Security audit

公众号10w+阅读文章推荐

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its WeChat article-reporting purpose, but one API reference expands credential access to shell profile files, which is unnecessary and under-scoped.

Review before installing. Use a dedicated Redfox API key through the platform or environment variable only, do not let the skill or agent inspect shell startup files for secrets, and confirm any subscription or report-generation action before it runs. Treat generated HTML reports as content from an external data source.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation clearly directs use of environment variables, local file I/O, and outbound network access, yet it declares no permissions or capability boundaries. This is dangerous because users and host platforms cannot accurately assess or constrain what the skill will access, increasing the chance of overprivileged execution and unnoticed data flow to external services.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The documentation explicitly instructs the skill to fall back to reading API credentials from users' shell profile files such as ~/.zshrc or ~/.bash_profile when the environment variable is unset. This expands the skill's access from a scoped runtime secret to arbitrary local credential files, creating a credential-harvesting path and violating least-privilege expectations for a content-fetching skill.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README says users can 'directly use natural language to express your needs' without defining explicit activation boundaries, permitted actions, or confirmation requirements for side-effecting operations like subscription setup and page/export generation. Overly broad activation increases the chance the agent will act on ambiguous prompts or infer actions the user did not clearly authorize, which can lead to unintended data retrieval, subscriptions, or output generation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs users to place an API key in shell environment or local config without any guidance on credential sensitivity, scoping, rotation, redaction, or avoiding accidental exposure. This raises the risk of secrets being leaked through logs, screenshots, shared config files, shell history, or overly broad reuse across unrelated tools.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes accessing an API key from environment variables or, failing that, shell startup files, but provides no user-facing warning or consent flow for accessing local credential material. In this skill context, which only retrieves popular WeChat article data, such credential access is unnecessary and disproportionately risky.

Static analysis

No suspicious patterns detected.