ClawHub
Back to skill

Security audit

小红书内容灵感专家

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Xiaohongshu reporting purpose is coherent, but it needs Review because it handles API credentials and generated reports in ways that can expose users to avoidable security risk.

Install only if you are comfortable giving the skill a RedFox API key and generating local reports from RedFox/Xiaohongshu data. Prefer a revocable, low-privilege key; set it only for the current session rather than letting an agent edit shell profiles; avoid opening generated reports with sensitive browser sessions; and review or patch the TLS verification and HTML escaping issues before routine use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch_explosive_articles.py:235
Finding

API credentials transmitted over connections with TLS certificate validation disabled

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/gen_xhs_html.py:645
Finding

API-controlled values are inserted into generated HTML without contextual escaping

Content
View full analysis
' + '
' + rankHtml + '
' + '' + '
' + (avatar ? '' : '') + '' + (userUrl && userUrl !== '#' ? '' + userName + '' : userName) + '' + (fans ? '·' + fans + '粉丝' : '') + '
' + '
' + '
' + '
' + '
互动' + fmtNum(interactive) + '↑' + fmtNum(addInteractive) + '
' + '
' + ''; document.getElementById('noteList').innerHTML = html; ``` From `scripts/fetch_xhs_hot_articles.py`: ```python note_link = item.get('shareInfoLink') or f"https://www.xiaohongshu.com/explore/{note_id}" author_link = f"https://www.xiaohongshu.com/user/profile/{author_id}" if author_id else "#" card_html = f'''
Remediation
View remediation
` - `` - `javascript:alert(1)` ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/fetch_explosive_articles.py:97
Finding

Scripts scan user shell profiles to recover an API credential

Content
View full analysis
Remediation
View remediation
str: api_key = os.environ.get("REDFOX_API_KEY", "").strip() if not api_key: raise RuntimeError( "REDFOX_API_KEY is not set. Configure it in the calling environment." ) return api_key ``` 3. If persistent storage is required, use an explicit, narrowly scoped configuration file with restrictive permissions and clear user consent rather than parsing general-purpose startup files. 4. Never print any portion of the credential. 5. Document that users should inject the environment variable through their shell, secret manager, CI secret store, or host-agent credential mechanism. 6. Add tests confirming that the scripts do not open `.zshrc`, `.bashrc`, `.profile`, or PowerShell profile files. ]]>

T08 · Insecure Dependencies

Warning
Location
assets/preview-template.html:8
Finding

Generated reports execute JavaScript retrieved from third-party CDNs

Content
View full analysis
``` From `scripts/gen_xhs_html.py`: ```html ``` From `scripts/generate_rank_report.py`: ```html ``` ### Technical Analysis Opening a generated local report causes the browser to retrieve and execute JavaScript from jsDelivr, cdnjs, or unpkg. None of the observed script elements uses Subresource Integrity. The fallback logic broadens trust to three separate CDN infrastructures. Although package versions are present in the URLs, version pinning does not cryptographically verify the delivered bytes. A CDN compromise, package-account compromise, malicious asset replacement, DNS/TLS interception invo ...[truncated 1545 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (94)

Tainted flow: 'req' from os.environ.get (line 111, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_xhs_hot_articles.py (reported line 113)May include surrounding context.

python
body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
            req = urllib.request.Request(url, data=body, headers=headers, method="POST")
            
            with urllib.request.urlopen(req, timeout=30) as resp:
                status_code = resp.status
                raw = resp.read().decode("utf-8")

Tainted flow: 'headers' from os.environ.get (line 196, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gen_xhs_html.py (reported line 207)May include surrounding context.

python
try:
        # 接口仅支持 GET（query 参数）；POST 会返回系统错误
        response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30)
        if response.status_code >= 400:
            return {"fetch_time": rank_date + " 19:00", "query_type": "日榜", "category": category, "hot_list": []}

Tainted flow: 'headers' from os.environ.get (line 175, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/xhs_daily_fetcher.py (reported line 186)May include surrounding context.

python
try:
        # 接口仅支持 GET（query 参数）；POST 会返回系统错误
        response = requests.get(REDFOX_API_BASE, params=params, headers=headers, timeout=30)
        if response.status_code >= 400:
            raise Exception(f"HTTP请求失败: {response.status_code}, {response.text}")

Tainted flow: 'req' from os.environ.get (line 312, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/xiaohongshu-similar-account.py (reported line 319)May include surrounding context.

python
ssl_ctx.verify_mode = ssl.CERT_NONE

    try:
        with urllib.request.urlopen(req, context=ssl_ctx, timeout=30) as resp:
            result = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        raise Exception(f"HTTP请求失败: {e.code}, {e.read().decode('utf-8', errors='replace')}")

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The discrepancy between declared purpose and actual behavior is a true vulnerability because operators may grant the skill broad activation based on its description, unaware that it writes files, scans local config, and uses third-party APIs. In agent ecosystems, metadata honesty is part of the security boundary.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: xiaohongshu-inspiration
description: 小红书内容灵感聚合技能，覆盖选题灵感全链路：关键词爆款笔记搜索（相关性/热度/时效三维评分）、批量获取作品数据（支持 Excel/HTML 导出）、每日爆款 TOP50 爆发榜、低粉爆款挖掘（粉丝<5000 点赞>500）、账号日/周/月榜 TOP50、同阶对标与高阶标杆推荐。当用户需要小红书灵感、爆款搜索、笔记查询、批量获取作品、每日爆款、低粉爆款、账号榜单、涨粉榜、对标账号推荐时使用。触发词：小红书灵感、小红书爆款、小红书搜索、小红书�

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
python3 scripts/fetch_xhs_hot_articles.py --keyword "睫毛膏" --max-items 10

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
python3 scripts/fetch_xhs_hot_articles.py --keyword "睫毛膏" --max-items 10

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
python3 scripts/fetch_explosive_articles.py --keyword "居家装修" --top_n 50

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/preview-template.html (reported line 7)May include surrounding context.

html
<meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>{{KEYWORD}} · 小红书低粉爆款笔记TOP{{TOP_N}}</title>
    <!-- 使用多个CDN源，确保html2pdf.js能够加载 -->
    <script src="https://cdn.jsdelivr.net/npm/html2pdf.js@0.10.1/dist/html2pdf.bundle.min.js"></script>
    <script>
        // 如果第一个CDN加载失败，尝试第二个

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/preview-template.html (reported line 7)May include surrounding context.

html
<meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>{{KEYWORD}} · 小红书低粉爆款笔记TOP{{TOP_N}}</title>
    <!-- 使用多个CDN源,确保html2pdf.js能够加载 -->
    <script src="https://cdn.jsdelivr.net/npm/html2pdf.js@0.10.1/dist/html2pdf.bundle.min.js"></script>
    <script>
        // 如果第一个CDN加载失败,尝试第二个

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow explicitly instructs the agent to persistently modify the user's shell profile or Windows user environment to store API credentials. This is dangerous because it causes the agent to change long-lived local configuration and handle secrets directly, increasing the risk of credential exposure, accidental propagation to other tools/sessions, and unauthorized system modification beyond the immediate task.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/m6_account_template.html (reported line 42)May include surrounding context.

html
</head>
<body>
    <div class="container">
        <!-- 开场白 -->
        <div class="intro">
            <div class="intro-text">{{intro_text}}</div>
            <div class="data-note">{{data_note}}</div>

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

TLS hostname checking is disabled and certificate verification is turned off before sending the API key in an HTTPS request. This allows man-in-the-middle interception or spoofing of the remote service, exposing credentials and tampering with returned content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill metadata explicitly states '严禁任何联网搜索', yet the code performs external requests to redfox.hk and the generated HTML loads third-party CDN JavaScript at runtime. This violates the declared trust boundary and means using the skill can trigger undisclosed network egress and remote code loading.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata explicitly says '严禁任何联网搜索', but this fallback path imports functions that re-fetch ranking data from a remote API when cache input is absent. That creates a policy-bypass behavior: an agent invoking this script can trigger outbound network access despite the declared no-network constraint, which is especially risky in a skill that advertises scraping/search capabilities.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_rank_report.py (reported line 144)May include surrounding context.

python
for rule in CATEGORY_INFER_RULES:
        for kw in rule["keywords"]:
            if kw.lower() in combined:
                return rule["category"]

    # 3. 兜底关键词
    for category, keywords in FALLBACK_KEYWORDS.items():

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/gen_xhs_html.py:68

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/xhs_daily_fetcher.py:66

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/fetch_explosive_articles.py:272

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/xiaohongshu-similar-account.py:310