公众号10w+阅读文章推荐

• Outcome: Pass
• Latest audit: Jun 2, 2026 · 10:25 AM UTC
• Version: 1.0.2

Overview

This skill appears to do what it claims: fetch WeChat hot-article data, analyze it, and create local reports, with some setup and privacy cautions.

Install only if you are comfortable giving the skill a Redfox API key and allowing it to contact redfox.hk. Configure the key through REDFOX_API_KEY or the platform secret mechanism, and do not allow an agent to inspect shell startup/profile files for credentials. Be aware that generated HTML reports store article metadata locally and load a PDF-export library from cdnjs when opened; review any subscription behavior in the host platform before enabling daily pushes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents use of environment variables, local file reads/writes, and outbound network access, but it does not declare corresponding permissions or clearly bound those capabilities. This creates a transparency and consent problem: a host may load a skill that can access secrets, write local artifacts, and call external services without an explicit permission model, increasing the risk of unintended data exposure or unsafe execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared description focuses on article retrieval and push recommendations, but the skill also performs local persistence, HTML/PDF generation, and automated content analysis. This mismatch is dangerous because operators and users may underestimate what the skill stores or produces, which can lead to unexpected retention of fetched content and broader execution privileges than implied by the headline description.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The spec instructs the skill to read credentials from shell profile files when the environment variable is absent, expanding access beyond the minimum needed to call the API. That behavior can expose unrelated secrets stored in user shell configs and causes the agent to inspect local credential stores without explicit user consent or warning.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises a subscription push feature but does not explain what user data is retained, how subscription preferences are stored, how long they persist, or how users can revoke them. Subscription features inherently imply ongoing state and user tracking, so the absence of disclosure and controls can lead to unauthorized retention or misuse of user preferences and delivery metadata.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes credential retrieval from environment variables or shell profile files without any user-facing disclosure that the skill may access local secret-containing files. In an article-retrieval skill, this is not justified by the feature set and increases the risk of overbroad credential access and accidental secret exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The generated HTML unconditionally loads html2pdf.js from a third-party CDN in the browser, which causes an external network request and introduces a supply-chain trust dependency. If the CDN asset is compromised, blocked, or modified, users opening the HTML could execute attacker-controlled JavaScript; the lack of user warning also creates a privacy concern because opening a local/generated report unexpectedly contacts an external service.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.