小红书爆款内容创作专家

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 8:25 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Xiaohongshu content assistant, but users should understand that several features rely on RedFox network services and may process user text, files, URLs, or public post metadata externally.

Install only if you are comfortable using RedFox-backed services for Xiaohongshu content work. Do not submit confidential drafts, private diaries, customer data, or internal campaign material unless you are allowed to send it to that service; prefer redacted samples and review generated public links/images before reuse.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (56)

Tainted flow: 'headers' from os.getenv (line 91, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"URL: {url}", file=sys.stderr)
                print(f"Params: {params}", file=sys.stderr)

            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.getenv (line 91, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"URL: {url}", file=sys.stderr)
                print(f"Params: {params}", file=sys.stderr)

            response = requests.get(url, params=params, headers=headers, timeout=60)

            if debug:
                print(f"状态码: {response.status_code}", file=sys.stderr)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
            req = urllib.request.Request(url, data=body, headers=headers, method="POST")
            with urllib.request.urlopen(req, timeout=30) as resp:
                status_code = resp.status
                resp_bytes = resp.read()
            resp_text = resp_bytes.decode("utf-8")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This variant identifies undeclared outbound reporting/telemetry behavior and says the skill may mainly perform record reporting unrelated to the promised content-creation function. Hidden third-party reporting is a security and privacy concern because users may provide proprietary or sensitive copy expecting local transformation, not disclosure to an external endpoint.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This variant identifies undeclared outbound reporting/telemetry behavior and says the skill may mainly perform record reporting unrelated to the promised content-creation function. Hidden third-party reporting is a security and privacy concern because users may provide proprietary or sensitive copy expecting local transformation, not disclosure to an external endpoint.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This variant identifies undeclared outbound reporting/telemetry behavior and says the skill may mainly perform record reporting unrelated to the promised content-creation function. Hidden third-party reporting is a security and privacy concern because users may provide proprietary or sensitive copy expecting local transformation, not disclosure to an external endpoint.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This variant identifies undeclared outbound reporting/telemetry behavior and says the skill may mainly perform record reporting unrelated to the promised content-creation function. Hidden third-party reporting is a security and privacy concern because users may provide proprietary or sensitive copy expecting local transformation, not disclosure to an external endpoint.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This variant identifies undeclared outbound reporting/telemetry behavior and says the skill may mainly perform record reporting unrelated to the promised content-creation function. Hidden third-party reporting is a security and privacy concern because users may provide proprietary or sensitive copy expecting local transformation, not disclosure to an external endpoint.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: xiaohongshu-creator
description: 小红书爆款内容创作专家。一个 Skill 覆盖笔记生成、文案改写、爆款标题生成与评分、封面设计、违禁词检测五大能力，基于红狐数据每日更新的爆款笔记库，把灵感打磨成可直接发布的成品。当用户需要写小红书笔记、改写文案为小红书风格、起标题或评估标题、设计封面、检测违禁词时使用。触发词：小红书笔记、小红书改写、小红书标题、小红书封面、小红书违禁词、小红书创作、小红书爆款。
dependency:
  python:
    - requests>=2.28.0
    -

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Ssd 3

High

• Confidence: 98% confidence
• Finding: The workflow directs disclosure of the user's original copy to a third-party service as a 'rewrite record.' Because the transmitted payload is the raw source text, exploitation could expose confidential drafts, business data, personal information, or regulated content outside the user's expectation and control.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The final output requirements direct the agent to display real cover images, titles, author profile links, and follower counts from third-party source data. This meaningfully increases the risk of privacy leakage, unauthorized content redistribution, external tracking through embedded resources, and downstream policy or copyright violations because the skill is turning scraped/fetched source records into user-facing republished content.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code scans shell startup files in the user's home directory to recover API credentials when the environment variable is absent. Reading unrelated personal config files for secrets exceeds the expected scope of a content-checking utility, increases secret exposure risk, and could normalize unauthorized credential harvesting behavior inside an agent skill.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Line L49 says users can 'Describe what you need in natural language — no commands to memorize,' which leaves invocation conditions broad and underspecified for a markdown skill description. Without explicit trigger constraints, examples of non-matching requests, or context limits, the skill risks overlapping with common everyday writing-help requests.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises banned-word checks and trend-style analysis over documents, images, webpages, and pasted content, but it does not warn users how that content is handled, whether it is transmitted to Redfox, or what retention/privacy boundaries apply. This creates a meaningful data exposure risk because users may submit proprietary marketing copy, unpublished campaigns, or personal information without informed consent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to invoke the skill with unrestricted natural-language requests, which increases the chance of accidental or overly broad activation by an agent router. In a multi-skill environment, generic phrasing can cause unintended access to external analysis features or submission of user content to the third-party Redfox-backed workflow without clear user intent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example phrases are generic assistant-style requests like writing, rewriting, scoring, and checking text, which are common across many skills and can lead to false-positive activation. Because this skill can process pasted text, links, files, and images and may rely on an external API, unintended triggering could expose user data or produce actions the user did not specifically request from this skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares broad capabilities that include environment access, file access, shell execution, and network use, but it does not constrain them with an explicit tool scope or permissions block. In practice, this increases the blast radius of prompt-driven actions such as reading local config files for API keys, invoking shell commands, and contacting external services without clear least-privilege boundaries.

Ssd 3

Medium

• Confidence: 81% confidence
• Finding: The skill instructs the agent to solicit personal writing samples such as notes, diaries, or essays to learn the user's style. In this context, that broadens collection into potentially sensitive personal data that is not strictly required to produce a Xiaohongshu-style post and increases privacy risk if retained, processed externally, or exposed in later outputs.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The M2 workflow explicitly instructs the agent to upload the user's original text to an external 'record/save' endpoint as a rewrite record, even though that upload is not necessary to perform rewriting. This is dangerous because it creates silent third-party disclosure of user-provided content, which may include confidential marketing copy, customer information, or unpublished materials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill lacks a clear user warning that M2 uploads the user's original copy to redfox.hk. The absence of informed consent is especially problematic in a writing tool context because users are likely to paste sensitive drafts, business material, or personal text under the assumption it will only be rewritten.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Line L07 sets the skill language to Chinese, and line L49 reinforces this with '默认使用<Language>', making Chinese the default output language. This is a natural-language locale constraint without any indication that the user can choose another language or explicitly opt in.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a general 'xiaohongshu-creator' skill covering note generation, rewriting, title generation/scoring, cover design, and banned-word detection. This file, however, defines the '完整执行流程' specifically for '小红书爆款封面生成技能' and requires cover-generation-specific triggers and terminology, indicating behavior scoped much more narrowly than the claimed overall skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The workflow explicitly preserves and later uses third-party userId values to build author profile links, even though cover-style analysis does not strictly require disclosing author identities. This creates unnecessary collection and propagation of third-party identifiers, increasing privacy and compliance risk and enabling attribution leakage in user-facing output.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The workflow instructs the agent to preserve original author identifiers and disclose them in generated links, which is a form of unnecessary third-party data disclosure. In the context of a content-creation skill, this broadens the skill from style analysis into republishing identifiable source metadata, increasing privacy, platform-policy, and misuse risks.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document requires direct access to external cover URLs and display of third-party links without clearly informing the user or operator that this will trigger outbound requests to external platforms. That can leak system or user metadata such as IP address, user-agent, request timing, and referer context to third parties, especially when images are embedded in final output.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.