T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_news.py:24- Finding
Server-Side Request Forgery Through Unvalidated Deep-Fetch URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
News Aggregator Skill
Security checks for vulnerabilities and agentic risk
Overview
This news skill mostly matches its stated purpose, but its deep-fetch mode can request arbitrary article URLs without enough safeguards, creating a real review concern before installation.
Install only if you are comfortable with a news skill making outbound web requests, including deep-fetching article links from public feeds. Prefer running it in an isolated environment with restricted network egress, avoid --deep on untrusted or broad sources, pin dependencies before installing, and review generated reports because content is automatically saved under reports/.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase '自动生成杂志级排版的中文日报/周报' specifies Chinese-language output as a default behavior, but the README does not mention any option for users to choose another language. This creates a natural-language locale policy concern because it imposes a language preference without explicit opt-in or documented justification.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The README instructs users to install the skill via
npx skills addfrom a remote source without pinning an exact package version or commit. This creates a supply-chain risk: a later malicious or compromised package/repository state could be fetched and executed during installation.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
cp -r news-aggregator-skill YourProject/.claude/skills/
4. 验证：确保 SKILL.md 存在于目标目录
ls YourProject/.claude/skills/news-aggregator-skill/SKILL.md
text ### 第二步：安装 Python 依赖（如果你的agent足够聪明，可以跳过）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
cp -r news-aggregator-skill YourProject/.claude/skills/
4. 验证：确保 SKILL.md 存在于目标目录
ls YourProject/.claude/skills/news-aggregator-skill/SKILL.md
text ### 第二步：安装 Python 依赖（如果你的agent足够聪明，可以跳过）
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language activation examples are broad and overlap with ordinary user requests like asking for news on AI, finance, or open source. In an agent environment, vague triggers can cause unintended invocation of the skill, leading to unexpected network access, data fetching, or execution paths the user did not explicitly approve.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes a network-capable script (
fetch_news.py) but does not declare anypermissionsorallowed-toolsscope. This weakens least-privilege controls and can cause the runtime or reviewer to underestimate the skill's access, increasing the chance of unintended outbound requests or misuse if the skill is modified later.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase allowing invocation on 'similar menu/help triggers' is overly broad and can cause the skill to activate on vague user language that was not intended to run this skill. Ambiguous triggers increase the risk of unauthorized or surprising actions, especially because the skill can read local files and initiate network-backed workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This is a natural-language policy issue applicable to all file types. The instruction fixes the response language to Simplified Chinese, but the file does not offer user opt-in, language selection, or a documented region-specific justification, which can violate language/locale choice expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs automatic writing of timestamped reports to
reports/for every run without notifying the user or requesting consent. Silent filesystem modification can leak sensitive fetched content into persistent storage, create clutter, and violate user expectations about side effects.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill header and interaction instruction require the user to reply in Chinese or copy a provided Chinese command, which imposes a language choice without explicit user opt-in. This can mislead or exclude users, reduce transparency about what the skill will do, and create prompt-routing issues when the surrounding system or user expects another language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template includes a very broad invocation phrase for a 'global scan' across all sources without meaningful scoping, constraints, or user-confirmation steps. Broad trigger phrasing can cause the skill to activate for loosely related requests and encourage high-cost or unintended multi-source retrieval, which increases the chance of overreach, irrelevant collection, and abuse of the skill beyond the user's precise intent.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency 'requests' is unpinned, which makes builds non-reproducible and can cause the skill to install an unexpected or newly vulnerable version over time. In a network-facing news aggregation skill that fetches content from multiple external sources, this increases supply-chain and reliability risk because dependency behavior may change without review.
- Content
text requests beautifulsoup4
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The manifest does not pin a version of 'requests', and that package has multiple historical advisories, including issues related to credential leakage and TLS/session verification behavior. Because this skill retrieves data from external sites, an affected installed version could expose network traffic integrity or sensitive credentials if the environment uses features like .netrc or persistent sessions.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The dependency 'beautifulsoup4' is also unpinned, so installations may resolve to different versions across environments or at different times. While this is typically lower severity than direct code execution flaws, it still creates supply-chain uncertainty and can introduce vulnerable or incompatible releases into a scraper that processes untrusted remote content.
- Content
text requests beautifulsoup4
Static analysis
No suspicious patterns detected.