公众号内容工坊

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 9:13 AM UTC
• Version: 1.0.0

Overview

This is a disclosed RedFox-backed WeChat content and analytics skill, with expected network/API use but some privacy and API-key handling precautions users should understand.

Install only if you are comfortable using RedFox as the backend service. Use a revocable REDFOX_API_KEY, avoid submitting confidential drafts or private local files for checking, and do not run debug mode because one script can print the full API key in logs. Expect local JSON, HTML, and text report files to be created during normal use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (120)

Tainted flow: 'headers' from os.getenv (line 96, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

last_error = None
    for attempt in range(max_retries + 1):
        try:
            response = requests.post(API_URL, headers=headers, json=payload, timeout=30)

            if response.status_code >= 500 and attempt < max_retries:
                import time

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.getenv (line 88, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"[DEBUG] Body: {json_body}", file=sys.stderr)

    try:
        response = requests.post(base_url, json=json_body, headers=headers, timeout=30)

        if debug:
            print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 109, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"Params: {json.dumps(params, ensure_ascii=False)}", file=sys.stderr)

    try:
        response = requests.post(base_url, headers=headers, json=params, timeout=60)

        if debug:
            print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 63, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"Headers: {headers}", file=sys.stderr)

            # 发送请求
            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个多功能的公众号内容创作与运营分析聚合技能，但所给代码块的实际职责非常单一，只是“公众号违禁词检测工具”。它会读取环境变量或Shell配置中的API Key，支持从文本、文件、URL提取内容，并将内容发送到 redfox.hk 的 sensitiveWordSearch 接口进行检测，最后整理违禁词结果与高亮HTML返回。虽然违禁词检测属于声明功能之一，但代码没有体现其他核心宣称能力，因此描述明显夸大了该代码块的实际覆盖范围。另有从网页和文件提取文本的辅助能力，这属于为检测服务的实现细节，不是主要问题；真正的失配在于声明的主功能集合与代码实际功能严重不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个多能力聚合型技能，但提供的代码仅实现了“公众号爆款/封面数据查询”相关功能。它会访问红狐 hotArticleNew 接口，返回 articles、latestHotArticles、hotTopics、relatedSearches，并支持提取已有文章的封面链接与格式化榜单输出。这与声明中的“10w+爆文榜单”部分基本一致，也可部分支撑“查爆文/找封面灵感”的场景；但代码并未实现文章创作、标题生成或评分、文案改写与记录上报、违禁词检测、封面生成设计、账号诊断等核心宣称能力。因此描述显著夸大了能力范围，属于描述与实际行为不符。另有一个轻微未声明行为是脚本在输出中附带商业采购联系方式，但这不是主要能力。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个聚合型全链路公众号创作与运营技能，但提供的代码块只实现了其中很小的一部分：10w+ / 爆款文章数据查询与展示。代码没有任何文本生成、标题评分、改写、上报、违禁词检测、封面设计或账号诊断逻辑，也未访问与这些功能对应的资源或接口。就本代码块而言，其实际主功能明显窄于声明范围，因此描述不能准确代表该代码实际行为。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个覆盖公众号创作、改写、检测、设计、诊断等完整链路的聚合技能；但提供的代码片段功能范围明显更窄，核心只是在调用外部API获取“10w+热门文章榜单”，排序后展示，并基于标题/摘要做启发式内容分析。代码中没有任何与正文生成、标题生成或评分、改写、违禁词检测、封面设计、账号诊断相关的实现，因此描述显著夸大了能力范围。虽然“查10w+爆文”这一部分与代码相符，但不足以覆盖声明中的主要多功能定位，构成明显描述与行为不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个聚合型全功能公众号创作/运营技能，但此代码块的实际功能非常单一：它只做外部API查询与结果格式化，用于获取公众号爆款文章/标题相关榜单数据。代码中没有任何文本生成、标题评分算法、改写、违禁词检测、封面设计、账号诊断等实现，也没有改写记录上报逻辑。虽然“查爆文榜单”与声明中的部分能力相符，但声明的主要能力范围远大于代码实际行为，且榜单口径也有偏差：主输出是1w+阅读榜和原创榜，不是声明强调的10w+爆文榜单。因此描述不能准确代表该代码块的实际行为。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The code chunk’s actual function is narrow: it formats provided article records into an HTML page that displays ranked hot articles and allows exporting the rendered page to PDF. It computes only simple presentation stats such as unique account count and date span. This is consistent with one small part of the declared skill—showing 10w+ hot-article rankings—but not with the much broader declared end-to-end公众号创作与运营 suite. Because the declared description prominently claims multiple major capabilities that are absent from the code, the description does not accurately represent what this supplied code chunk actually does. No suspicious undeclared exfiltration or unrelated external access is present beyond loading a public html2pdf JS library in the generated page.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 该声明描述的是一个功能很广的公众号内容创作与运营聚合技能，但当前提供的代码片段只是一个‘公众号文案改写辅助脚本’。它会读取本地 markdown 规则文件中的“公众号”章节并打印出来，或在提供任意文本参数时向远程接口上报一次改写记录。代码没有实现实际的文案改写逻辑，也没有实现榜单、标题、评分、封面、违禁词检测或账号诊断等能力。虽然声明中提到“改写记录自动上报”，这部分与代码部分吻合，但整体描述远超出代码实际行为。另一个明显偏差是代码存在对外网络访问与 API Key 使用，而声明 permissions 为空，未反映这一资源访问行为。因此该描述不能准确代表该代码片段的实际功能。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents an all-in-one公众号 content creation and operations suite spanning both creative-generation functions and operational analysis. However, this code chunk is narrowly focused on公众号账号诊断/分析: it queries account data from Redfox APIs, computes engagement/content/operations scores, writes raw_data.json and report_data.json, and generates HTML diagnosis/comparison reports. The only declared capability clearly supported here is account diagnosis/operations analysis. The many creative and moderation/design features in the description—article writing, title generation/scoring, rewriting and reporting, banned-word detection, cover design, and爆文榜单 retrieval—are absent from the supplied code. Therefore the description materially overstates the implemented behavior, and the code’s primary purpose is a subset (account analysis/reporting) rather than the full declared skill.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The capability summary states that copy rewriting includes “自动上报改写记录”, which implies transmitting user-provided content to a backend service. Although the behavior is mentioned elsewhere as a backend action, the documentation does not present a clear warning about privacy/data transmission risk or advise users not to submit sensitive content.

Ae1

High

• Category: analysis-evasion

Content

| "10w+ 爆文"、"公众号爆文榜单"、"今日爆文"、"科技数码赛道爆文" | **M1 10w+ 爆文榜单** | `references/m1_category_mapping.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "10w+ 爆文"、"公众号爆文榜单"、"今日爆文"、"科技数码赛道爆文" | **M1 10w+ 爆文榜单** | `references/m1_category_mapping.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "改写成公众号风格"、"这篇文案帮我公众号化" | **M4 文案改写** | `assets/m4_platform_rules.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "改写成公众号风格"、"这篇文案帮我公众号化" | **M4 文案改写** | `assets/m4_platform_rules.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "有没有违禁词"、"检测敏感词"、"公众号合规"、"限流词" | **M5 违禁词检测** | `references/m5_prohibited_word_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "有没有违禁词"、"检测敏感词"、"公众号合规"、"限流词" | **M5 违禁词检测** | `references/m5_prohibited_word_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "设计公众号封面"、"做个推文封面"、"美妆/财经封面" | **M6 封面设计** | `references/m6_report_template.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "设计公众号封面"、"做个推文封面"、"美妆/财经封面" | **M6 封面设计** | `references/m6_report_template.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "诊断 XX 公众号"、"分析 XX 账号"、"对比诊断 A 和 B" | **M7 账号诊断** | `references/m7_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| "诊断 XX 公众号"、"分析 XX 账号"、"对比诊断 A 和 B" | **M7 账号诊断** | `references/m7_core_workflow.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python scripts/fetch_hot_articles.py \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python scripts/fetch_hot_articles.py \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Static analysis

No suspicious patterns detected.