Security audit

公众号热门原创文章

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated article-ranking purpose, but it handles its API key and generated HTML reports in ways that need review before use.

Install only if you are comfortable giving this skill a RedFox API key and making network requests to redfox.hk. Before routine use, the publisher should restore normal TLS verification and escape or validate generated HTML fields. Treat generated reports as local artifacts that may persist, and confirm how any claimed daily subscription push is implemented and revoked.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script explicitly disables both certificate validation and hostname verification before sending an authenticated HTTPS request. This allows a man-in-the-middle attacker to intercept or tamper with responses and capture the X-API-KEY, which is especially dangerous because the skill depends on remote content returned from that API.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The README explicitly says users can invoke the skill with plain-language requests and 'no fixed commands,' which makes activation boundaries ambiguous. In an agent environment, this increases the chance the skill is selected for loosely related prompts, causing unintended external data access, unexpected subscriptions, or behavior overlap with other skills.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example trigger phrase 'viral recommendations' is generic and commonly used in everyday conversation, so it can accidentally match unrelated user requests. In a multi-skill agent, such broad phrasing can spur unintended routing to this skill, leading to irrelevant external queries or unsolicited workflow steps like subscription prompts.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The README instructs users to invoke the skill with unrestricted natural language, which broadens activation conditions and increases the chance the skill is triggered by ambiguous everyday requests. In a multi-skill agent environment, this can cause accidental routing and unintended access to external data retrieval or subscription actions without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example trigger phrases are very generic, such as asking for latest hot articles or recommendations, and may overlap with ordinary user requests unrelated to this specific skill. This raises the risk of false activation, causing the agent to invoke this skill when the user intended a broader news, content, or recommendation query.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrases include broad everyday terms such as '最近' and '最新', which can cause the skill to activate during unrelated conversation. Over-broad invocation can lead to unexpected network calls, file generation, or disclosure of externally sourced content when the user did not intend to use this skill.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill states that it will automatically generate an HTML page and write output files, but does not provide a clear warning or obtain user confirmation before local file creation. Silent file creation can surprise users, consume storage, and create residual artifacts containing fetched content or metadata on the host system.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The skill advertises daily subscription push behavior without documenting how consent, opt-out, notification frequency, or data delivery are handled. Users may be led to believe they are enrolling in an ongoing service without a clear lifecycle, which creates privacy, consent, and expectation-management risks.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The category mapping uses very broad trigger keywords such as “生活”, “知识”, “娱乐”, “社会”, and “全部”, which can match many unrelated user requests and cause the skill to activate or route queries unexpectedly. In a content-push skill, this can lead to over-collection of user intent, misclassification, and unintended content delivery, increasing the attack surface for prompt/skill hijacking through ambiguous phrasing.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script directly interpolates untrusted article fields such as `title`, `oriUrl`, `userName`, `accountId`, and `clicksCount` into HTML attributes and element content without escaping or URL validation. If the JSON input is attacker-controlled or poisoned upstream, this can produce stored HTML/JavaScript injection in the generated page, leading to XSS when a user opens the file locally or serves it from a web context.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The generated HTML unconditionally loads `html2pdf.bundle.min.js` from a third-party CDN, introducing a supply-chain and privacy risk. Anyone opening the HTML will make a network request to the CDN, and if that dependency is compromised, unavailable, or tampered with, the page's behavior and client-side security can be affected.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/fetch_articles.py:107