公众号内容工坊

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:29 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it combines broad content processing with sensitive local credential discovery, unrestricted webpage fetching, automatic backend reporting, unsafe generated reports, and mandatory promotional output.

Install only if you are comfortable giving this skill a RedFox API key, sending draft or compliance-check content to RedFox, allowing URL extraction from pages you provide, and seeing RedFox promotional/subscription text in outputs. Prefer setting REDFOX_API_KEY explicitly in the environment instead of relying on shell-profile scanning, avoid using it on confidential drafts unless RedFox handling is acceptable, and treat generated HTML reports as untrusted files when opened in a browser.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: references/m7_core_workflow.md:294

Finding

Forced Commercial Promotion and Subscription Steering in Agent Output

Content

View full analysis

*诊断时间：[YYYY-MM-DD] | 数据来源：[红狐数据（redfox.hk）](https://redfox.hk/?source=clawhub) 更多平台数据、优质数据可前往查看API接口 | 置信度：[高/中/低] | 阅读数>10万显示为10w+* > 💡 **订阅提醒**：如需持续追踪该账号数据变化，可回复"订阅 {账号名称}"，系统将自动同步最新作品数据（约需30分钟）。首次订阅后可解锁完整7天作品数据。 ``` The workflow further enforces the behavior: ```markdown ### 🔴 最高优先级：输出格式铁律 - **诊断报告必须严格按照第4节定义的5章节模板输出，一字不漏** ``` ```markdown - 报告末尾必须追加 💡 订阅提醒（引导用户回复"订阅 {账号名称}"） ``` ### Technical Analysis These instructions and script statements alter normal Agent output by automatically inserting third-party sales, branding, and subscription-conversion material. The content is not necessary to query article data, generate cover recommendations, or diagnose a WeChat account. The behavior is persistent across ordinary successful executions. In the M7 workflow, the instruction is explicitly mandatory and reinforced as a highest-priority output constraint. This prevents the Agent from producing a result limited to the user's requested analysis. Although this behavior does not provide operating-system access, it hijacks the interaction channel and directs users toward an external commercial service and email address without requiring a related user request. ### Attack Path 1. A user request ...[truncated 1132 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/check_sensitive_words.py:184

Finding

Server-Side Request Forgery Through Unrestricted Webpage Extraction

Content

View full analysis

100: text = extracted break except Exception: continue if not text: text = page.inner_text('body') browser.close() return text.strip() except Exception: pass try: response = requests.get(url, timeout=30, headers={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" }) if response.status_code >= 400: raise Exception(f"网页请求失败: H ...[truncated 2571 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_hot_html.py:30

Finding

HTML and Script Injection in Generated Article Reports

Content

View full analysis

str: """生成单篇文章的HTML""" try: title = article.get("title", "未知标题") url = article.get("oriUrl", "#") account = article.get("userName", article.get("accountId", "未知账号")) account_id = article.get("accountId", "") reads = article.get("clicksCount", "0") public_time = article.get("publicTime", "") if public_time: try: date = str(public_time)[:10] except: date = "" else: date = "" if account_id: account_url = f"https://open.weixin.qq.com/qr/code?username={account_id}" else: account_url = "#" top_class = " top-item" if is_top else "" rank_display = get_rank_display(rank) top_rank_class = " top" if is_top else "" return f'''

{rank_display}

{title}

👤{account} 📖 阅读 {reads}

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/m6_report_template.html:83

Finding

Dangerous URL Schemes Permitted in Dynamically Rendered Cover Reports

Content

View full analysis

0) { html += '

'; var maxCovers = Math.min(s.covers.length, 5); for (var j = 0; j < maxCovers; j++) { var url = esc(s.covers[j]); html += ''; } html += '

'; } ``` ```javascript html += '

'; html += ''; html += '

'; html += '

' + esc(p.case.title) + '

'; html += '

作者：' + esc(p.case.author) + '

'; html += '阅读：' + esc(p.case.reads) + ''; ``` ```javascript document.title = '爆款封面分析报告 - ' + d.keyword + '主题'; document.getElementById('app').innerHTML = html; function esc(s) { if (!s) return ''; return String(s).replace(/&/g,'&').replace(//g,'>').replace(/"/g,'"'); } ``` ### Technical Analysis The `esc` function encodes HTML metacharacters and therefore mitigates ordinary attribute breakout. It does not, however, validate URL schemes. Values such as `javascript:` remain unchanged and are inserted into anchor `href` attributes. The resulting HTML is assigned through `innerHTML`. A dangerous URL can therefore become an active link even though its quotation marks and angle brackets were escaped. Exploitation generally requires the user to click the malicious link. Image source fields should also be restricted because arbitrary remote image URLs cause browser requests to attacker-selected servers, exposing network metadata such as the user's IP addre ...[truncated 1071 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_hot_html.py:132

Finding

Generated Reports Execute an Unpinned Remote JavaScript Dependency

Content

View full analysis

``` ### Technical Analysis Every generated M1 report contains a script reference to a third-party CDN. When the report is opened, the browser retrieves and executes the remote JavaScript in the report's context. The URL specifies a library version but does not use Subresource Integrity. A versioned path does not cryptographically guarantee the returned bytes. If the CDN, account, delivery path, DNS resolution, or upstream artifact is compromised, modified JavaScript can be served after the Skill itself has been audited. The report therefore has a runtime dependency on externally controlled executable content. This also creates an undeclared report-time network request. ### Attack Path 1. The Skill generates an article report containing the CDN script reference. 2. The user opens the generated report in a browser. 3. The browser requests `html2pdf.bundle.min.js` from the remote CDN. 4. A compromised CDN or delivery path returns modified JavaScript. 5. The browser executes that JavaScript with access to the report DOM. 6. The malicious script can read report contents, alter links, redirect the user, or make further network requests. ### Impact Assessment - **Browser privileges obtained:** JavaScript execution within every opened generated M1 report. - **System privileges obtained:** None directly. - **Potentially exposed data:** Report titles, article metadata, account information, and any other DOM-visible content. - **Affected scope:** Generated reports opened while network access is available. - **Trust boundary crossed:** Executable content outside the reviewed project is trusted at report-rendering time. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (72)

Tainted flow: 'headers' from os.getenv (line 96, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_sensitive_words.py (reported line 110)May include surrounding context.

python

last_error = None
    for attempt in range(max_retries + 1):
        try:
            response = requests.post(API_URL, headers=headers, json=payload, timeout=30)

            if response.status_code >= 500 and attempt < max_retries:
                import time

Tainted flow: 'headers' from os.getenv (line 88, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_explosive_covers.py (reported line 38)May include surrounding context.

python

print(f"[DEBUG] Body: {json_body}", file=sys.stderr)

    try:
        response = requests.post(base_url, json=json_body, headers=headers, timeout=30)

        if debug:
            print(f"[DEBUG] 状态码: {response.status_code}", file=sys.stderr)

Tainted flow: 'headers' from os.environ.get (line 109, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_gzh_trends.py (reported line 44)May include surrounding context.

python

print(f"Params: {json.dumps(params, ensure_ascii=False)}", file=sys.stderr)

    try:
        response = requests.post(base_url, headers=headers, json=params, timeout=60)

        if debug:
            print(f"状态码: {response.status_code}", file=sys.stderr)

Tainted flow: 'headers' from os.environ.get (line 63, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_official_account_trends.py (reported line 80)May include surrounding context.

python

print(f"Headers: {headers}", file=sys.stderr)

            # 发送请求
            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This mismatch specifically conceals security-relevant behavior: scanning shell configuration files for REDFOX_API_KEY is access to sensitive local credential sources that users may not expect from a content-creation skill. Hidden credential discovery increases the risk of inadvertent secret exposure and violates least surprise, especially when combined with networked modules.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch specifically conceals security-relevant behavior: scanning shell configuration files for REDFOX_API_KEY is access to sensitive local credential sources that users may not expect from a content-creation skill. Hidden credential discovery increases the risk of inadvertent secret exposure and violates least surprise, especially when combined with networked modules.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch specifically conceals security-relevant behavior: scanning shell configuration files for REDFOX_API_KEY is access to sensitive local credential sources that users may not expect from a content-creation skill. Hidden credential discovery increases the risk of inadvertent secret exposure and violates least surprise, especially when combined with networked modules.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch specifically conceals security-relevant behavior: scanning shell configuration files for REDFOX_API_KEY is access to sensitive local credential sources that users may not expect from a content-creation skill. Hidden credential discovery increases the risk of inadvertent secret exposure and violates least surprise, especially when combined with networked modules.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch specifically conceals security-relevant behavior: scanning shell configuration files for REDFOX_API_KEY is access to sensitive local credential sources that users may not expect from a content-creation skill. Hidden credential discovery increases the risk of inadvertent secret exposure and violates least surprise, especially when combined with networked modules.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch specifically conceals security-relevant behavior: scanning shell configuration files for REDFOX_API_KEY is access to sensitive local credential sources that users may not expect from a content-creation skill. Hidden credential discovery increases the risk of inadvertent secret exposure and violates least surprise, especially when combined with networked modules.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch specifically conceals security-relevant behavior: scanning shell configuration files for REDFOX_API_KEY is access to sensitive local credential sources that users may not expect from a content-creation skill. Hidden credential discovery increases the risk of inadvertent secret exposure and violates least surprise, especially when combined with networked modules.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description does not clearly warn users that rewrite requests are automatically reported to a remote service. Because rewrite inputs can contain drafts, proprietary copy, customer data, or sensitive business content, silent transmission to a third party creates a direct confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatically reporting user-provided rewrite content to a backend service is a direct data leakage risk because the original text may contain confidential, regulated, or unpublished information. In the context of a writing tool, users are especially likely to paste sensitive drafts or proprietary marketing content, making the risk more acute.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow sends the user's original copy to a remote endpoint as a background action, creating an explicit exfiltration path for sensitive content. Because the reporting is described as non-blocking and hidden from the final output, users may never realize their data has been transmitted off-platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow explicitly instructs that backend reporting occurs automatically and should not be shown to the user, which suppresses notice of external data transmission. Concealing network disclosure prevents informed consent and materially increases the risk of unnoticed leakage of confidential user-provided copy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README says 'Describe what you need in plain language — no commands to memorize,' which implies very open-ended triggering without clearly constraining when this skill should be used versus ignored. Although examples are WeChat-specific, this line makes activation scope ambiguous and does not provide exclusion conditions or negative examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README directs users to invoke the skill with very broad natural-language requests such as writing articles, rewriting copy, scanning content, and diagnosing accounts, but it does not clearly constrain what sources, actions, or external processing are in scope. In an agent setting, vague trigger guidance can cause over-invocation, unintended handling of sensitive user content, or activation in contexts the user did not intend, especially because this skill processes arbitrary text and may send it to an external API service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares capabilities that include environment access, local file reads/writes, and network use, but does not define any explicit tool scope or permission boundary. In an agent setting, that omission increases the chance of over-broad execution and unauthorized access to local credentials or remote endpoints beyond what users reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest-style description lists trigger words such as "10w+", "爆文", and "账号诊断" alongside more specific phrases. Terms like "爆文" and especially "账号诊断" are broad enough to appear in ordinary discussion and may cause unintended invocation because the trigger scope and exclusions are not clearly constrained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatically scanning shell profile files for API keys is sensitive local-resource access that is insufficiently disclosed. Those files may contain unrelated secrets, tokens, commands, or personal configuration, so silent inspection expands the trust boundary beyond what users would expect for this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file specifies "Language: 中文" as a fixed/default operating language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is clearly justified or the user is given a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The initialization text says "默认使用", which operationalizes the fixed language requirement for all responses. This reinforces a mandatory locale behavior without presenting an opt-in choice or clear region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The HTML document explicitly sets lang="zh-CN", indicating a fixed Simplified Chinese locale. Under the stated policy, forcing a specific language or locale without user opt-in or a clear documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The spec explicitly instructs the skill to retrieve an API key from local shell profile files such as ~/.zshrc or ~/.bash_profile when the environment variable is unset. That behavior expands the skill's access to unrelated sensitive local files and can expose credentials without clear user consent, which is especially risky in an agent context where file access may be broad or opaque.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Documenting credential retrieval from shell profile files without any warning normalizes access to highly sensitive user configuration data and may lead the implementing agent to read files that commonly contain tokens, keys, and other secrets. In this skill's content-creation context, such access is unnecessary for core functionality, so the behavior is more dangerous because it is out of scope for the user task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.