter the runtime. No lock file or package hashes are provided. The audit found no evidence that the currently referenced packages are intentionally malicious. The vulnerability is the absence of controls that bind installations and reports to reviewed artifacts. ### Attack Path #### Remote JavaScript path 1. An attacker compromises the CDN account, DNS route, distribution infrastructure, or upstream asset. 2. The mutable `plotly-latest.min.js` resource is replaced or modified. 3. A user opens a generated report while connected to the network. 4. The browser downloads and executes the altered JavaScript. 5. The malicious ...[truncated 1210 chars]

Remediation

View remediation

``` 3. Replace open-ended dependency ranges with a reviewed lock file containing exact versions and hashes. 4. Use hash-verified installation, for example: ```bash pip install --require-hashes -r requirements.lock ``` 5. Generate the lock file from a controlled build environment and review dependency changes before updating it. 6. Run automated vulnerability and provenance checks with tools such as `pip-audit`, while recognizing that scanners do not replace version pinning and artifact verification. 7. Remove dependencies that are not actually required by reachable runtime paths to reduce the supply-chain attack surface. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (40)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 48)May include surrounding context.

text

# Config with sensitive info
config/local.yaml
config/private.yaml
.env

# Temporary files
tmp/

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · data/reports/topic_radar_report_20260329_233212.html (reported line 255)May include surrounding context.

html

</div>
        
        <div class="content">
            <!-- 数据概览 -->
            <div class="section">
                <h2 class="section-title">📊 数据概览</h2>
                <div class="stats-grid">

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes multi-platform collection and local report generation but does not prominently disclose, near the usage instructions, that the skill performs live network requests and writes files to local storage. In an agent/skill context, this can mislead users or host systems about external connectivity and filesystem side effects, reducing informed consent and increasing operational risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language instructions, descriptions, usage guidance, and notes are entirely in Chinese, and the file does not indicate that this is an opt-in language choice or a region-specific constraint. Under the language/locale policy, forcing a single language without user opt-in can be a policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest sets the skill language to "zh-CN", which indicates a fixed locale. There is no accompanying note offering language choice or explaining that the skill is intentionally limited to a China-specific audience, so this can violate the policy against forcing a language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This local HTML report loads and executes JavaScript from an external CDN, which creates a supply-chain and privacy risk. If the CDN content is compromised, changed unexpectedly, or blocked, opening the report can execute untrusted code in the viewer's browser and potentially exfiltrate report contents or make network requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file uses Chinese-only natural-language documentation in the module docstring and throughout user-facing descriptions, with no indication that the skill is region-specific or that another language is supported. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring states the WeChat collector only provides simulated data and an interface framework, but the implementation still performs live outbound requests to Sogou. This mismatch can cause unexpected network access, privacy/compliance issues, and bypass operator expectations or sandbox assumptions about the component being non-live.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The code hardcodes an HTTP endpoint (not HTTPS) for a third-party API, which exposes requests and responses to interception or modification by a network attacker. Because the returned data is consumed directly and influences output, a man-in-the-middle could tamper with topic titles, links, or metadata and poison downstream consumers.

Content

Scanner excerpt · scripts/enhanced_collector.py (reported line 94)May include surrounding context.

python

class XiaoChenCollector(BaseCollector):
    """
    小尘API采集器 - 支持20+平台
    接口: http://api.xcvts.cn/api/hotlist
    """
    
    API_BASE = "http://api.xcvts.cn/api/hotlist"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This finding points to the same insecure third-party HTTP API usage: traffic to api.xcvts.cn is sent without transport encryption. In the context of a collector that may run in automated pipelines, this increases the chance of silent data tampering, endpoint impersonation, and privacy leakage over untrusted networks.

Content

Scanner excerpt · scripts/enhanced_collector.py (reported line 97)May include surrounding context.

python

接口: http://api.xcvts.cn/api/hotlist
    """
    
    API_BASE = "http://api.xcvts.cn/api/hotlist"
    
    # 平台映射表
    PLATFORM_MAP = {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The collector makes outbound requests to multiple third-party services and does not provide any user-facing notice, consent, or configuration guard before transmitting network metadata such as IP address, headers, timing, and requested platform selection. In this skill’s context, the entire purpose is remote aggregation, so the behavior is expected, but the use of undisclosed third-party endpoints still creates a real privacy and trust risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains user-facing natural-language descriptions and runtime output in Chinese, but nowhere indicates that the skill is China/Chinese-specific or that users may choose another language. That can violate language/locale policy when a skill implicitly forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script prints operational status and results to the user only in Chinese. Because no alternative language selection or explicit locale justification is provided, the skill imposes a fixed language on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML output explicitly sets lang="zh-CN" and the report title/content are hard-coded in Chinese, which forces a specific language/locale experience without any user opt-in or configuration. This matches the language/locale policy violation criterion because the file does not indicate that the skill is intentionally region-specific or user-selectable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated HTML unconditionally loads Plotly JavaScript from an external CDN, which introduces a third-party supply-chain and privacy dependency into every opened report. If the CDN response is tampered with, blocked, or observed, users opening the report may execute unexpected script or leak access metadata despite the report otherwise being local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and all user-facing generated content are written exclusively in Chinese, indicating the skill is designed to operate in a single language without any opt-in or language-selection mechanism. The policy explicitly calls for flagging language or locale constraints when they are forced rather than offered as a user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The request session sets Accept-Language to prefer zh-CN, which imposes a specific language/locale on all requests made by this collector. Under the policy, forcing a locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The class documentation states that Zhihu and Weibo require a login state and are 'currently unavailable'. However, the file contains fully implemented collect methods for both platforms that issue HTTP requests and parse responses at L246-L301 and L322-L367. This is an active contradiction in documentation about actual capability and availability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

A natural-language policy issue applies because the skill documentation presents all user-facing instructions in a single language with no opt-in or alternative locale guidance. Nothing in the README states that the skill is region-specific or intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises broad multi-platform network collection and local HTML/JSON report generation, but it does not clearly warn users that invoking the skill will perform external network access and write files to local storage. This can lead to unintended data transfer, surprise filesystem side effects, and execution in environments where outbound access or file creation is restricted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This manifest/config file uses Chinese labels and comments throughout, which effectively imposes a specific language on users or maintainers. The file does not document that the skill is China-specific or offer any language/locale choice, so it may violate the language/locale policy for natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This JSON file contains user-facing natural-language content entirely in Chinese across titles, hooks, structures, and recommendations, but provides no indication that the language is optional, user-selected, or justified as a region-specific constraint. That can violate language/locale policy when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document declares lang="zh-CN", and the entire visible interface is presented only in Simplified Chinese. Under the policy rule for language/locale constraints, this is a locale choice imposed on users without any opt-in or explanation that the report is intended only for a China-specific audience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally pull in vulnerable or breaking releases from the supply chain.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# 公众号爆款选题雷达 - Python依赖

# 数据采集
requests>=2.28.0
urllib3>=1.26.0

# 数据分析

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The manifest does not pin the requests version, so it is impossible to verify whether deployed environments will avoid known vulnerable releases. In a project that performs data collection over HTTP, this uncertainty increases supply-chain and transport-related risk because the actual installed package may vary by installation time or mirror state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.