小红书相似账号推荐

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.5

Overview

The skill’s main purpose is coherent, but it handles an API key and generated reports in ways that create real security and consent concerns.

Install only if you are comfortable giving this skill a RedFox API key and sending Xiaohongshu account IDs or targeting criteria to redfox.hk. The publisher should fix TLS verification, escape generated HTML, and make subscription behavior explicit and opt-in before routine use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:103

Finding

Mandatory Promotional Instructions Hijack Agent Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xiaohongshu-similar-account.py:298

Finding

TLS Certificate and Hostname Verification Are Disabled

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xiaohongshu-similar-account.py:739

Finding

Unescaped API Data Is Embedded in Generated HTML Reports

Content

View full analysis

{nickname} {fans} {interactive_thirty} {reason} ''' ``` The high-level account section repeats the same unsafe construction: ```python for acc in high_level_accounts: nickname = acc.get("nickname") or "Unknown" url = acc.get("url") or "#" fans = format_number(acc.get("fans")) interactive_thirty = format_number(acc.get("interactiveCountThirty") or 0) reason = generate_recommendation_reason(acc) rows += f''' {nickname} {fans} {interactive_thirty} {reason} ''' ``` The original source uses a localized fallback string instead of the English word `Unknown`; that fallback does not affect the vulnerability. ### Technical Analysis Values obtained from the remote API are interpolated directly into HTML text and attribute contexts without output encoding: - `nickname` is inserted into an element body. - `url` is inserted into a quoted `href` attribute. - `reason` is derived partly from API-controlled work titles and other account data. - Numeric values are formatted but are not strictly validated against an expected response schema. No `html.escape()` call, automatic-escaping temp ...[truncated 2364 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Tainted flow: 'req' from os.getenv (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

The script sends a secret API key from the environment to a remote endpoint while TLS certificate verification is explicitly disabled. This creates a realistic man-in-the-middle risk where the credential and returned data can be intercepted or altered, making the tainted network flow genuinely dangerous in this skill context.

Content

Scanner excerpt · scripts/xiaohongshu-similar-account.py (reported line 303)May include surrounding context.

python

ssl_ctx.verify_mode = ssl.CERT_NONE

    try:
        with urllib.request.urlopen(req, context=ssl_ctx, timeout=30) as resp:
            result = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        raise Exception(f"HTTP请求失败: {e.code}, {e.read().decode('utf-8', errors='replace')}")

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README advertises a daily subscription push feature even though the skill metadata explicitly says '严禁任何联网搜索'. That creates a capability/expectation mismatch: users or downstream agents may enable persistent networked behavior and scheduled data retrieval outside the declared boundaries, increasing the risk of unauthorized external access and data exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README instructs users to obtain and supply an external API key and states that recommendation data comes from an API, directly conflicting with the stated prohibition on online search/network use. This can lead an agent to request secrets and access external services not permitted by the skill contract, creating both policy bypass and credential-handling risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose says the tool recommends comparable Xiaohongshu accounts and explicitly warns against online search, but the instructions require external API calls, writing JSON/HTML artifacts to disk, and subscription solicitation. This mismatch can mislead users and reviewers about what data leaves the environment and what side effects occur, increasing the risk of undisclosed data exfiltration and unexpected persistence.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/account_template.html (reported line 42)May include surrounding context.

html

</head>
<body>
    <div class="container">
        <!-- 开场白 -->
        <div class="intro">
            <div class="intro-text">{{intro_text}}</div>
            <div class="data-note">{{data_note}}</div>

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code disables certificate and hostname verification for HTTPS requests, eliminating the authenticity guarantees of TLS. An attacker on the network path could impersonate the API server, steal the X-API-KEY, and return malicious or manipulated account data that the skill then stores and presents as trusted output.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises a persistent subscription push feature even though the skill is described as a recommendation tool. Expanding behavior from one-shot recommendations into recurring delivery materially changes the trust and privacy model, and can lead to unauthorized task creation or unexpected ongoing data processing if the platform or manifest does not clearly declare and gate that capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README describes creating daily subscription pushes but does not prominently warn that this is a persistent recurring action. Without explicit disclosure and confirmation, users may unknowingly authorize ongoing notifications or retained preferences, which creates consent and abuse risks disproportionate to a simple recommendation skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The phrase 'Describe what you need in plain language — no commands to memorize' is broad enough that normal conversation may unintentionally invoke the skill. Over-broad invocation increases the chance of the agent processing user content, account identifiers, or preferences without sufficiently clear intent, especially in a skill that may generate reports or create subscriptions.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.en.md (reported line 72)May include surrounding context.

md

| --------------- | --------- | ---------------- | --------------------------------------------------------------------------------------------------- |
| [Account](link) | 3200      | 15K              | Food tutorials, stable updates, high engagement; viral post "5-min breakfast…" got 23K interactions |
| [Account](link) | 2800      | 8500             | Daily vlog style, consistent updates, solid engagement base                                         |
| …               | …         | …                | …                                                                                                   |

👉 **【High-level benchmarks to chase (2)】** (proven models to aspire to)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Telling users they can invoke the skill with any natural-language request is overly broad and lacks boundaries on accepted inputs and prohibited actions. In an agent setting, vague triggers can cause over-invocation, misuse outside the intended domain, and accidental execution of unsupported or policy-violating workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The example phrase for creating a daily push task is broad and does not define validation, approval, or task-creation limits. This makes it easier for an agent to interpret casual language as authorization for persistent automation, which is especially risky given the skill's stated no-network constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Automatic daily subscription pushes extend the skill from a one-time recommendation tool into a persistent monitoring/notification service. That expanded behavior increases attack surface, can trigger repeated unauthorized data pulls, and may collect or act on user criteria over time without clear necessity or governance.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation describes capabilities that require environment-variable access, local file reads/writes, and outbound network access, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can cause overbroad execution privileges, making it easier for the skill to access sensitive data or perform side effects beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description says to use the skill whenever the user needs account recommendations, KOL benchmarking, startup references, or ad-placement selection, but it does not define precise trigger phrases, scope limits, or exclusion conditions. This broad natural-language activation guidance could cause unintended invocation for general marketing or recommendation conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest and the entire instruction set are written as Chinese-only operational guidance for output formatting and usage, with no indication that users may choose another language. Under the language/locale policy criterion, forcing a specific language without opt-in can be a policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to provide account IDs and query parameters, then sends them to an external API, but it does not clearly warn users that this information will leave the local agent context. This creates a privacy and consent issue, especially because account identifiers and business targeting criteria may be sensitive in creator, brand, or MCN workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script’s natural-language interface, output strings, and generated HTML language setting are fixed to Chinese, with no option for users to select another language or locale. That can violate language/locale choice expectations when used in broader environments where user opt-in is required.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation states '严禁任何联网搜索' and says all data comes only from an API interface, which reads as a prohibition on networked retrieval in general. In practice, the script sends a real HTTPS POST request to an external host at L0274-L0304, so the documentation contradicts the actual behavior rather than merely omitting an implementation detail.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The unsafe default here is disabling TLS verification for an outbound request carrying an API key. In the context of a skill that claims strict no-network behavior yet actually connects to an external service, this materially increases risk because users and operators may not expect credential exposure or response tampering.

Content

Scanner excerpt · scripts/xiaohongshu-similar-account.py (reported line 294)May include surrounding context.

python

"X-API-KEY": api_key
    }

    # 原生 urllib POST 请求（verify=False）
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=headers, method="POST")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes an account-matching/recommendation tool for Xiaohongshu use cases, but the implementation persists API results to local JSON and renders an HTML report file before returning its path. Local file creation is not an obvious requirement of simply recommending benchmark accounts and materially expands the behavior beyond the stated description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code always saves returned account data into timestamped JSON and HTML files, and the comments indicate these writes are mandatory. There is no confirmation prompt or explicit user-facing disclosure before persisting the fetched data to disk, so users may not expect local artifact creation containing query results.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The manifest frames the skill as an account matching/recommendation tool and explicitly warns against online searching, which suggests a constrained data-access model. The README introduces dependency on an external RedFoxHub API key and remote API-backed data retrieval, a capability that is broader and more operationally sensitive than the manifest itself discloses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill mandates writing query results into local JSON and HTML files but does not warn users that artifacts will be persisted on disk. Even if temporary, these files can expose sensitive account research, targeting criteria, or generated links to other users or processes on the same system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The HTML declares lang="zh-CN" and the page title/content labels are all fixed in Simplified Chinese, which imposes a specific language/locale on users. The file does not indicate that this is optional, user-selected, or restricted to a clearly justified region-specific workflow.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/xiaohongshu-similar-account.py:294