Ai News Brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 1.5.1

Overview

This news-brief skill mostly matches its stated purpose, but it handles untrusted web content unsafely in generated reports and can send data to email or LLM services when configured.

Review before installing or running unattended. Keep email and LLM features disabled unless you are comfortable sending generated reports, article text, recipient addresses, and configured credentials through those providers. Avoid opening or forwarding generated HTML from untrusted sources until the report/email generators escape content and validate links. Prefer a pinned, isolated Python environment for dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/email_sender.py:184

Finding

Untrusted News Content Is Inserted into HTML Without Escaping

Content

View full analysis

🔥 {hot_score} {i}. {title}

📰 {source} 可信度 {level}

""" if include_summary and summary: html += f'

{summary[:200]}...

\n' ``` Key points are also appended without escaping: ```python for kp in key_points[:3]: html += f'

{kp[:100]}

\n' ``` ### Technical Analysis Article titles, URLs, source names, summaries, and key points originate from remote RSS feeds and web pages. These fields are directly interpolated into an HTML document without contextual encoding or URL-scheme validation. Truncating a string does not make it safe. An attacker-controlled title or summary can contain HTML elements, while an attacker-controlled URL can contain a deceptive or unsafe URI. Depending on the renderer, the resulting report may load external tracking resources, alter the visible report, create fraudulent links, or execute active content. Email clients commonly apply sanitization, but this behavior is not consistent enough to constitute an appl ...[truncated 1303 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/llm_summarizer.py:72

Finding

Remote Article Content Is Passed Directly into an LLM Instruction

Content

View full analysis

Remediation

View remediation

{title[:100]}\n" f"{content[:2000]}" } ], "max_tokens": 150, "temperature": 0.3 } ``` 2. Clearly delimit external content and state that the delimiters contain data, not instructions. 3. Validate the returned summary before storing or publishing it: - Enforce the expected length. - Reject HTML and unexpected URLs. - Reject known instruction-following phrases. - Require a constrained output schema where supported. 4. Preserve provenance by labeling LLM-generated summaries and retaining a link to the source article. 5. Avoid automatically distributing summaries that fail validation. Fall back to deterministic extraction or require review. 6. Do not add tools, local file access, or privileged agent capabilities to this summarization request without implementing stronger isolation. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/check_deps.py:16

Finding

Automatically Installed Python Dependencies Are Not Version-Pinned

Content

View full analysis

Remediation

View remediation

beautifulsoup4== websocket-client== fpdf2== ``` 2. Generate and verify cryptographic hashes, and install with `--require-hashes`. 3. Store dependencies in a reviewed lock file rather than embedding mutable installation commands in Python source. 4. Explicitly configure and document the trusted package index. Do not inherit an unknown mirror or additional index without warning. 5. Disable automatic installation by default. Require informed user approval before changing the environment. 6. Install dependencies in an isolated virtual environment with minimal filesystem permissions. 7. Run dependency vulnerability and provenance checks as part of release preparation. 8. Periodically update pinned versions through a controlled review process rather than resolving latest versions at runtime. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (64)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more security-relevant because it suggests undisclosed external LLM API usage for article processing while the top-level description focuses on scraping/reporting. Undeclared third-party transmission can expose scraped content, user preferences, and potentially confidential context to external providers without clear informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a skill for automatically fetching AI/compute/LLM/GPU news briefs from technology media sources, with browser automation, PDF generation, and email delivery. This file is instead dedicated to scraping government policy, notice, and announcement sites such as 中国政府网、工信部、科技部、网信办 and others, which is a materially different content domain and source type than the declared tech-media news brief scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares broad capabilities including network access, file reads/writes, and package installation/Chrome usage, but it does not define any explicit tool scope or permission boundaries. In an agent environment, this increases the blast radius of prompt-triggered actions because the agent may perform filesystem, shell, or network operations without a least-privilege contract visible to users or the platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation describes optional email delivery and LLM/translation API integrations but does not clearly disclose that article content, generated reports, recipient addresses, and user-configured data may be sent to external services. This creates a real privacy and data-governance risk because users may enable features without understanding what data leaves the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Natural-language policy review applies to all file types. The line "翻译英文AI资讯为中文" specifies a forced locale/language behavior, and the document does not present this as a user-selectable option or a clearly justified region-specific constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase '科技资讯' is overly broad for a skill with network, file, browser, and optional email/API capabilities. In agent routing contexts, a generic phrase can cause accidental invocation on unrelated requests, leading to unnecessary web access, content collection, file generation, or external transmission without the user intending to use this specific skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language strings that force a specific language/locale for the skill experience. The file does not indicate that Chinese is optional, selectable by the user, or justified as a region-specific tool, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstrings and generated report text are fixed in Chinese, including labels such as the report title and footer. Under the language/locale policy, forcing a single language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The HTML report directly interpolates untrusted article fields such as title, url, source, summary, and key_points into markup without HTML escaping or URL validation. If scraped content contains HTML or JavaScript, opening the generated report could trigger stored XSS or malicious links, which is more concerning here because the skill aggregates external news from multiple sources and produces a browsable HTML/PDF artifact.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_deps.py (reported line 19)May include surrounding context.

python

'name': 'Python 3.8+'
    },
    'requests': {
        'check': lambda: __import__('requests', fromlist=['']) is not None,
        'install': 'pip install requests',
        'name': 'requests'
    },

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_deps.py (reported line 24)May include surrounding context.

python

'name': 'requests'
    },
    'beautifulsoup4': {
        'check': lambda: __import__('bs4', fromlist=['']) is not None,
        'install': 'pip install beautifulsoup4',
        'name': 'beautifulsoup4'
    },

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_deps.py (reported line 29)May include surrounding context.

python

'name': 'beautifulsoup4'
    },
    'websocket-client': {
        'check': lambda: __import__('websocket', fromlist=['']) is not None,
        'install': 'pip install websocket-client',
        'name': 'websocket-client'
    }

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/check_deps.py (reported line 41)May include surrounding context.

python

import requests
    
    try:
        resp = requests.get('http://localhost:9222/json/list', timeout=3)
        pages = resp.json()
        for p in pages:
            if p['type'] == 'page':

Static analysis

No suspicious patterns detected.