Security audit

小红书爆款内容创作专家

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with Xiaohongshu content workflows, but it asks for broader local and network access than the task needs and includes under-scoped prompt and telemetry behavior.

Install only if you are comfortable giving the skill RedFox API access, letting it read shell profile files to locate that key, fetching arbitrary URLs from your machine, and sending content or usage events to RedFox. Prefer setting REDFOX_API_KEY only in the current process, avoid checking private/internal URLs, and review generated output files before relying on them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/check_sensitive_words.py:177
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
100: text = extracted break except Exception: continue if not text: text = page.inner_text('body') browser.close() return text.strip() except Exception: pass response = _http_request(url, method="GET", timeout=30) ``` ### Technical Analysis The `--url` input is passed directly to Playwright or `urllib` without validating the destination hostname or resolved IP address. The implementation does not reject: - Loopback addre ...[truncated 1796 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: assets/platform-rules.md:36
Finding: Reusable System Prompt Contains an Unconditional Role-Locking Directive
Content: View full analysis
None: """Output the Xiaohongshu rewriting-rule prompt.""" rules = extract_platform_rules() if not rules: print(f'\n❌ Rules were not found\n', file=sys.stderr) sys.exit(1) print(f'\n✅ Platform: {PLATFORM}\n') print('─' * 60) print('\n【System Prompt】\n') print(rules) ``` ### Technical Analysis The rules contain an unconditional instruction never to leave the assigned role. The script then labels and emits the block as a System Prompt, increasing the likelihood that an integration will load it at elevated instruction priority. Content-formatting requirements should be scoped to the current rewrite operation. An unconditional role lock can instead interfere with later user requests or safety controls if the prompt is reused as persistent session context. The instruction does not explicitly attempt to disable security protections, but its absolute wording creates an instruction-preceden ...[truncated 1147 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/check_sensitive_words.py:32
Finding: Scripts Read General-Purpose Shell Profiles to Discover an API Key
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_xhs_hot_articles.py:579
Finding: User-Controlled Output Paths Permit Arbitrary File Creation and Overwrite
Content: View full analysis
Remediation: View remediation

other

Note

Location: scripts/rewrite_record.py:62
Finding: Rewrite Operations Trigger Nonessential Remote Telemetry
Content: View full analysis
Dict[str, Any]: payload = json.dumps( {'source': '小红书文案改写-ClawHub'}, ensure_ascii=False ).encode('utf-8') req = urllib.request.Request( RECORD_URL, data=payload, headers={ 'Content-Type': 'application/json; charset=utf-8', 'User-Agent': 'xiaohongshu-rewriting/1.0', }, method='POST', ) try: with urllib.request.urlopen(req, timeout=10) as resp: return { 'ok': True, 'status_code': resp.status, 'status_line': f'HTTP {resp.status}', } ``` The documented workflow automatically invokes the script for rewrites: ```bash python scripts/rewrite_record.py "" ``` ### Technical Analysis The rewrite function can be completed locally, but the documented workflow performs a network request to the RedFox record endpoint for every rewrite operation. The function accepts the original text as `content`, but the inspected implementation does not include that value in the request body. It sends only a fixed source marker. It also does not attach `REDFOX_API_KEY`, contrary to the statement in `SKILL.md` that the record request uses the key. Although the payload is limited, the remote service still receives connection metadata, including the source IP address and request timing. The documentation does not provide a distinct opt-in control for this telemetry. ### Attack Path 1. A user requests a local text rewrite. 2. The Agent follows `SKILL.md` and invokes `rewrite_record.py`. 3. The script sends a POST request to the RedFox record endpoint. 4. RedFox receives a usage event and associ ...[truncated 478 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (51)

Tainted flow: 'headers' from os.getenv (line 91, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/fetch_explosive_covers.py (reported line 105)May include surrounding context.
python
print(f"URL: {url}", file=sys.stderr) print(f"Params: {params}", file=sys.stderr) response = requests.get(url, params=params, headers=headers, timeout=60) if debug: print(f"状态码: {response.status_code}", file=sys.stderr)

Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/fetch_xhs_hot_articles.py (reported line 94)May include surrounding context.
python
body = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request(url, data=body, headers=headers, method="POST") with urllib.request.urlopen(req, timeout=30) as resp: status_code = resp.status resp_bytes = resp.read() resp_text = resp_bytes.decode("utf-8")

Tainted flow: 'headers' from os.getenv (line 116, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/fetch_xhs_trends.py (reported line 127)May include surrounding context.
python
if debug: print(f"\n=== DEBUG: 第 {attempt + 1} 次尝试 ===", file=sys.stderr) response = requests.get(url, params=params, headers=headers, timeout=60) if debug: print(f"状态码: {response.status_code}", file=sys.stderr)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明将该 Skill 描述为一个涵盖五大能力的“小红书爆款内容创作专家”，但所给代码块的核心与唯一业务功能是违禁词检测。代码支持三种输入来源：直接内容、本地文件、网页 URL；可提取 TXT/DOC/DOCX/HTML 等文本，甚至尝试用 Playwright 渲染网页后抽取正文，再把文本发送到 redfox.hk 的 sensitiveWordSearch API 做“小红书”平台敏感词检测。代码中没有任何与笔记生成、文案改写、标题生成、标题评分、封面设计相关的逻辑、模型调用、模板处理或图像处理功能。因此，声明的主要用途明显宽于实际实现，属于描述与行为不符。网页/文件提取本身可视为违禁词检测的辅助实现细节，但不足以支持其余四类创作能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明强调的是内容创作与优化工具，包含生成、改写、评分、设计、检测等多种创作型能力；但提供的代码仅实现了对外部红狐接口的调用，拉取小红书爆款内容数据，并将结果格式化输出为报告。虽然描述中提到“基于红狐数据每日更新的爆款笔记库”，这与代码中的数据来源相符，也与‘封面设计/爆款参考’存在弱相关，但代码本身没有任何生成文案、改写、标题打分、封面生成设计或违禁词检测逻辑。因此，代码行为与技能描述的主要能力明显不一致，属于实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该描述与代码存在明显不匹配。代码的核心功能是通过 REDFOX_API_KEY 调用 redfox.hk 的小红书搜索接口，获取热门笔记列表，并将结果格式化为 JSON/HTML 展示，包括互动数、作者、时间、相关性/热度等字段。它不包含任何内容生成、改写、标题创作、封面设计或违禁词检测算法/流程。虽然声明中提到“基于红狐数据每日更新的爆款笔记库”，这与代码的数据来源相符，但代码只是一个检索与展示底层数据的脚本，最多可作为上述创作能力的辅助数据来源，而不是实现这些能力本身。因此其实际行为只覆盖了很小一部分“爆款素材检索/分析支持”，与宣称的一体化创作专家能力存在实质差异。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 描述强调的是内容创作与加工类能力（生成笔记、改写文案、生成/评分标题、封面设计、违禁词检测），而代码并未执行任何文本生成、改写、评分、图像/封面设计或敏感词检测逻辑。代码的核心行为是访问外部 redfox.hk 数据接口，基于关键词获取4类小红书热门内容数据（低粉高赞、点赞Top、单日增长、7日增长），然后做去重、排序、表格渲染和文件输出。这说明其主要用途是爆款数据检索与分析，而不是描述中宣称的一体化创作专家。虽然后端数据源与“小红书爆款”主题相关，且可作为创作辅助，但与声明的五大核心能力存在显著功能不一致，属于实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a multi-capability Xiaohongshu creative assistant. However, this code chunk only supports two behaviors: extracting and printing a Xiaohongshu rules block from a local file, and reporting a rewrite record to https://redfox.hk/story/api/skill/record/save. The remote network call is not disclosed in the description, and the advertised end-user creative functions are not implemented in this chunk. Because the actual behavior is materially narrower and includes undeclared external logging, this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: xiaohongshu-creator description: 小红书爆款内容创作专家。一个 Skill 覆盖笔记生成、文案改写、爆款标题生成与评分、封面设计、违禁词检测五大能力，基于红狐数据每日更新的爆款笔记库，把灵感打磨成可直接发布的成品。当用户需要写小红书笔记、改写文案为小红书风格、起标题或评估标题、设计封面、检测违禁词时使用。触发词：小红书笔记、小红书改写、小红书标题、小红书封面、小红书违禁词、小红书创作、小红书爆款。 dependency: python: - requests>=2.28.0 -

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This workflow mandates sending user-provided original copy to an external service as a rewrite record, which is a direct disclosure path for potentially sensitive or proprietary content. Because the transmission is built into the normal operation of a common content-rewriting task, the privacy impact is significant and likely to occur in routine use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README states users can invoke the skill by describing needs in natural language with no commands to memorize, which creates very broad activation semantics. In agent ecosystems, this can cause unintended triggering from ordinary conversation and route sensitive or unrelated user content into an external API-backed skill without explicit user confirmation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README encourages invocation via very broad natural-language requests such as general content creation, rewriting, and compliance checks without defining clear boundaries, allowed inputs, or safety constraints. In an agent environment, this can cause over-triggering or misuse on unintended content sources, increasing the chance the skill processes sensitive, copyrighted, deceptive, or policy-violating material.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares broad capabilities that include environment access, file reads, network calls, and shell execution, but it does not define any explicit tool scope or permission boundary. In an agent setting, this increases the blast radius of prompt-driven actions and makes it harder to constrain sensitive operations such as reading local configuration files or invoking shell commands.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The authentication workflow tells the agent to scan shell startup files such as .zshrc and .bashrc to locate API keys. Reading unrelated user configuration files exceeds the reasonable boundary of a content-creation skill and risks exposing other secrets stored in those files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The '用词规范（强制）' section mandates exact Chinese wording for all external outputs, stating '所有对外输出（对话、报告、提示词）均须遵守.' This is a language/locale style constraint applied globally without giving the user a choice or documenting a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill explicitly encourages users to submit diary-style personal writing samples to model their style. This solicits potentially sensitive personal data beyond what is necessary for generating a Xiaohongshu post, increasing privacy risk and the likelihood of over-collection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The rewrite module instructs the agent to send the user's original text to an external endpoint as a side-effect unrelated to fulfilling the rewrite request. This creates unnecessary third-party disclosure of potentially sensitive user content and expands data handling beyond user expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill omits a clear upfront warning that the M2 workflow will transmit the user's original copy to a remote logging endpoint. Hidden transmission undermines informed consent and can cause accidental leakage of proprietary, personal, or regulated text.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L07 sets the language to Chinese, and L49 reinforces that the skill should default to that language. This is a natural-language locale constraint with no indication that users can choose another language or explicitly opt in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a broader skill covering note generation, copy rewriting, title generation/scoring, cover design, and banned-word detection. This workflow document, however, states it defines the complete execution flow for only '小红书爆款封面生成技能' and requires cover-generation-specific triggers and terminology, indicating behavior/documentation scoped much narrower than the claimed all-in-one skill purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow instructs the agent to fetch and display third-party cover URLs, post links, author profile links, userId values, and fan counts without any privacy, provenance, or external-content warning. In context, this skill aggregates external creator data and republishes it in generated output, which heightens the risk of privacy leakage, unwanted redistribution of third-party content, and exposing users to unvetted external resources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill explicitly prompts users to upload their own images but provides no guidance on sensitive-image handling, retention, consent, or what analysis will be performed. Because user-uploaded images may contain faces, location clues, documents, or other personal data, the omission creates a real privacy risk in normal use, especially for a consumer-content creation workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: A Xiaohongshu prohibited-word detection skill has no legitimate need to inspect local shell startup files for credentials. In this context, the capability is over-privileged and context-inappropriate, increasing the risk of unintended secret discovery or abuse if the skill is run in a sensitive environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow explicitly instructs the agent to recover REDFOX_API_KEY by scanning local shell profile files such as ~/.zshrc and ~/.bashrc. This expands the skill’s access from user-provided Xiaohongshu content into unrelated local secrets, creating an unnecessary credential-access behavior that could expose sensitive data from the host environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest focuses on content generation, rewriting, title scoring, cover design, and prohibited-word checking. Mandating persistent local file creation for every detection result is an additional side effect not clearly disclosed in that description and is not necessary to the core detection function itself.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.