公众号封面图制作

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:20 AM UTC
• Version: 1.0.5

Overview

The skill is mostly aligned with WeChat cover analysis, but it contains unsafe command/report-generation instructions and unsolicited runtime output that users should review before installing.

Install only if you trust RedFox with your API key and keyword queries. Use an isolated environment, avoid sensitive client topics or private reference images, sanitize keywords before running commands, and review generated HTML instead of automatically opening it until the template is fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/fetch_explosive_covers.py:337
• Finding: Forced Commercial Message Injection and Machine-Readable Output Corruption<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_explosive_covers.py:337` **Vulnerability Type**: Forced output injection **Risk Level**: High ### Vulnerable Code ```python print( "\nRedFox also offers a complete commercial database. " "For purchasing information, contact [e-mail]." ) ``` The displayed snippet is an English translation of the unconditional promotional message at line 337. ### Technical Analysis The script unconditionally appends a commercial database advertisement and external contact address after every successful invocation. This message is unrelated to the Skill's declared cover-analysis functionality and is not required to retrieve or process cover data. The default output format is JSON. Because the promotional message is printed to standard output after the JSON document, the resulting stream is no longer valid JSON. Any Agent or downstream program that attempts to parse the entire output with a JSON parser may fail, process incomplete data, or inadvertently relay the promotional content to the user. This is classified as instruction hijacking because the Skill package causes unrelated commercial content to be inserted into the Agent's normal task output. ### Attack Path 1. A user asks the Agent to analyze popular WeChat covers. 2. The Agent follows `SKILL.md` and invokes `fetch_explosive_covers.py`. 3. The script retrieves and prints the requested data. 4. The script unconditionally appends the unrelated promotional message. 5. The JSON response becomes invalid, or the Agent relays the commercial solicitation as part of its answer. 6. The user is redirected toward an external commercial contact that is outside the declared task. ### Impact Assessment No additional operating-system privileges are obtained. The impact is limited to output integrity, workflow reliability, and user trust: - Corruption of machine-readable JSON output. - Failure of downstream report-generation or parsing logi ...[truncated 139 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotional `print` statement. 2. Keep standard output exclusively reserved for the selected output format. 3. Send operational diagnostics to standard error, but do not place advertising in either output stream. 4. If commercial information must be disclosed, place it transparently in the README rather than runtime output. 5. Add an automated test that invokes the default JSON mode and verifies that the entire standard-output stream can be parsed as exactly one JSON document. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:65
• Finding: Shell Command Injection Through Unsanitized Keyword Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:65, 114-118` **Vulnerability Type**: Shell command and argument injection **Risk Level**: High ### Vulnerable Instructions ```bash python3 scripts/fetch_explosive_covers.py --keyword <keyword1,keyword2,keyword3> ``` ```bash cp references/report_template.html ./popular-cover-analysis-report_{keyword}.html open ./popular-cover-analysis-report_{keyword}.html ``` The command structure above is an English rendering of the original filename and placeholder text. The commands interpolate a user-derived keyword into both a shell argument and a filesystem path. ### Technical Analysis The Skill instructs the Agent to insert keywords derived from user input directly into shell commands and report filenames. It does not require shell quoting, filename normalization, rejection of metacharacters, or an argument-array execution API. The documented restrictions only limit the number and total length of keywords. They do not reject characters with shell semantics, such as command separators, command substitutions, redirection operators, wildcards, quotes, or path separators. If an Agent executes the documented commands through a shell, a crafted keyword can alter the command structure. A keyword beginning with an option prefix can also affect argument parsing. When used in the output filename, path separators or traversal sequences can redirect the copy operation outside the intended working directory. ### Attack Path 1. An attacker submits a cover-design keyword containing shell syntax, such as a command separator followed by another command. 2. The Agent extracts the value as the workflow keyword. 3. The Agent substitutes it into the command template from `SKILL.md`. 4. The command is executed through a shell. 5. The shell interprets the injected syntax rather than treating the entire keyword as data. 6. The injected command executes with the same operating-system permissions as the Agent. A secondary ...[truncated 989 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings from user-controlled values. 2. Invoke Python with an argument array, for example: ```python subprocess.run( ["python3", "scripts/fetch_explosive_covers.py", "--keyword", keyword], check=True, shell=False, ) ``` 3. Validate keywords against a conservative allowlist appropriate for expected natural-language terms. 4. Generate the report filename from a separate sanitized slug rather than the raw keyword. 5. Remove path separators, traversal components, control characters, shell metacharacters, and leading option prefixes from filenames. 6. Resolve the output path and verify that it remains inside an explicitly approved output directory. 7. Use filesystem APIs such as `shutil.copyfile` rather than constructing `cp` commands. 8. Open the resulting absolute path through a platform API or argument-array process invocation with `shell=False`. 9. Add tests using keywords containing separators, substitutions, quotes, option prefixes, and traversal sequences. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/report_template.html:51
• Finding: Stored Script Injection and Unsafe URL Schemes in Generated HTML Reports<![CDATA[ ## Vulnerability Details **File Location**: `references/report_template.html:51-57, 83, 105-107, 139` **Vulnerability Type**: Stored script injection and unsafe link construction **Risk Level**: High ### Vulnerable Code ```javascript var __REPORT_DATA__ = { "keyword": "", "analysisCount": 0, "styles": [], "plans": [] }; ``` ```javascript var url = esc(s.covers[j]); html += '<a href="' + url + '" target="_blank"><img src="' + url + '" alt="cover example"></a>'; ``` ```javascript html += '<a href="' + esc(p.case.imageUrl) + '" target="_blank" class="cover-wrap"><img src="' + esc(p.case.imageUrl) + '" alt="cover image"></a>'; html += '<div class="info">'; html += '<div class="title"><a href="' + esc(p.case.url) + '" target="_blank">' + esc(p.case.title) + '</a></div>'; ``` ```javascript document.getElementById('app').innerHTML = html; function esc(s) { if (!s) return ''; return String(s) .replace(/&/g, '&amp;') .replace(/</g, '&lt;') .replace(/>/g, '&gt;') .replace(/"/g, '&quot;'); } ``` Visible labels in the snippets have been translated into English; the executable logic is unchanged. ### Technical Analysis The report-generation workflow replaces the JavaScript object assigned to `__REPORT_DATA__` with data derived from user input, AI-generated analysis, and an external API response. There are two related injection risks: 1. **Script-element termination during JSON injection** JSON string escaping does not inherently neutralize the HTML sequence that closes a script element. If an injected value contains a script-closing sequence, the HTML parser can terminate the existing script before JavaScript parsing occurs. Additional attacker-controlled markup can then be interpreted as executable HTML or JavaScript. The later `esc()` call does not mitigate this path because it runs only after the browser has already parsed the containing script element. 2. **Unsafe URL schemes** The ...[truncated 2213 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not embed untrusted JSON directly in an executable script assignment. 2. Store report data in a non-executable element: ```html <script id="report-data" type="application/json"></script> ``` 3. When serializing into HTML, escape at least `<`, `>`, `&`, U+2028, and U+2029 so a value cannot terminate its container. 4. Parse the data with `JSON.parse(document.getElementById("report-data").textContent)`. 5. Replace string-based HTML assembly and `innerHTML` with DOM construction using `createElement`, `textContent`, and validated attribute assignments. 6. Parse every external URL with the `URL` API. 7. Allow only `https:` URLs and, where feasible, restrict image and article links to explicitly approved hosts. 8. Reject active schemes, protocol-relative URLs, malformed URLs, embedded credentials, and unexpected local-file URLs. 9. Add `rel="noopener noreferrer"` to every link using `target="_blank"`. 10. Add a restrictive Content Security Policy that blocks inline scripts and limits image and navigation destinations. 11. Add security tests containing script-closing sequences, markup payloads, malformed URLs, and active URL schemes. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:53
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:53` **Vulnerability Type**: Uncontrolled dependency resolution **Risk Level**: Low ### Vulnerable Instruction ```text Dependency: requests (pip install requests) ``` ### Technical Analysis The setup instructions install `requests` without a version constraint, lock file, integrity hash, or explicitly controlled package index. The resolved artifact can therefore change over time. No evidence was found that the named `requests` package is malicious. The risk is that future installation behavior is mutable and not reproducible. A compromised package-index account, index substitution, or unexpectedly incompatible release could introduce code that runs during installation or when imported by the Skill. ### Attack Path 1. A user follows the Skill's installation instructions. 2. `pip` queries its configured package index and resolves the current release of `requests` and its transitive dependencies. 3. A compromised, substituted, or incompatible artifact is downloaded because no reviewed version or hash is required. 4. Package code executes during installation or later when the script imports `requests`. 5. The dependency code runs with the permissions of the user operating the Agent. ### Impact Assessment The potential impact is bounded by the privileges of the environment running `pip` and the Skill. A compromised dependency could theoretically: - Read files and environment variables accessible to the Agent. - Access `REDFOX_API_KEY`. - Modify the Python environment. - Make unauthorized network requests. - Alter or intercept API behavior. This is a supply-chain hardening issue; the audit found no evidence that dependency compromise has already occurred. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin a reviewed `requests` version and all transitive dependencies. 2. Provide a lock file generated from a reviewed dependency set. 3. Require package hashes during installation, such as with `pip install --require-hashes`. 4. Document the trusted package index explicitly and use TLS certificate validation. 5. Regularly scan the locked dependencies for known vulnerabilities. 6. Test dependency upgrades before changing the lock file. 7. Prefer an isolated virtual environment with only the permissions required to run the Skill. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (18)

Tainted flow: 'headers' from os.getenv (line 88, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"[DEBUG] Body: {json_body}", file=sys.stderr)

    try:
        response = requests.post(base_url, json=json_body, headers=headers, timeout=30)

        if debug:
            print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented purpose emphasizes AI cover design and visual analysis, but the actual behavior centers on querying a third-party API, processing returned URLs, opening generated HTML, and relying on capabilities not transparently disclosed in the high-level description. This mismatch undermines informed consent and security review because operators may enable the skill expecting local creative assistance while it actually performs external data access and local file/browser actions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README says users can 'Simply describe your niche, content topic, or cover needs in natural language — no commands to memorize,' which does not define clear activation boundaries or exclusions. This broad phrasing increases the chance of unintended invocation from ordinary design-related conversation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Phrases such as 'Design a beauty tutorial cover for me' and 'Choose proposal 1' are generic conversational language that could easily appear outside an intentional skill invocation context. The documentation does not provide disambiguation rules, required context, or exclusion conditions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports uploading reference images but does not warn users how those images will be stored, transmitted, retained, or shared with external services. This creates privacy and data-handling risk, especially if users upload personal, copyrighted, or sensitive images under the assumption they are only used transiently for generation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README states users can 'directly use natural language' and 'do not need to remember fixed commands,' which makes the trigger scope unclear and potentially overlaps with ordinary conversation. The file does not provide explicit boundaries, exclusion conditions, or a constrained trigger list to distinguish when the skill should activate versus when it should not.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requires access to environment secrets, network access, and file writing, yet declares no explicit tool scope or permissions boundaries. This creates an overbroad execution surface where a host agent may grant more capability than users expect, increasing the risk of unintended secret access, external data exfiltration, or filesystem modification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs use of a script that sends user-supplied keywords to an external API endpoint, but it does not disclose that those inputs leave the local environment or describe any privacy/security implications. In a content-analysis skill, users may provide sensitive campaign topics, client names, or unpublished article ideas, so silent transmission to a third party creates a real data exposure risk.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The HTML declares `lang="zh-CN"` and the visible report title/content are hard-coded in Chinese, which imposes a specific language/locale on users. Under the policy, this is a natural-language locale constraint unless the skill offers opt-in or clearly documents that it is region-specific, which this file does not.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file presents all operational instructions in Chinese only and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs the agent to write a local HTML file and automatically open it in the user’s browser without any warning or consent flow. That creates observable side effects on the filesystem and desktop environment, and because the report embeds JSON-derived content into an HTML template, auto-opening increases the blast radius if untrusted data is ever rendered unsafely in the template.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"[DEBUG] Body: {json_body}", file=sys.stderr)

    try:
        response = requests.post(base_url, json=json_body, headers=headers, timeout=30)

        if debug:
            print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a tool for generating公众号封面设计方案、封面生图 and analyzing high-conversion visual rules. In this file, the implemented behavior is limited to querying a remote hot-article API, deduplicating returned articles/topics, and exposing cover image URLs; there is no image generation, cover design synthesis, or visual-rule analysis logic here.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The instruction '统一使用"爆款封面"，禁止使用...' imposes a fixed language/wording policy in natural language. This is a locale/language-style constraint presented as mandatory, and the file does not indicate user opt-in or a justified regional compliance requirement.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The instructions require the agent to always call the script, wait for completion, and present the full dataset without skipping or asking the user, removing user choice and preventing privacy-preserving confirmation before a network action. In this skill context, that makes unintended external disclosure of user interests or sensitive keywords more likely, though the impact is primarily workflow/privacy related rather than direct code execution.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The manifest describes a tool for generating公众号封面 analysis/design outputs, but this template documentation additionally tells the agent to run `open ./爆款封面分析报告_{关键词}.html` to launch a browser. Automatically invoking a local GUI application is not necessary to the core analytical/design function and represents an extra capability beyond producing the report itself.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The module docstring and CLI description frame the script as '公众号爆款封面数据查询', implying cover-oriented retrieval. However, the main output generated by format_output is a markdown/text table of article metadata such as title, author, 阅读数 and 在看数, with cover URLs only printed secondarily to stderr in limited cases.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This code presents user-facing descriptions, help text, status messages, and final output in Chinese throughout the script. Because the file does not offer a user language/locale option or explain that the tool is intentionally limited to a Chinese-speaking context, it violates the language-choice policy for natural-language behavior.

Static analysis

No suspicious patterns detected.