Japan News Mcp

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:17 PM UTC
• Version: 0.1.2

Overview

This skill is a coherent Japanese business-news helper, with ordinary network/news-feed behavior and a notable but disclosed dependency-installation risk.

Before installing, treat japan-news-mcp like any third-party executable: install it in a limited environment when possible, review or pin the package version if you need reproducibility, and avoid searching confidential company names or internal terms if disclosure to news sources or intermediaries would be sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned and Unverifiable Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 73
Vulnerability Type: Unpinned third-party package installation and execution
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"openclaw":{"emoji":"📰","requires":{"bins":["japan-news-mcp"]},"install":[{"id":"uv","kind":"uv","package":"japan-news-mcp","bins":["japan-news-mcp"],"label":"Install japan-news-mcp (uv)"}],"tags":["japan","news","finance","rss","mcp","business","economy","japanese"]}}

text

- Python package: `pip install japan-news-mcp` or `uv tool install japan-news-mcp`

Technical Analysis

The skill installs and executes the japan-news-mcp package by its registry name without specifying an exact version, integrity hash, lockfile, or verified source repository. Both documented installation methods resolve a package version from an external package registry at installation time.

Because the effective executable is not included in the audited project, its implementation cannot be verified from the available artifact. The package selected during a future installation may also differ from the version that existed when the skill was reviewed. This creates a supply-chain exposure if the package publisher, registry account, package namespace, build pipeline, or transitive dependencies are compromised.

This finding does not establish that the current package is malicious. It identifies the unsafe trust and installation model through which a malicious or compromised future release could be introduced.

Attack Path

1. An attacker compromises the package publisher account, package build pipeline, or a relevant dependency.
2. The attacker publishes a malicious release under the expected japan-news-mcp package name.
3. A user or agent follows the skill metadata or documentation and runs uv tool install japan-news-mcp or pip install japan-news-mcp.
4. The package manager resolves the attacker-controlled ...[truncated 1181 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin japan-news-mcp to a specific, reviewed version in both the installation metadata and documentation.
2. Use a lockfile or package-manager mechanism that verifies cryptographic hashes for the package and all transitive dependencies.
3. Document the canonical source repository, publisher identity, and package registry URL so users can verify package provenance.
4. Prefer reproducible builds and signed release artifacts, and verify signatures before installation.
5. Include the executable source code in the audited artifact or reference an immutable source commit for independent review.
6. Review package installation hooks and disable unnecessary build or installation-time script execution where supported.
7. Run the tool with least privilege in an isolated environment that exposes only the files and network access required to retrieve the documented RSS feeds.
8. Establish an update-review process so version changes are explicitly audited rather than automatically resolving the newest registry release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The description and examples consistently position the skill around Japanese news sources and Japanese-language content. This can constitute a language/locale restriction, and the file does not explicitly present it as a user choice or justify the constraint beyond the skill name and source list.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The command examples and workflow cause network access to external news sources, but the skill description does not clearly warn users that prompts may result in outbound connections and data disclosure such as searched keywords. While expected for a news-fetching tool, lack of explicit disclosure can surprise users and may expose sensitive research interests or internal terms through external requests.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to install a Python package without pinning a specific version, which can lead to non-reproducible installs and increases supply-chain risk if a later package release is compromised or introduces unsafe behavior. In this context the package is the core executable dependency, so users are implicitly trusting whatever version is current at install time.

Content

No source excerpt is available for this finding.