Security audit

小红书账号诊断

Security checks across malware telemetry and agentic risk

Overview

The skill’s account-analysis purpose is coherent, but it handles an API key, external data, and generated HTML in ways that create avoidable security risk.

Install only if you trust RedFox with the account IDs and API key use. Treat generated reports as sensitive local files, avoid opening or sharing HTML reports from untrusted data until HTML escaping is fixed, and prefer a version that verifies TLS certificates and bundles or removes remote browser scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use environment variables, read multiple local reference files, write output JSON/HTML files, and make network requests, but it declares no permissions or capability boundaries. This creates a mismatch between documented behavior and actual access needs, increasing the risk of unintended data access, secret exposure, or uncontrolled external requests when the skill is executed.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The template loads and executes html2canvas from a third-party CDN at render time, which creates a supply-chain and privacy risk: if the CDN resource is compromised, replaced, or blocked, untrusted code runs in the user's browser. In this skill context, the report may contain account analysis data and remote script execution is not necessary for basic HTML report viewing, so the extra browser-side dependency increases attack surface beyond the core function.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The template loads a third-party script from html2canvas.hertzen.com at runtime, which creates a supply-chain risk: if that host is compromised, unavailable, or serves modified code, anyone opening the generated report executes untrusted JavaScript. Because this is an export/report feature rather than core account-analysis logic, the dependency is avoidable and increases exposure for all report viewers.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The workflow instructs the agent to redirect users to external commercial contact channels after repeated failures, which can steer users off-platform without any trust verification, consent step, or safety gating. This creates phishing, social-engineering, and privacy risks because users may disclose identifiers or contact details to third parties when the core task fails.

Context-Inappropriate Capability

Low

Confidence: 79% confidence
Finding: The workflow directs the agent to perform background searches on media reports and cross-platform presence that go beyond the minimum data needed for Xiaohongshu account analysis. This expands collection and inference about a person or brand, increasing privacy and profiling risk, especially when done automatically without clear necessity or user opt-in.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code builds HTML table rows and anchor tags by directly interpolating untrusted fields such as title, likes, dates, and especially url into HTML without escaping or URL validation. If report data can contain attacker-controlled values, this enables stored/reflected XSS and attribute injection in the generated report, which is more dangerous because the skill’s purpose is to export HTML that users may open in a browser.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The similar account card generator injects externally supplied account names, recommendation text, learning points, and profile links directly into HTML fragments, including inside anchor attributes and visible content. An attacker could supply malicious markup or crafted URLs to execute script, phish users, or alter report content when the exported HTML is viewed.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The multi-account detail HTML embeds untrusted avatar URLs in img src and untrusted text such as account name, tag, score, and diagnostic content directly into HTML. This creates both markup injection and attribute injection surfaces, allowing XSS or browser-driven external requests when users open the report.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README instructs users to invoke the skill with broad natural-language requests and explicitly says there are 'no commands to memorize,' which leaves activation scope weakly bounded. In an agent environment, vague triggers can cause the skill to activate on loosely related user messages, increasing the chance of unintended execution, data access, or overlap with other skills.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example prompts include very generic phrases such as 'Help me diagnose my account,' which are common conversational utterances and may match benign discussion rather than a deliberate request to run the skill. In a multi-skill agent system, this ambiguity can lead to accidental triggering, incorrect routing, and unintended processing of account-related data.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README explicitly says the skill can be invoked with natural language and provides common, loosely scoped phrases. That increases the chance of over-broad or accidental activation when a user is discussing Xiaohongshu analysis in ordinary conversation, which can cause unintended tool use, unnecessary external API calls, and possible disclosure of user-provided account identifiers to the integrated service.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The example requests in the usage scenarios are broad enough to overlap with normal requests a general assistant might receive, without clearly signaling that this specific skill should be used. In practice, that can route unrelated or insufficiently consented conversations into the skill, triggering account analysis, report generation, or third-party data access beyond the user's intended scope.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide instructs the skill to transmit user-supplied Xiaohongshu account identifiers to a third-party endpoint and to authenticate with an API key from environment variables, but it provides no warning about data disclosure, consent, retention, or safe handling of secrets. In a user-facing analysis skill, this creates a real privacy and operational security risk because users may not realize their account data is sent off-platform, and developers may mishandle the API key or expose it in logs or downstream errors.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow mandates automatic WebSearch and later file/HTML generation without a user-facing notice or consent mechanism. This can surprise users with external data retrieval and artifact creation, potentially exposing sensitive content, creating persistent local files, or causing unintended sharing of enriched profile data.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill sends user-provided account identifiers and source metadata to a third-party service without clear user disclosure or consent. In this skill context, the data flow is core functionality, but silent transmission to an external domain creates privacy and compliance risk, especially if users assume analysis is local.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill writes raw API responses and analyzed account data to disk in output/raw_data.json without explicit notice or retention controls. In this skill, persisted data may include account identifiers, profile attributes, demographics, and derived analysis, creating avoidable privacy exposure to other local users, backups, or later processes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/xiaohongshu_analyzer.py:105

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/xiaohongshu_analyzer.py:142