Walter Info

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.1.0

Overview

This weather and e-commerce news skill mostly matches its stated purpose, but it includes an undocumented cleanup script that deletes a local skill file and fetches news with TLS verification disabled before AI summarization.

Review this skill before installing. The main weather/news behavior is recognizable, but remove or ignore the undocumented cleanup.py and check_files.py scripts, restore TLS certificate verification before fetching news, and only summarize llm_input files with a constrained agent that treats article text as untrusted source material. Expect Chinese-language reports and local output-file writes under the skill output directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch_news.py:143

Finding

TLS Certificate Validation Disabled for News Retrieval

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/run.py:98

Finding

Untrusted Remote Article Content Is Passed to an AI Agent Without an Instruction Boundary

Content

View full analysis

]*>(.*?)', raw, re.DOTALL | re.I) parts = [] for p in paragraphs: text = re.sub(rb'<[^>]+>', b'', p).strip() text = text.decode('utf-8', errors='replace') if len(text) < 30: continue if any(kw in text for kw in ['©', '版权所有', '转载', '未经授权']): continue parts.append(text) if len(parts) >= 8: break full_text = '\n'.join(parts) ... llm_input.append({ "title": title, "url": url, "full_text": full_text, "current_description": item.get("description", ""), }) ... with open(llm_input_path, "w", encoding="utf-8") as f: json.dump({ "date": date_str, "generated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"), "articles": llm_input, }, f, ensure_ascii=False, indent=2) ``` The Skill documentation explicitly directs an AI Agent to consume this file: ```text run.py writes llm_input_*.json containing the complete CIFNews Top 10 article text ↓ AI Agent reads it and generates an LLM summary for every CIFNews article ``` ### Technical Analysis Article bodies are externally controlled content. The code strips HTML tags and excludes a small set of copyright-related strings, but it does not distinguish article data from instructions directed at an AI model. Consequently, an article can contain text such as instructions to ignore the summarization task, reveal contextual information, modify files, or invoke available tools. That text is copied verbatim into `full_text` and then deliberately presented to an AI Agent. JSON serialization prevents conventional code execution but does not mitigate prompt injection. The vulnerability occurs at the semantic boundary: un ...[truncated 2038 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the underlying skill actually deletes a local configuration file and modifies local files while claiming only to fetch weather/news and generate reports, that is a significant transparency and safety issue. Undeclared destructive filesystem actions can lead to loss of secrets, broken configuration, or user data corruption, especially in agentic systems where users rely on the manifest to understand risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the underlying skill actually deletes a local configuration file and modifies local files while claiming only to fetch weather/news and generate reports, that is a significant transparency and safety issue. Undeclared destructive filesystem actions can lead to loss of secrets, broken configuration, or user data corruption, especially in agentic systems where users rely on the manifest to understand risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If the underlying skill actually deletes a local configuration file and modifies local files while claiming only to fetch weather/news and generate reports, that is a significant transparency and safety issue. Undeclared destructive filesystem actions can lead to loss of secrets, broken configuration, or user data corruption, especially in agentic systems where users rely on the manifest to understand risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the underlying skill actually deletes a local configuration file and modifies local files while claiming only to fetch weather/news and generate reports, that is a significant transparency and safety issue. Undeclared destructive filesystem actions can lead to loss of secrets, broken configuration, or user data corruption, especially in agentic systems where users rely on the manifest to understand risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the underlying skill actually deletes a local configuration file and modifies local files while claiming only to fetch weather/news and generate reports, that is a significant transparency and safety issue. Undeclared destructive filesystem actions can lead to loss of secrets, broken configuration, or user data corruption, especially in agentic systems where users rely on the manifest to understand risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the underlying skill actually deletes a local configuration file and modifies local files while claiming only to fetch weather/news and generate reports, that is a significant transparency and safety issue. Undeclared destructive filesystem actions can lead to loss of secrets, broken configuration, or user data corruption, especially in agentic systems where users rely on the manifest to understand risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script deletes a local configuration-related file and lists directory contents, behavior that is unrelated to the stated purpose of a weather and cross-border e-commerce information skill. Even though it targets a specific file path, unauthorized file manipulation and filesystem enumeration expand the skill's capability unnecessarily and can damage local state or expose environment details.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code performs direct local file deletion via os.remove on a file inside the skill directory without any user confirmation or runtime justification tied to the skill's advertised functionality. In the context of an informational weather/news skill, this is especially suspicious because destructive filesystem access is unnecessary and could be repurposed or normalized as a precedent for tampering with local files.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · output/news_report_20260407.json (reported line 9)May include surrounding context.

json

{
  "date": "20260407",
  "generated_at": "2026-04-07 23:15:38",
  "type": "news",
  "source": "ennews / cifnews",
  "data": [
    {
      "title": "彻底终结灰色玩法？亚马逊新规落地",
      "description": "亚马逊新规收紧定价管理，虚标划线价被终结，4月下旬至5月中旬分阶段生效，跨境电商竞争转向品牌化运营。",
      "source": "cifnews",
      "url": "https://www.cifnews.com/article/184913",
      "published_at": "2026-04-07T00:00:00Z",
      "source_tier": "unrated",
      "impact_score": 60.0,
      "core_keywords": [
        "亚马逊"
      ],
      "summary_type": "llm"
    },
    {
      "title": "卖家故事：深圳亚马逊大卖星商创新如何攻破欧洲难题？",
      "description": "星商创新以数据�

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · output/cifnews_20260407.md (reported line 31)May include surrounding context.

md

**链接**: https://www.cifnews.com/article/184908
**权重分**: 60.0

### 3. 一键诊断：四步提升亚马逊商品当日达比例，销量增长20%不是‌空谈
**发布时间**: 2026-04-07T00:00:00Z
**来源**: cifnews
**概要**: 通过优化库存水平、补货频次、入库方式、送达追踪四个维度提升FBA配送速度，拉动销量增长20%。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · output/news_report_20260407.md (reported line 20)May include surrounding context.

md

**链接**: https://www.cifnews.com/article/184908
**权重分**: 60.0

### 3. 一键诊断：四步提升亚马逊商品当日达比例，销量增长20%不是‌空谈
**发布时间**: 2026-04-07T00:00:00Z
**来源**: cifnews
**概要**: 通过优化库存水平、补货频次、入库方式、送达追踪四个维度提升FBA配送速度，拉动销量增长20%。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file-level documentation and all implemented steps are exclusively about fetching, preparing, summarizing, and exporting cross-border e-commerce news. There is no code here for querying weather data, handling city/continent weather inputs, or generating weather outputs, creating a clear mismatch with the manifest description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill advertises and documents capabilities that involve filesystem access, file generation, networking, and shell execution, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can cause overbroad invocation privileges and make it harder to enforce least privilege or review what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger text is broad enough to match generic requests for reports, weather, or e-commerce information, which increases the chance of unintended activation. In an agent setting, overbroad triggers can cause the skill to run in contexts the user did not intend, exposing local files, making network calls, or generating outputs outside the proper scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all headings, metadata, and article summaries in Chinese and does not offer any language selection, opt-in, or justification for the locale restriction. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill for weather forecasts and cross-border e-commerce hotspot news, but this output includes multiple general business, automotive, trade, and cloud-product news items that are not clearly cross-border e-commerce hotspots. Examples include Amazon DevOps Agent, Tesla and BYD UK car sales, and general trade statistics, indicating broader news aggregation than the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and entire report are presented exclusively in Chinese, with no indication that language selection is optional or limited to a documented region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON weather report uses Chinese locale-specific keys and labels throughout, such as continent names, city names, and day labels like "今天/明天/后天", while weather conditions remain partly in English. For a general weather data file, this imposes a specific language/locale without any visible opt-in or justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This codebase's user-facing natural language is fixed to Chinese in the module description and later output strings, with no indication that the user can opt into another language. The policy specifically flags language or locale constraints when a skill forces a specific language without user choice or documented justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run.py (reported line 44)May include surrounding context.

python

print("=" * 50)
    print("Step 1: Python 抓取 enews + cifnews")
    print("=" * 50)
    result = subprocess.run(
        [sys.executable, os.path.join(SCRIPT_DIR, "fetch_news.py")],
        cwd=SCRIPT_DIR
    )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

TLS certificate validation is explicitly disabled by turning off hostname checks and setting verify_mode to CERT_NONE before fetching article content. This allows a man-in-the-middle attacker to spoof cifnews pages and feed tampered content into the LLM input and generated reports, undermining data integrity and potentially enabling prompt/content injection into downstream agent processing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The printed instructions say the agent should read llm_input_*.json and then call update_json_with_llm_summaries(), and later the CLI example passes that same llm_input_path to --update-summaries. However, the actual handler expects a file shaped like {"date": "...", "summaries": {"url": "summary", ...}}, not the intermediate article-content input file, so the documentation actively misstates how the code should be used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly state that the AI Agent must generate summaries in Chinese ("50 字以内中文摘要"). This is a natural-language locale policy constraint, and the file does not provide an opt-in, alternative language option, or clear region-specific justification for forcing Chinese output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The config uses Chinese region and city names throughout the user-facing data structure, such as continent keys and city labels, with no indication that the locale is optional or region-specific. This can violate the language/locale policy when a skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file presents all headings, metadata, and content in Chinese only, with no indication that the skill is limited to Chinese-speaking users or that users can opt into that language. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.