Security audit

News Brief Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate news-briefing tool, but it needs review because it stores identifiers and delivery credentials while its privacy and secret-handling disclosures are incomplete.

Install only if you are comfortable with scheduled outbound news delivery and local storage of preferences, logs, backups, user IDs, and channel credentials. Prefer revocable webhook or bot tokens, avoid reusing sensitive email passwords, and confirm you can pause delivery and delete stored configs, logs, backups, and feedback history.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill describes capabilities for network access, reading/writing configuration and user data, and automated scheduled delivery, but it does not declare corresponding permissions or scope limitations. This creates a transparency and governance gap: users and the hosting platform cannot accurately assess what the skill can access or modify, increasing the risk of over-privileged execution and unnoticed data handling.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The module exposes a capability to enumerate every user ID stored by the skill, which exceeds the minimum access needed for per-user configuration, briefing delivery, and feedback handling. If this method is reachable by broader application logic, compromised components, or an unauthorized admin path, it enables user discovery and cross-tenant targeting, increasing privacy and abuse risk.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrases are broad everyday expressions such as '每日新闻' and '新闻推送', which can cause accidental activation outside clear user intent. In a skill that performs automation, configuration changes, and outbound delivery, misfires can lead to unintended setup flows, data collection, or message sending behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill supports automatic push delivery across multiple channels and failover to backup channels, but it does not clearly warn users about the operational and privacy risks of automated outbound messaging. Without explicit notice and consent, users may unknowingly enable repeated notifications, send content to unintended endpoints, or incur exposure through third-party delivery channels.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill states that it records user preferences and performs automatic backups of configuration and logs, but it does not adequately disclose retention, backup scope, or the privacy implications of persistent data storage. This can result in users unknowingly leaving behavioral profiles, channel configuration, and operational logs stored longer than expected, increasing exposure if the host or storage is compromised.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases "反馈" and especially "优化" are generic conversational terms that users may naturally send in unrelated contexts, which can unintentionally activate the skill's feedback or optimization flow. In a news-briefing skill that expects free-form user replies, this broad trigger design increases the chance of misrouting normal conversation, causing unintended state changes or configuration actions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The documented activation phrases such as “新闻简报” or “每日新闻” are broad and common enough to risk accidental invocation in ordinary conversation. In a skill that can fetch external content, modify settings through follow-up dialogue, and push messages across channels, unintended activation can lead to unexpected outbound requests or undesired notifications.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation advertises external news retrieval and multi-channel delivery but does not clearly disclose that user interests, configuration data, and generated content may be transmitted to third-party APIs, websites, RSS endpoints, email providers, or messaging platforms. This weakens informed consent and can create privacy and compliance risk, especially because the skill supports dynamic tools and multiple outbound channels.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The encryption key used to protect stored secrets is generated and persisted in a local file under the project directory, so anyone who gains filesystem access can recover both the key and encrypted user credentials. In this skill, the same manager stores passwords and messaging tokens, which makes local key storage materially weaken the protection claims around sensitive configuration data.

Static analysis

No suspicious patterns detected.