抖音热门账号推荐

• Outcome: Review
• Latest audit: Jun 2, 2026 · 10:46 AM UTC
• Version: 1.0.2

Overview

The skill mostly does what it advertises, but generated reports automatically open a browser and load remote JavaScript without clear disclosure.

Install only if you are comfortable providing a RedFox API key and allowing generated reports to open in a browser. Treat report HTML as active content because it loads JavaScript from a CDN; avoid opening reports in restricted or sensitive environments unless this behavior is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if system == "Darwin":  # macOS
            subprocess.run(["open", str(abs_path)], check=True)
        elif system == "Windows":
            subprocess.run(["start", "", str(abs_path)], shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", str(abs_path)], check=True)
        print(f"\n✓ HTML 报告已自动打开: {abs_path}", file=sys.stderr)

• Confidence: 92% confidence
• Finding: subprocess.run(["start", "", str(abs_path)], shell=True, check=True)

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The script's primary purpose is report generation, but it also automatically launches the generated file through OS handlers. That extra system-interaction capability increases risk because opening the HTML can trigger browser execution, network fetches, and desktop-side effects without explicit user approval.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The generated report includes a third-party script from a public CDN, so opening what appears to be a local report causes remote code to be fetched and executed in the browser. This creates a supply-chain and privacy risk that is inconsistent with user expectations for an offline downloadable report.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README explicitly says users can invoke the skill with any natural-language request, which weakens invocation boundaries and can cause the skill to activate outside its intended domain. In an agent environment, overly broad activation increases the chance of accidental triggering, context confusion, and unintended access to external data/actions such as report generation or subscription setup.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: The example trigger phrase is generic enough that it may overlap with ordinary conversation, making unintended routing more likely. While the skill is domain-specific and low-risk compared with code-execution or secret-handling tools, generic triggers still increase the attack surface for prompt-routing mistakes and accidental invocation.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger phrases include broad, generic recommendation terms such as '最新推荐' and similar ranking-oriented language that may match ordinary conversation outside the intended scope. Overbroad activation can cause the skill to run unexpectedly, leading to unnecessary network calls, file generation, or subscription-oriented prompts in contexts where the user did not intend to invoke this capability.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Users opening the generated HTML are not warned that it will contact a third-party CDN and execute remote JavaScript. That hidden network behavior can leak metadata, weaken trust boundaries, and expose users to CDN compromise or policy violations in restricted environments.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script automatically opens the newly generated report without prior consent, which causes an immediate external application launch and may trigger remote resource loading from the HTML. While not inherently malicious, this violates least surprise and can be risky in automated or sensitive environments.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.