T01 · Skill Instruction Hijacking
Error
- Location
scripts/fetch_explosive_covers.py:337- Finding
Forced Commercial Message Injection and Machine-Readable Output Corruption
- Content
View full analysis
- Remediation
View remediation
Security audit
公众号封面图制作
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with WeChat cover analysis, but it contains unsafe command/report-generation instructions and unsolicited runtime output that users should review before installing.
Install only if you trust RedFox with your API key and keyword queries. Use an isolated environment, avoid sensitive client topics or private reference images, sanitize keywords before running commands, and review generated HTML instead of automatically opening it until the template is fixed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:65- Finding
Shell Command Injection Through Unsanitized Keyword Interpolation
- Content
View full analysis
``` ```bash cp references/report_template.html ./popular-cover-analysis-report_{keyword}.html open ./popular-cover-analysis-report_{keyword}.html ``` The command structure above is an English rendering of the original filename and placeholder text. The commands interpolate a user-derived keyword into both a shell argument and a filesystem path. ### Technical Analysis The Skill instructs the Agent to insert keywords derived from user input directly into shell commands and report filenames. It does not require shell quoting, filename normalization, rejection of metacharacters, or an argument-array execution API. The documented restrictions only limit the number and total length of keywords. They do not reject characters with shell semantics, such as command separators, command substitutions, redirection operators, wildcards, quotes, or path separators. If an Agent executes the documented commands through a shell, a crafted keyword can alter the command structure. A keyword beginning with an option prefix can also affect argument parsing. When used in the output filename, path separators or traversal sequences can redirect the copy operation outside the intended working directory. ### Attack Path 1. An attacker submits a cover-design keyword containing shell syntax, such as a command separator followed by another command. 2. The Agent extracts the value as the workflow keyword. 3. The Agent substitutes it into the command template from `SKILL.md`. 4. The command is executed through a shell. 5. The shell interprets the injected syntax rather than treating the entire keyword as data. 6. The injected command executes with the same operating-system permissions as the Agent. A secondary ...[truncated 989 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/report_template.html:51- Finding
Stored Script Injection and Unsafe URL Schemes in Generated HTML Reports
- Content
View full analysis
'; ``` ```javascript html += '
'; html += '
'; html += ''; ``` ```javascript document.getElementById('app').innerHTML = html; function esc(s) { if (!s) return ''; return String(s) .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"'); } ``` Visible labels in the snippets have been translated into English; the executable logic is unchanged. ### Technical Analysis The report-generation workflow replaces the JavaScript object assigned to `__REPORT_DATA__` with data derived from user input, AI-generated analysis, and an external API response. There are two related injection risks: 1. **Script-element termination during JSON injection** JSON string escaping does not inherently neutralize the HTML sequence that closes a script element. If an injected value contains a script-closing sequence, the HTML parser can terminate the existing script before JavaScript parsing occurs. Additional attacker-controlled markup can then be interpreted as executable HTML or JavaScript. The later `esc()` call does not mitigate this path because it runs only after the browser has already parsed the containing script element. 2. **Unsafe URL schemes** The ...[truncated 2213 chars]- Remediation
View remediation
``` 3. When serializing into HTML, escape at least `<`, `>`, `&`, U+2028, and U+2029 so a value cannot terminate its container. 4. Parse the data with `JSON.parse(document.getElementById("report-data").textContent)`. 5. Replace string-based HTML assembly and `innerHTML` with DOM construction using `createElement`, `textContent`, and validated attribute assignments. 6. Parse every external URL with the `URL` API. 7. Allow only `https:` URLs and, where feasible, restrict image and article links to explicitly approved hosts. 8. Reject active schemes, protocol-relative URLs, malformed URLs, embedded credentials, and unexpected local-file URLs. 9. Add `rel="noopener noreferrer"` to every link using `target="_blank"`. 10. Add a restrictive Content Security Policy that blocks inline scripts and limits image and navigation destinations. 11. Add security tests containing script-closing sequences, markup payloads, malformed URLs, and active URL schemes. ]]>
T08 · Insecure Dependencies
Note
- Location
SKILL.md:53- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (18)
Tainted flow: 'headers' from os.getenv (line 88, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python print(f"[DEBUG] Body: {json_body}", file=sys.stderr) try: response = requests.post(base_url, json=json_body, headers=headers, timeout=30) if debug: print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The documented purpose emphasizes AI cover design and visual analysis, but the actual behavior centers on querying a third-party API, processing returned URLs, opening generated HTML, and relying on capabilities not transparently disclosed in the high-level description. This mismatch undermines informed consent and security review because operators may enable the skill expecting local creative assistance while it actually performs external data access and local file/browser actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README says users can 'Simply describe your niche, content topic, or cover needs in natural language — no commands to memorize,' which does not define clear activation boundaries or exclusions. This broad phrasing increases the chance of unintended invocation from ordinary design-related conversation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Phrases such as 'Design a beauty tutorial cover for me' and 'Choose proposal 1' are generic conversational language that could easily appear outside an intentional skill invocation context. The documentation does not provide disambiguation rules, required context, or exclusion conditions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly supports uploading reference images but does not warn users how those images will be stored, transmitted, retained, or shared with external services. This creates privacy and data-handling risk, especially if users upload personal, copyrighted, or sensitive images under the assumption they are only used transiently for generation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states users can 'directly use natural language' and 'do not need to remember fixed commands,' which makes the trigger scope unclear and potentially overlaps with ordinary conversation. The file does not provide explicit boundaries, exclusion conditions, or a constrained trigger list to distinguish when the skill should activate versus when it should not.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill requires access to environment secrets, network access, and file writing, yet declares no explicit tool scope or permissions boundaries. This creates an overbroad execution surface where a host agent may grant more capability than users expect, increasing the risk of unintended secret access, external data exfiltration, or filesystem modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs use of a script that sends user-supplied keywords to an external API endpoint, but it does not disclose that those inputs leave the local environment or describe any privacy/security implications. In a content-analysis skill, users may provide sensitive campaign topics, client names, or unpublished article ideas, so silent transmission to a third party creates a real data exposure risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The HTML declares
lang="zh-CN"and the visible report title/content are hard-coded in Chinese, which imposes a specific language/locale on users. Under the policy, this is a natural-language locale constraint unless the skill offers opt-in or clearly documents that it is region-specific, which this file does not.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents all operational instructions in Chinese only and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs the agent to write a local HTML file and automatically open it in the user’s browser without any warning or consent flow. That creates observable side effects on the filesystem and desktop environment, and because the report embeds JSON-derived content into an HTML template, auto-opening increases the blast radius if untrusted data is ever rendered unsafely in the template.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python print(f"[DEBUG] Body: {json_body}", file=sys.stderr) try: response = requests.post(base_url, json=json_body, headers=headers, timeout=30) if debug: print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a tool for generating公众号封面设计方案、封面生图 and analyzing high-conversion visual rules. In this file, the implemented behavior is limited to querying a remote hot-article API, deduplicating returned articles/topics, and exposing cover image URLs; there is no image generation, cover design synthesis, or visual-rule analysis logic here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction '统一使用"爆款封面"，禁止使用...' imposes a fixed language/wording policy in natural language. This is a locale/language-style constraint presented as mandatory, and the file does not indicate user opt-in or a justified regional compliance requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The instructions require the agent to always call the script, wait for completion, and present the full dataset without skipping or asking the user, removing user choice and preventing privacy-preserving confirmation before a network action. In this skill context, that makes unintended external disclosure of user interests or sensitive keywords more likely, though the impact is primarily workflow/privacy related rather than direct code execution.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a tool for generating公众号封面 analysis/design outputs, but this template documentation additionally tells the agent to run
open ./爆款封面分析报告_{关键词}.htmlto launch a browser. Automatically invoking a local GUI application is not necessary to the core analytical/design function and represents an extra capability beyond producing the report itself.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module docstring and CLI description frame the script as '公众号爆款封面数据查询', implying cover-oriented retrieval. However, the main output generated by format_output is a markdown/text table of article metadata such as title, author, 阅读数 and 在看数, with cover URLs only printed secondarily to stderr in limited cases.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code presents user-facing descriptions, help text, status messages, and final output in Chinese throughout the script. Because the file does not offer a user language/locale option or explain that the tool is intentionally limited to a Chinese-speaking context, it violates the language-choice policy for natural-language behavior.
- Content