Security audit

运营数据日报虾

Security checks for vulnerabilities and agentic risk

Overview

This skill fits its analytics-reporting purpose, but it handles live platform credentials and session cookies in unsafe, under-scoped ways that warrant careful review before installation.

Install only if you are comfortable giving this skill access to creator-platform analytics credentials and business performance data. Before use, replace Bash sourcing of .env with a safe dotenv parser, keep secrets out of source control and logs, avoid full browser cookies where official scoped APIs are available, confirm Feishu recipients before sending, and treat any cron setup as privileged automation that should run under a low-privilege account.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch-platform-data.sh:13
Finding: Arbitrary Shell Command Execution Through Unsafe .env Loading
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch-platform-data.sh:133
Finding: WeChat Corporate Secret and Access Token Exposed in URL Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The English description similarly overstates what the skill can do, including API collection, cleaning, Feishu push, scheduling, and monthly reporting that are not present. Overclaimed automation in a data-reporting skill can mislead users into sharing credentials, relying on nonexistent controls, or assuming reports were sent and monitored when they were not.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The English description similarly overstates what the skill can do, including API collection, cleaning, Feishu push, scheduling, and monthly reporting that are not present. Overclaimed automation in a data-reporting skill can mislead users into sharing credentials, relying on nonexistent controls, or assuming reports were sent and monitored when they were not.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 13)May include surrounding context.

data.external.user — 用户数据

data.external.item — 内容数据

获取 Access Token：

bash
curl -X POST "https://open.douyin.com/oauth/access_token/" \ -H "Content-Type: application/x-www-form-urlencoded" \

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide instructs users to extract a full Xiaohongshu browser Cookie and place it into a .env file without clearly warning that this cookie is a live session credential that may grant account access. In the context of an automation skill that centralizes multi-platform data collection, this encourages insecure handling of highly sensitive session tokens and increases the risk of account takeover or unauthorized scraping if the credential leaks.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 73)May include surrounding context.
md
## 微信视频号数据助手 **鉴权方式**：企业微信 Access Token **申请入口**：https://work.weixin.qq.com/

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 77)May include surrounding context.
md
## 微信视频号数据助手 **鉴权方式**：企业微信 Access Token **申请入口**：https://work.weixin.qq.com/

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 122)May include surrounding context.
md
## 微信视频号数据助手 **鉴权方式**：企业微信 Access Token **申请入口**：https://work.weixin.qq.com/

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document tells users to take Bilibili SESSDATA from browser cookies and use it for API access, but does not explain that SESSDATA is a sensitive authenticated session token. If mishandled, anyone obtaining it may impersonate the account for creator-center access, making this especially risky in an operational reporting skill that aggregates credentials across several platforms.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The .env template encourages consolidating multiple high-value platform credentials, including cookies and access tokens, into one local file without any accompanying security guidance. In a skill designed for automated multi-platform reporting, this concentration of secrets meaningfully increases blast radius if the file is exposed through source control, backups, process output, or host compromise.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 135)May include surrounding context.

.env 配置模板

env
# 抖音

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/fetch-platform-data.sh (reported line 4)May include surrounding context.
sh
#!/usr/bin/env bash # fetch-platform-data.sh — 多平台运营数据采集脚本 # 依赖：bash, curl, jq, python3 # 配置：从 .env 文件读取 API 密钥 set -euo pipefail

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/fetch-platform-data.sh (reported line 10)May include surrounding context.
sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" DATA_DIR="${SCRIPT_DIR}/../data/raw" ENV_FILE="${SCRIPT_DIR}/../.env" # 加载环境变量 if [[ -f "$ENV_FILE" ]]; then

Credential Access

High

Category: Privilege Escalation
Confidence: 76% confidence
Finding: Sourcing the .env file with Bash executes its contents as shell code, not just key-value parsing. If an attacker can modify .env, they can achieve arbitrary command execution when the script runs, which is more dangerous than simple credential access. In this automation context, scheduled execution would amplify the impact.
Content: Scanner excerpt · scripts/fetch-platform-data.sh (reported line 18)May include surrounding context.
sh
source "$ENV_FILE" set +a else echo "[WARN] .env 文件不存在，请先创建并配置 API 密钥" fi mkdir -p "$DATA_DIR"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs use of shell scripts and file-writing behavior but does not declare any explicit tool scope or permission boundaries. That creates an authorization gap where an agent may execute commands or modify files more broadly than the user expects, increasing the chance of unsafe command execution or unintended workspace changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description promotes collecting operational metrics and pushing reports to Feishu groups or documents without an explicit warning that sensitive business data may be transmitted to external systems and multiple recipients. That omission can lead users to disclose confidential performance data, account identifiers, or tokens without informed consent or recipient review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrases are broad enough to match common analytics requests, which can cause the skill to activate in situations where the user did not intend external data collection, shell execution, or report dissemination. In this context, overbroad invocation increases the risk of unnecessary handling of operational data and unintended actions across multiple platforms.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is entirely written in Chinese and presents the anomaly rules, handling guidance, and alert message template only in that language. Under the policy, a skill should not force a specific language or locale without opt-in or a documented justification; no such choice or justification appears here.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 15)May include surrounding context.
获取 Access Token：

bash
curl -X POST "https://open.douyin.com/oauth/access_token/" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "client_key=YOUR_CLIENT_KEY&client_secret=YOUR_CLIENT_SECRET&code=AUTH_CODE&grant_type=authorization_code"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This example sends a full Xiaohongshu Cookie to a non-official endpoint flow for automated scraping, which materially raises exposure because the cookie is a reusable authenticated session credential. In this skill's context, where operators may automate and centralize many such credentials, compromise of logs, scripts, or environment variables could lead to unauthorized account access.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 52)May include surrounding context.
数据采集（非官方，稳定性较低）：

bash
curl "https://creator.xiaohongshu.com/api/galaxy/creator/data/note_stats" \ -H "Cookie: $XIAOHONGSHU_COOKIE" \ -H "X-Sign: ..." \ -d '{"start_date":"2026-03-31","end_date":"2026-03-31"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 79)May include surrounding context.
获取 Access Token：

bash
curl "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=YOUR_CORPID&corpsecret=YOUR_CORPSECRET"

查询数据：

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 124)May include surrounding context.
获取 Access Token：

bash
curl -X POST "https://api.weibo.com/oauth2/access_token" \ -d "client_id=APP_KEY&client_secret=APP_SECRET&grant_type=authorization_code&code=AUTH_CODE&redirect_uri=REDIRECT_URI"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 124)May include surrounding context.
获取 Access Token：

bash
curl -X POST "https://api.weibo.com/oauth2/access_token" \ -d "client_id=APP_KEY&client_secret=APP_SECRET&grant_type=authorization_code&code=AUTH_CODE&redirect_uri=REDIRECT_URI"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/platform-api-guide.md (reported line 130)May include surrounding context.
获取 Access Token：

bash
curl -X POST "https://api.weibo.com/oauth2/access_token" \ -d "client_id=APP_KEY&client_secret=APP_SECRET&grant_type=authorization_code&code=AUTH_CODE&redirect_uri=REDIRECT_URI"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This shell script reads API keys from a local .env file and later uses them in outbound requests to third-party platform APIs. While the script logs progress, it does not clearly disclose to the user that stored credentials and account-related data will be used and sent externally, which is a safety-relevant behavior for a data-collection script.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/fetch-platform-data.sh (reported line 48)May include surrounding context.
sh
fi local response response=$(curl -sf "https://open.douyin.com/data/external/user/fans/data/" \ -H "access-token: ${DOUYIN_ACCESS_TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"open_id\":\"${account_id}\",\"date_type\":1}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/fetch-platform-data.sh (reported line 90)May include surrounding context.
sh
fi local response response=$(curl -sf "https://creator.xiaohongshu.com/api/galaxy/creator/data/note_stats" \ -H "Cookie: ${XIAOHONGSHU_COOKIE}" \ -H "Content-Type: application/json" \ -d "{\"start_date\":\"${target_date}\",\"end_date\":\"${target_date}\"}" \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Credential Access

Missing User Warnings

Credential Access

Credential Access

Credential Access

Missing User Warnings

Credential Access

.env 配置模板

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Missing User Warnings

Vague Triggers

Natural-Language Policy Violations

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

External Transmission

Static analysis