小红书相似账号推荐

• Outcome: Review
• Latest audit: Aug 5, 2026 · 7:44 AM UTC
• Version: 1.0.5

Overview

The skill does what it claims, but it sends queries and an API key to RedFox with TLS certificate verification disabled, which makes credential interception and response tampering materially possible.

Install only if you are comfortable sending Xiaohongshu account IDs and targeting criteria to redfox.hk and keeping generated JSON/HTML reports locally. The publisher should remove the disabled TLS verification before use with a real API key, clarify that the skill calls a remote API despite not using web search, and fix the documented script path.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tainted flow: 'req' from os.getenv (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ssl_ctx.verify_mode = ssl.CERT_NONE

    try:
        with urllib.request.urlopen(req, context=ssl_ctx, timeout=30) as resp:
            result = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        raise Exception(f"HTTP请求失败: {e.code}, {e.read().decode('utf-8', errors='replace')}")

• Confidence: 99% confidence
• Finding: The script sends an API key from the environment in an outbound HTTPS request while explicitly disabling TLS certificate validation. This creates a real interception risk: a machine-in-the-middle could impersonate the remote endpoint, capture the credential, and tamper with returned account data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation indicates capabilities to read environment variables, access the network, and read/write local files, but it does not declare those permissions explicitly. This creates a transparency and consent problem: users and hosting platforms may invoke the skill without understanding that account IDs and query data are sent externally and persisted locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill claims a narrow recommendation purpose and warns against联网搜索, but the documented behavior includes remote API access, local persistence of returned data, report generation, and subscription upsell/output flows that are not clearly surfaced in the high-level description. This mismatch can mislead users about what data leaves the system and what side effects occur on disk.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The README advertises subscription push and scheduled daily updates, which expands the skill from a one-shot recommendation tool into a persistent automation service. Scope expansion matters because scheduled actions can create ongoing data handling, repeated outbound activity, and user-consent expectations that are not clearly bounded by the stated skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The README requires a third-party API key and external service dependency despite the skill metadata emphasizing no network search, creating a trust and data-flow mismatch. This can mislead users about where their inputs go and may cause sensitive account queries or usage data to be transmitted to an external provider without clear scope justification.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill requires a third-party API key from redfox.hk despite the metadata warning against network search, creating an undisclosed external dependency and data egress path. This can expose user queries, account identifiers, and usage metadata to a third party, and may mislead users about where their data is processed.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The documentation says '严禁任何联网搜索' while the workflow explicitly requires a remote HTTPS API call. Even if 'search' and 'API request' are distinguished by the author, this wording is likely to mislead users and reviewers into believing no external network transfer occurs.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script persistently writes retrieved account data into local JSON and HTML files without necessity being obvious from the narrow recommendation function. This increases data retention and local exposure risk, especially on shared runners or multi-user environments where residual files may be accessible after execution.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Disabling certificate verification for outbound API traffic materially weakens transport security. An attacker able to intercept traffic can spoof the API, steal the X-API-KEY, and return malicious or misleading response data that the script will trust.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The activation guidance says to describe needs in plain language with no commands to memorize, which is broad enough to encourage invocation from ordinary conversation. Overly permissive triggers increase the chance the skill runs unintentionally on unrelated requests, potentially causing unnecessary external calls, report generation, or data processing without clear user intent.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The example trigger phrases are common natural-language requests and do not include guardrails or exclusion conditions, making accidental activation more likely. In this skill's context, unintended invocation is more concerning because the README also implies external API usage and optional subscription setup, so a mistaken trigger could lead to data transmission or persistent task creation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill does not warn users that provided account IDs, track selections, follower ranges, and levels are sent to an external API service. This omission undermines informed consent and can expose potentially sensitive business targeting data or account identifiers to a third party.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the system to write JSON and HTML files containing query results to local storage without warning the user about persistence. Local artifacts may retain account-related data, benchmarking targets, and generated reports beyond the session, increasing exposure on shared or managed environments.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script transmits user query data and an API credential to a remote service without a clear just-in-time disclosure or consent step. In a skill ecosystem that claims strict behavior boundaries, undisclosed outbound transmission can violate user expectations and leak sensitive identifiers or business queries.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script writes retrieved account data to local JSON and HTML files without warning or confirmation, creating avoidable data-at-rest exposure. On shared systems or persistent workspaces, these files may remain accessible beyond the intended session and reveal query history and fetched account metadata.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

"X-API-KEY": api_key
    }

    # 原生 urllib POST 请求（verify=False）
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=headers, method="POST")

• Confidence: 99% confidence
• Finding: The unsafe default of operating with TLS verification disabled undermines the confidentiality and integrity of all remote API communication. Because the request includes an API key, the skill context makes this more dangerous than a generic example: credential theft and response tampering directly affect the core function.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/xiaohongshu-similar-account.py:294