公众号封面图制作

• Outcome: Pass
• Latest audit: Jul 28, 2026 · 1:07 PM UTC
• Version: 1.0.5

Overview

This skill is purpose-aligned for WeChat cover analysis, but it does send keywords to RedFox and creates a local HTML report.

Install only if you are comfortable using a RedFox API key and sending cover-topic keywords to redfox.hk. Treat generated HTML reports as local artifacts, avoid using sensitive unpublished topics as keywords, and ask the agent not to auto-open reports if you want to inspect the file path first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to access an environment API key, call an external network service, and write local files, but it does not declare these capabilities or permissions. Hidden or undeclared capability use weakens user oversight and sandbox policy enforcement, especially because the workflow includes exfiltration-relevant operations such as sending user-derived queries to a third-party API and persisting outputs to disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The stated purpose is cover-design analysis, but the workflow also performs third-party API retrieval, outputs ranked article metadata and topic intelligence, writes files, and includes commercial/upsell behavior not clearly reflected in the description. This mismatch impairs informed consent and can cause the agent to perform broader data handling and external communication than a user would reasonably expect from the declared skill description.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README says the skill can be invoked with unrestricted natural language and '无需记忆固定命令', but it does not define clear activation boundaries or scoping. In an agent environment, this increases the chance the skill is triggered unintentionally by ordinary conversation or adversarial prompt content, causing unwanted external data access or image-generation actions.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The skill is designed to trigger on common cover-design requests and broad topic descriptions, which increases the chance of accidental activation. Over-broad triggering is risky because this skill initiates network access, image URL fetching, and local report generation, so a user may invoke side-effecting behavior without clearly intending it.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation table maps generic inputs directly to execution and does not clearly distinguish analysis-only conversations from tasks that should cause network calls and file writes. In context, that ambiguity makes unintended external requests and artifact creation more likely, even though the underlying business logic appears non-malicious.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The template explicitly instructs the agent to write a generated HTML report into the current working directory without any user confirmation or warning. Unprompted filesystem modification is risky because it can create persistent artifacts, overwrite existing files with matching names, and exceed user expectations about what the skill is allowed to do.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions tell the agent to automatically open the generated HTML report in a browser after writing it. Automatically launching local HTML increases risk because it triggers execution/rendering of embedded client-side content without an explicit user action, which is especially relevant here since the report is JS-rendered and populated with injected JSON-derived data.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.