AI Layoff Radar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:57 AM UTC
• Version: 1.0.0

Overview

The skill performs the advertised layoff-news analysis, but it also automatically contacts a billing service and attempts a $0.02 charge before analysis without declaring that in the skill metadata.

Review this carefully before installing. Expect outbound calls to Google News/RSS-linked article sites, OpenAI if OPENAI_API_KEY is set, and SkillPay. Do not run it unless you are comfortable with a mandatory per-call charge flow tied to a user_id, and prefer an isolated runtime with restricted network access and pinned dependencies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: main.py:60

Finding

Mandatory Third-Party Billing and User Identifier Disclosure Are Not Declared in Skill Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: news_fetcher.py:49

Finding

Remote RSS Entry URLs Are Downloaded Without SSRF or Resource Controls

Content

View full analysis

str: try: article = Article(url) article.download() article.parse() return article.text.strip() except Exception: logger.warning("Failed to parse full article text: %s", url) return "" ``` The URL passed to this function is obtained directly from an RSS entry: ```python for entry in parsed.entries[:max_items_per_feed]: url = entry.get("link", "").strip() if not url or url in seen_urls: continue seen_urls.add(url) title = clean_html((entry.get("title") or "").strip()) summary = clean_html((entry.get("summary") or "").strip()) published = _parse_date(entry.get("published") or entry.get("updated") or "") source = "" if isinstance(entry.get("source"), dict): source = (entry.get("source", {}).get("title") or "").strip() if not source: source = (parsed.feed.get("title") or "Unknown").strip() text = clean_html(_extract_text(url)) ``` ### Technical Analysis `entry["link"]` is remote-controlled content received from Google News RSS. The implementation passes it to `newspaper.Article.download()` without validating: - The URL scheme. - The initial hostname. - The resolved IP address. - Redirect destinations. - Whether an address belongs to loopback, private, link-local, multicast, or reserved ranges. - The final content type or response size. - The number of redirects or total download time beyond library defaults. Although the RSS feeds themselves are generated by Google News, linked destinations and redirect behavior are not inherently trusted. A malicious publisher, compromised article, poisoned feed result, or redirecting endpoint could cause the runtime to contact servi ...[truncated 1697 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependencies Are Installed With Unbounded Future Versions and Without Integrity Verification

Content

View full analysis

=2.31.0 feedparser>=6.0.11 beautifulsoup4>=4.12.3 openai>=1.30.0 newspaper3k>=0.2.8 lxml[html_clean]>=5.2.1 python-dateutil>=2.9.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis All dependencies use minimum-version constraints. Consequently, a fresh installation may select any later release available from the configured package index. No lock file or package hashes are supplied. This does not prove that any listed package is currently malicious. The issue is that the audited source does not uniquely determine the code that will be installed. A future compromised release, malicious takeover, dependency-resolution change, or incompatible transitive dependency could therefore alter installation or runtime behavior without changes to this Skill repository. Python package installation can execute build backends and package-supplied code. Runtime imports also execute package initialization code with the permissions of the Skill process. ### Attack Path 1. A direct or transitive dependency publishes a compromised or otherwise unsafe future version satisfying the `>=` constraint. 2. A user runs `pip install -r requirements.txt`. 3. The package resolver selects that future version because no exact version or hash is required. 4. Malicious behavior executes during package build, installation, import, or normal runtime. 5. The dependency receives the same filesystem, environment, and network access as the Skill process. This attack requires compromise or abuse of the dependency supply chain; no such compromise was confirmed during the static audit. ### Impact Assessment A compromised dependency could potentially access: - `OPENAI_API_KEY` and `SKILLPAY_AP ...[truncated 386 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (27)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 1)May include surrounding context.

text

.env
__pycache__/
*.pyc
*.pyo

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims to detect AI-driven layoffs from global news and generate structured reports, but the manifest only gives high-level instructions and example output without defining reliable sourcing, validation, or causality criteria. This mismatch can mislead users into overtrusting the results of a sensitive reputational-analysis workflow and may produce inaccurate or fabricated risk reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to detect AI-driven layoffs from global news and generate structured reports, but the manifest only gives high-level instructions and example output without defining reliable sourcing, validation, or causality criteria. This mismatch can mislead users into overtrusting the results of a sensitive reputational-analysis workflow and may produce inaccurate or fabricated risk reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims to detect AI-driven layoffs from global news and generate structured reports, but the manifest only gives high-level instructions and example output without defining reliable sourcing, validation, or causality criteria. This mismatch can mislead users into overtrusting the results of a sensitive reputational-analysis workflow and may produce inaccurate or fabricated risk reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to detect AI-driven layoffs from global news and generate structured reports, but the manifest only gives high-level instructions and example output without defining reliable sourcing, validation, or causality criteria. This mismatch can mislead users into overtrusting the results of a sensitive reputational-analysis workflow and may produce inaccurate or fabricated risk reports.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements balance checks, charging, and payment-link generation for an external billing service, which is materially unrelated to the skill's declared purpose of analyzing layoff news and generating reports. Hidden or unnecessary monetization logic expands the skill's capability to debit users or transmit billing-related identifiers without clear necessity, making abuse or unauthorized charging more dangerous in this context.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

md

DEV mode:

- Set `SKILLPAY_DEV_MODE=true` to bypass live billing calls during local development.
- In DEV mode, billing functions simulate success responses (for example balance `999`).
- In non-DEV mode, missing `SKILLPAY_API_KEY` raises: `SKILLPAY_API_KEY not configured`.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill metadata declares use of an environment variable and implies external news access, but it does not define explicit tool scope such as allowed network or env permissions. This weakens least-privilege controls and can let a runtime grant broader capabilities than reviewers or users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance uses broad phrases like 'AI layoffs' and 'companies replacing workers with AI' without scope limits, exclusions, or thresholds for evidence. That can cause over-triggering in unrelated contexts and increase the chance of producing defamatory, inaccurate, or low-confidence claims about companies and layoffs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code sends event content, including title, summary, reason, and up to 2000 characters of text, to an external OpenAI API. If those fields contain sensitive, proprietary, or personal data, this creates a real data exposure and third-party processing risk, especially because there is no consent, redaction, or policy gate in this file before transmission.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code loads a billing API key from environment variables and uses it to interact with an external payment API, despite the skill being described only as a news-analysis tool. While using environment variables for secrets is normal, the concerning issue is the presence of external billing capabilities and credentialed payment operations that are outside the stated function, increasing the risk of undisclosed financial actions and data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The charge_user function can attempt to debit a user's account directly with no evidence of prior user notice, confirmation, or authorization in this component. In a skill whose advertised purpose is informational analysis, silent charging behavior is especially risky because users would not reasonably expect financial side effects from invoking the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This POST transmits user_id, skill_id, amount, and currency to an external billing endpoint. External transmission by itself is not always unsafe, but here it supports an undisclosed billing action outside the skill's stated purpose, so the context makes the data flow more sensitive and potentially harmful.

Content

Scanner excerpt · billing.py (reported line 65)May include surrounding context.

python

"currency": "USD",
    }
    try:
        response = requests.post(
            url,
            json=payload,
            headers=_headers(),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This POST sends user and payment metadata to an external service to generate a payment link. Although payment-link creation is less severe than direct charging, it still initiates a monetization workflow unrelated to the declared layoff-analysis function and exposes user identifiers to a third party.

Content

Scanner excerpt · billing.py (reported line 101)May include surrounding context.

python

"currency": "USD",
    }
    try:
        response = requests.post(
            url,
            json=payload,
            headers=_headers(),

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill performs billing checks, charges the user, and generates payment links even though its stated purpose is news analysis and layoff reporting. This expands the skill’s operational scope into payments, increasing abuse and user-surprise risk, especially because the billing logic is embedded directly in the main execution path before the reporting function completes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Payment processing is not justified by the visible function of detecting AI-related layoffs, so the code introduces a capability unrelated to the expected task. In a skill ecosystem, unnecessary financial operations materially increase risk because they can charge users or redirect them into payment flows without a clear, task-related need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code automatically calls charge_user(user_id=user_id) during execution with no in-file evidence of a user-facing confirmation, preview, or authorization step. Automatic charging is dangerous because a routine analysis request can directly trigger financial impact, and users may only discover the charge after the fact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The query URL forces hl=en-US, gl=US, and ceid=US:en, which imposes a specific language and locale in the skill's behavior. The file does not offer user opt-in, configurability, or a documented region-specific justification for this constraint.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally pull in vulnerable or breaking releases, especially for a network-facing library like requests.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.11
beautifulsoup4>=4.12.3
openai>=1.30.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin a version, it is impossible to verify whether the installed release is affected. In a skill that retrieves external content, this uncertainty is more significant because a vulnerable HTTP client could expose credentials, mishandle redirects, or weaken TLS/request safety.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

feedparser is unpinned, so builds are not reproducible and may silently install different versions in different environments. Because this skill ingests external news/RSS data, dependency drift can increase exposure to parser-related security issues if a bad release or affected version is installed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.11
beautifulsoup4>=4.12.3
openai>=1.30.0
newspaper3k>=0.2.8

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

feedparser has known historical advisories, and without version pinning there is no assurance that deployments avoid affected releases. Since this skill consumes untrusted feeds from the public internet, parser vulnerabilities are more relevant than in a closed-input application.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

beautifulsoup4 is declared with a minimum version rather than an exact version, which permits uncontrolled upgrades. That creates supply-chain and stability risk because the installed package may vary by install time and environment.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.11
beautifulsoup4>=4.12.3
openai>=1.30.0
newspaper3k>=0.2.8
lxml[html_clean]>=5.2.1

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The openai package is unpinned, so deployments may receive different versions with changed behavior or newly introduced flaws. While this file alone does not prove exploitation, allowing unconstrained dependency resolution is a real supply-chain hygiene weakness.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.11
beautifulsoup4>=4.12.3
openai>=1.30.0
newspaper3k>=0.2.8
lxml[html_clean]>=5.2.1
python-dateutil>=2.9.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

newspaper3k is unpinned despite being used for article fetching/parsing from external content sources. For a skill that processes untrusted web content, reproducible parser versions matter because silent upgrades can introduce exploitable parsing behavior or dependency issues.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

feedparser>=6.0.11
beautifulsoup4>=4.12.3
openai>=1.30.0
newspaper3k>=0.2.8
lxml[html_clean]>=5.2.1
python-dateutil>=2.9.0