Security audit

last30days

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it includes under-disclosed extra data flows and developer utilities that deserve review before installation.

Install only if you are comfortable with research topics and selected result text leaving your machine for AISA and other source APIs. Do not configure webhook delivery unless you trust the destination, avoid the Xiaohongshu source unless you intend to use a local logged-in service, and do not run the evaluation scripts against untrusted git revisions while API keys are present.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (123)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a multi-source recent-research aggregation skill. This code chunk instead operates downstream on already collected data: it initializes a local DB, lists watchlist topics, loads new findings, computes summary statistics and week-over-week engagement changes, marks stale topics, saves briefing JSON files under the user's home directory, and shows archived briefings. These are materially different behaviors from source aggregation across the named platforms. While JSON output is present and summarization of prior findings could support the broader tool, the primary behavior of this chunk is briefing generation/storage rather than external search/social aggregation. Therefore the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a full-featured recent social research aggregation skill spanning many external platforms and analytical functions. The actual code chunk does not implement any of those behaviors. It only checks for an installed Python 3.12+ interpreter and reports its path. While such a script could be a support utility for the broader skill, the supplied code chunk itself has a materially different primary purpose and no observable functionality related to the declared description. Therefore this is a clear description-behavior mismatch for the provided code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向最终用户的“最近30天多源搜索聚合”能力；而提供的代码块并不直接执行该技能的主功能，也不实现规划、聚类、重排给用户使用。它的核心目的是离线/开发期评估两个版本的 last30days 搜索结果质量与稳定性。虽然代码中会调用 last30days.py，并处理 Reddit/X/YouTube 等来源结果，这只是为了比较评测，不是对外提供聚合检索能力本身。此外，声明提到 GitHub 源，但本代码的 V2_SOURCE_KEYS 中未见 GitHub；更重要的是，代码具有未声明的 git worktree 管理、模型评审、指标分析和报告生成能力。因此描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a multi-source recent-social-research aggregation skill. The actual code chunk does not access any external services or perform search/aggregation at all; it only transforms already-saved local JSON reports into compact Markdown files. This is a materially different primary purpose from the declared behavior. While the header references 'last30days', the implementation shown is strictly a post-processing/rendering step, not the described data gathering and synthesis capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises substantial multi-source recent-research functionality, but the supplied code chunk is only an empty module initializer with a comment. Based on this code alone, none of the described capabilities are implemented or evidenced. This is a material description-to-code mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 代码与描述存在明显能力范围不一致。实际代码访问的资源仅包括 AISA chat completions、Twitter/X、YouTube、Tavily 和 Polymarket；没有任何 Reddit、TikTok、Instagram、Hacker News、GitHub 的检索实现。描述中的“聚合最近30天”也未被完整实现：Twitter 通过 since: 参数支持起始日期，Tavily 支持 date_range，YouTube 仅在解析阶段做有限过滤，Polymarket 只是开放市场搜索，并无统一的30天窗口聚合控制。另有 chat_completion 的 JSON 输出支持与描述部分一致，但“规划、聚类、重排”等关键能力在此代码块中不存在。因此，声明的主要能力明显超过了代码实际行为，属于实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 从该片段看，技能描述强调的是一个面向终端任务的“最近30天多平台研究/聚合”能力；但实际代码只是底层配置与可用性判断层，负责读取 ~/.config/last30days/.env、项目内 .claude/last30days.env、环境变量，并根据 AISA API key 判断若干来源是否可用，还会对 Xiaohongshu 本地/宿主 HTTP 服务进行探测。虽然这些行为可能是实现该技能的支持性细节，但就“这段代码实际做什么”而言，其主行为与声明的高层功能存在明显偏差：未见真正的抓取、检索、聚合、规划、聚类、重排或输出逻辑。此外，代码暴露的平台集合与声明也不一致，增加了未声明能力。因此应判定为描述与该代码片段行为不完全匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 该描述宣称的是一个跨多个社交/内容平台的“最近30天聚合研究”技能，覆盖大量来源并支持更高层的规划、聚类、重排与 JSON 输出。但实际代码块是一个 GitHub 专用模块，核心行为是调用 GitHub Search API / repos API / releases API / readme API，对 issues、PR、评论、仓库信息、release、README、star 数和人物贡献进行检索与富化。就该代码块本身而言，其主要目的明显更窄且不同于声明的多平台聚合器，因此描述不能准确代表这段代码的实际行为。虽然 GitHub 是声明来源之一，因此存在部分重合，但整体范围和主功能存在实质不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad recent-social-research aggregator spanning numerous platforms plus web search. However, this code chunk’s primary function is narrowly scoped: it performs web search through AISA/Tavily and parses the results. The helper functions only normalize dates, test date ranges, and extract domains. There is no evidence here of connectors to Reddit, X/Twitter, YouTube, TikTok, Instagram, Hacker News, Polymarket, GitHub, or of higher-level orchestration such as planning, clustering, or reranking. Because the implemented behavior is materially narrower than the declared purpose and accesses only a subset of the declared resources, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个最近30天的多平台社交/研究聚合技能，明确列出了 Reddit、X/Twitter、YouTube、TikTok、Instagram、Hacker News、Polymarket、GitHub 和 web search，但没有提到 Pinterest。该代码块的核心和唯一功能是 Pinterest discovery：构造 site:pinterest.com 查询，经 AISA/Tavily 获取网页结果，筛选 Pinterest URL 与日期，并输出 Pinterest pin 结构化数据。因此，这不是单纯的底层实现细节，而是一个未声明的数据源/能力。虽然代码也使用 AISA，和声明中的 AISA 规划生态相关，但其实际行为仍与声明的平台范围存在实质不一致，所以应判定为 mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 描述与代码的核心主用途基本一致：都是做最近30天的多源社媒/网络研究聚合，并包含规划、重排、聚类等流程。代码也确实覆盖了声明中的主要来源（Reddit、X、YouTube、TikTok、Instagram、Hacker News、Polymarket、GitHub、web grounding）。但存在明显未声明能力：available_sources 和 _retrieve_stream 中额外支持 Threads、Pinterest、Xiaohongshu；_run_supplemental_searches 还会从已取回内容中抽取实体/账号并对 X 进行二阶段定向补充搜索。这些不是单纯实现细节，而是新增的数据源与检索能力，因此应判定为描述与行为存在不完全匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 描述的是一个多平台近期社媒/网络研究聚合技能，而代码块实际只是其中一个子模块：Polymarket 搜索器。它访问公开的 Polymarket Gamma API，执行查询扩展、并行检索、事件/市场过滤、结果归一化和相关性排序。虽然“Polymarket”确实在声明的平台列表中，且结果也可作为整体技能的一部分，但就所给代码块本身而言，其实际行为远窄于声明的整体能力，且声明中的关键特征（多平台聚合、30天结果范围、AISA 规划/聚类）在此代码中并未实现。根据‘描述是否准确代表所给代码块实际行为’这一标准，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a multi-source research collection skill, but this code chunk is a quality-assessment helper that inspects config/results metadata after research has already run. Its primary function is scoring source coverage and producing remediation/upgrade text, not fetching or aggregating content from the declared platforms. While it references some overlapping sources and AISA configuration, the actual behavior is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该描述与代码片段存在明显范围不一致。代码是一个 Reddit 专用辅助模块，包含 Reddit 查询扩展、subreddit 发现、评论抓取和 enrichment，且注释明确写明是 'Reddit helpers'、走 'public Reddit JSON path'。从这段代码看，主要目的不是多平台聚合，而是单一平台 Reddit 检索与评论增强。虽然声明中的整体技能可能在其他文件中实现更多平台与规划能力，但就当前提供的代码块而言，其实际行为无法支撑所宣称的广泛多源聚合与 AISA 规划/聚类/重排能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向多平台近况研究的聚合/检索技能，而实际代码仅是一个内部排序辅助组件，用于计算查询与文本之间的相关性。该代码不执行数据抓取、聚合、时间过滤、平台访问、研究规划、聚类或输出格式化。虽然“重排”与相关性打分存在弱相关，但这里实现的只是底层支持函数，无法代表声明中的主要能力。因此描述与代码行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该描述把技能定位为一个跨平台“近30天研究聚合器”，核心能力应是查询/抓取 Reddit、X、YouTube、TikTok、Instagram、Hacker News、Polymarket、GitHub 和 web search，并进行规划、聚类、重排、JSON 输出。然而给出的代码块仅是展示层/报告格式化层：它接受已经生成好的 report 数据结构，输出 markdown 文本，包括标题、时间范围、来源统计、证据聚类、代表候选、评论和 transcript highlights、Polymarket odds、source coverage 与 errors。虽然代码中出现 clusters、ranked_candidates、items_by_source 等字段，但没有任何网络访问、API 调用、搜索、抓取、近30天过滤的主流程、规划逻辑或 JSON 序列化逻辑。根据评估标准，这属于“声明的主要用途与实际代码行为 materially different primary purpose”——代码主要目的是渲染现有结果，而不是执行声明中的研究聚合能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Most of the code is broadly consistent with the declared research pipeline: it reranks shortlisted candidates for relevance, applies fallback relevance scores, and includes prompt-injection defenses for untrusted scraped content. However, the code also contains a separate score_fun path that scores items for humor, cleverness, wit, and shareability, with special preference for short punchy content and viral markers. That entertainment-oriented ranking capability is not reflected in the declared description, which frames the skill as recent social/web research aggregation and analysis. This is a meaningful undeclared capability rather than a minor implementation detail, so the description does not fully accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 声明描述的是一个面向多平台近30天社媒研究的聚合技能；而代码片段的实际作用更窄，主要是利用 web search 自动解析与 topic 相关的 subreddit、X 账号、GitHub 用户/仓库，并从新闻搜索结果拼出简短上下文摘要。它确实使用了30天日期范围和 AISA backend，但并没有实现声明中的核心广泛聚合行为，也没有覆盖多数宣称的平台与分析能力。因此属于明显的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk does not implement any of the declared core behavior such as querying social/web platforms, aggregating recent results, planning, clustering, reranking, or producing research outputs. Its primary purpose is unrelated setup/configuration management for an AISA-only runtime. It also writes to a local .env file and probes local executables, which are capabilities not reflected in the declared description. While setup helpers could exist in a broader skill, this specific chunk is materially mismatched with the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full multi-source recent social/web research skill. The supplied code chunk does not perform any source access, external retrieval, platform aggregation, date filtering, or end-to-end research orchestration. It only supports a narrow internal function: extracting a preferred snippet or selecting the most relevant text window from an item's body based on token overlap with a ranking query. While this could be a supporting component of a larger reranking pipeline, the actual code chunk's behavior is materially narrower and different from the declared primary purpose. Therefore, this chunk does not accurately represent the declared skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码块是一个非常具体的 Threads 发现模块：文件名与注释都表明其用途是“Threads discovery for /last30days using the AISA web proxy”。核心函数 search_threads 仅调用 aisa.search_tavily 对 site:threads.net {topic} 进行搜索，随后过滤 URL 和日期并返回 Threads 风格的标准化条目。其余函数也都围绕 Threads 数据解析、作者字段抽取、互动数与相关性计算展开。相比之下，声明描述的是一个最近30天多平台研究聚合器，覆盖多个社交/信息源，并支持规划、聚类、重排和 JSON 输出。代码没有显示这些多源聚合或分析编排能力，因此描述与实际行为存在明显的范围和主用途不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This code chunk does not match the declared description closely enough. The description enumerates specific supported sources—Reddit, X/Twitter, YouTube, TikTok, Instagram, Hacker News, Polymarket, GitHub, and web search—but the actual code accesses Xiaohongshu via REST endpoints, including login status and feed search. Xiaohongshu is an undeclared external resource/platform. While a source-specific client could be a supporting component of a broader aggregator, the explicit platform list in the description makes this materially inconsistent, because the code adds a distinct social source not mentioned in the declared purpose. The code's recent-search normalization behavior is adjacent to the overall skill theme, but the resource accessed is mismatched.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码块的文件名和实现都表明它是“Xquik”的兼容包装层，核心函数 search_xquik/search_and_enrich 只处理 X/Twitter 搜索。它最多通过 AISA 的 twitter 搜索接口或一个 legacy HTTP 接口获取 tweet 列表，然后做字段标准化。声明中强调的是跨多个平台的近30天聚合研究能力，并包含规划、聚类、重排等分析流程；这些在代码中均未出现。虽然使用了 AISA，但仅用于 Twitter 搜索，不足以支撑声明的综合聚合目的。因此描述与实际行为存在明显且实质性的不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 该代码与声明存在实质性不匹配。声明描述的是一个跨多个社交/信息平台的“最近30天聚合研究”技能，而实际代码块是单一的 YouTube 子模块。它的核心行为是：生成 YouTube 查询、调用 AISA 的 YouTube 搜索接口、合并去重结果、可选抓取 YouTube 字幕并提取高亮句子。虽然这可被视为整个大技能中的一个组成部分，但就“该代码块实际做什么”而言，它没有体现声明中的多平台聚合、趋势扫描总控、聚类、重排、或其他平台接入能力。因此若将这段代码作为对该技能描述的代表，实现范围明显更窄，应判定为不准确匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a research aggregation skill spanning many external sources and analysis features. The supplied code chunk does not implement any of that directly; it simply invokes a Python evaluation script. Based on this chunk, the observable purpose is orchestration for evaluating search quality, which is materially different from the declared end-user functionality. While the real functionality could exist inside the invoked Python script, this code chunk itself does not substantiate the declared behavior, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.