World News Aggregator Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:19 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent news aggregator, but it needs review because its helper script can automatically install unpinned Python packages and one feed is fetched without HTTPS.

Install and run this only in an isolated virtual environment or container. Review the source before use, install dependencies explicitly from pinned versions, avoid the script's automatic pip path, and treat retrieved article text and links as untrusted external content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/fetch-news.py:17

Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content

View full analysis

=2.31.0 urllib3>=2.0.0 # RSS Feed Parsing feedparser>=6.0.10 # HTML Parsing beautifulsoup4>=4.12.0 lxml>=4.9.0 # JSON Processing json5>=0.9.0 # Date/Time Handling python-dateutil>=2.8.2 pytz>=2023.3 # Optional: Browser Automation (for anti-bot sites) # playwright>=1.40.0 # Optional: Markdown Output markdown>=3.5.0 # Optional: CLI Interface # click>=8.1.0 ``` `README.md:45-51`: ```bash # Directly add from the remote repository npx skills add https://github.com/BODYsuperman/world-news-aggregator-skill ``` ### Technical Analysis When either `requests` or `feedparser` cannot be imported, the script automatically invokes pip without obtaining explicit user approval. Python package installation can execute package build backends and installation-related code with the privileges of the user running the Skill. The dependency declarations use open-ended lower bounds rather than exact, reviewed versions and hashes. A future dependency release could therefore be selected without a corresponding review of the Skill. The requirements file also contains multiple packages that the implementation does not import, including `beautifulsoup4`, `lxml`, `json5`, `python-dateutil`, `pytz`, and `markdown`. These packages ...[truncated 2097 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch-news.py:40

Finding

News Feed Retrieved over Plaintext HTTP

Content

View full analysis

List[Dict]: """Fetch and parse arXiv Atom feed.""" entries = [] try: response = requests.get(url, timeout=15) response.raise_for_status() feed = feedparser.parse(response.content) ``` ### Technical Analysis The arXiv source uses HTTP rather than HTTPS. HTTP provides neither server authentication nor transport integrity. An attacker with a network position between the Skill and the feed endpoint can observe or modify the response before `feedparser` processes it. Feed fields such as titles, summaries, authors, and links are incorporated into Markdown or JSON output without authenticity verification. A network attacker could therefore replace legitimate entries with fabricated reports, phishing links, or adversarial text intended to influence a user or a downstream AI Agent. The fetched response is parsed as data and is not directly executed by the Python script. Accordingly, this issue does not by itself establish native code execution. Its primary effect is loss of content integrity and trustworthiness. ### Attack Path 1. A user invokes the Skill with the `ai` source enabled. 2. `fetch_arxiv` sends a plaintext HTTP request to `export.arxiv.org`. 3. An attacker on the same untrusted n ...[truncated 996 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx skills add without pinning a specific version of the skills package or otherwise constraining what code is fetched and executed. This creates a supply-chain risk: users may execute a changed or compromised package version at install time, and the zero-config/install-from-remote context makes this more likely to be followed verbatim.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The scenario-based examples are broad natural-language phrases like '生成今日科技早报' and '国内有什么新政策', which overlap with ordinary conversation rather than clearly scoped command invocations. In an agent skill system, that can cause unintended triggering, making the skill activate on unrelated user dialogue and fetch/process external content without explicit intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and introductory content are written entirely in Chinese and present the skill as a Chinese-language assistant experience. Under the policy, language constraints should not be forced without user opt-in or a clearly documented, justified locale restriction; no such opt-in or justification is provided here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic dependency installation expands the script's capabilities beyond fetching feeds by allowing package installation and subprocess execution at runtime. In an agent skill context, this is more dangerous because simply running the skill can mutate the environment, pull unreviewed code from external registries, and trigger installer code execution without explicit user approval.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

The script automatically invokes pip via subprocess when imports fail, which introduces package-management side effects and command execution during what appears to be a read-only news fetch operation. While the command is not shell-injected, it can install arbitrary packages from the environment's configured indexes and execute package install hooks, making it risky in agent or automation contexts.

Content

Scanner excerpt · scripts/fetch-news.py (reported line 23)May include surrounding context.

python

except ImportError:
    print("Installing dependencies...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "-r", "requirements.txt"])
    import requests
    import feedparser

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code formats its user-facing report entirely in Chinese, including headings and field labels, with no option for users to select another language. That creates a natural-language locale policy concern because it forces a specific language without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README’s user-facing instructions and examples are written entirely in Chinese, which imposes a language-specific interaction model without stating that the skill is China/Chinese-specific or offering alternatives. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The package description is written entirely in Chinese ("全球信息参考 - 多元聚合全球科技、股市、AI 论文、军事技术、政策情报") with no indication that users can choose another language or locale. Under the language/locale policy, a skill should not impose a specific language experience without explicit opt-in or clear region-specific justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time and can unintentionally include vulnerable or incompatible releases. This weakens supply-chain reproducibility and makes it difficult to verify whether a safe version is consistently installed.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

# Optional: Only needed if running standalone fetch scripts

# HTTP Requests
requests>=2.31.0
urllib3>=2.0.0

# RSS Feed Parsing

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The manifest does not pin requests, and the package has multiple known advisories across versions. Because this skill appears to aggregate world news and likely performs outbound HTTP fetching, an affected requests version could expose sensitive credentials or weaken request-handling security in a realistic execution context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using an unpinned urllib3 version allows installation of any release at or above the minimum, which reduces reproducibility and can expose deployments to newly introduced vulnerable versions. For network-facing libraries, version drift increases supply-chain risk and complicates incident response.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

# HTTP Requests
requests>=2.31.0
urllib3>=2.0.0

# RSS Feed Parsing
feedparser>=6.0.10

Unverifiable Dependency: urllib3 has 16 known advisory(ies) (CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

urllib3 has known advisories and is left unpinned, making it impossible to verify whether deployments use a safe version. In a news aggregation skill that performs network operations, a vulnerable HTTP client stack can increase exposure to redirect, proxy, or decompression-related issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

A minimum-only version constraint for feedparser means the installed version is not deterministic and may vary by environment or time. That makes it harder to confirm whether known parser-related vulnerabilities are avoided and increases dependency hygiene risk.

Content

Scanner excerpt · requirements.txt (reported line 9)May include surrounding context.

text

urllib3>=2.0.0

# RSS Feed Parsing
feedparser>=6.0.10

# HTML Parsing
beautifulsoup4>=4.12.0

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

feedparser has a history of advisories and is not pinned, so the actual installed version may be vulnerable without visibility. Given that this skill likely consumes third-party RSS feeds, parser security matters more because it processes untrusted external content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Unpinned beautifulsoup4 introduces non-reproducible installs and may pull in versions with unexpected behavior changes or unresolved security issues. While not necessarily immediately exploitable on its own, it contributes to avoidable supply-chain uncertainty.

Content

Scanner excerpt · requirements.txt (reported line 12)May include surrounding context.

text

feedparser>=6.0.10

# HTML Parsing
beautifulsoup4>=4.12.0
lxml>=4.9.0

# JSON Processing

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

An unpinned lxml dependency is more concerning because parser libraries often process untrusted content and have a history of security issues. Allowing any version above a minimum can result in inconsistent installations and accidental exposure to vulnerable parser behavior.

Content

Scanner excerpt · requirements.txt (reported line 13)May include surrounding context.

text

# HTML Parsing
beautifulsoup4>=4.12.0
lxml>=4.9.0

# JSON Processing
json5>=0.9.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

lxml is unpinned despite multiple known advisories, and parser libraries commonly handle attacker-controlled markup. In this skill's context of HTML/news parsing, that increases concern because vulnerable parser behavior could be reached through malicious feed or page content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

json5 is declared with a lower-bound constraint only, which permits version drift and makes security posture unverifiable across environments. This is a supply-chain hygiene issue rather than evidence of a direct exploit path in this file.

Content

Scanner excerpt · requirements.txt (reported line 16)May include surrounding context.

text

lxml>=4.9.0

# JSON Processing
json5>=0.9.0

# Date/Time Handling
python-dateutil>=2.8.2

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

python-dateutil is not pinned, so installations may vary over time and by environment. This undermines reproducibility and can mask whether a known-safe version is being used.

Content

Scanner excerpt · requirements.txt (reported line 19)May include surrounding context.

text

json5>=0.9.0

# Date/Time Handling
python-dateutil>=2.8.2
pytz>=2023.3

# Optional: Browser Automation (for anti-bot sites)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

An unpinned pytz dependency creates the same reproducibility and verification problems as other open-ended constraints. Although the direct exploitability is limited from this file alone, it still weakens dependency governance.

Content

Scanner excerpt · requirements.txt (reported line 20)May include surrounding context.

text

# Date/Time Handling
python-dateutil>=2.8.2
pytz>=2023.3

# Optional: Browser Automation (for anti-bot sites)
# playwright>=1.40.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

markdown is unpinned, so future installs may resolve to versions with different security characteristics or behavior. Since markdown processing can interact with untrusted text in some applications, lack of pinning increases risk and hampers assurance.

Content

Scanner excerpt · requirements.txt (reported line 26)May include surrounding context.

text

# playwright>=1.40.0

# Optional: Markdown Output
markdown>=3.5.0

# Optional: CLI Interface
# click>=8.1.0

Unverifiable Dependency: markdown has 2 known advisory(ies) (CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

markdown has known advisories and is not pinned, so there is no assurance that installed versions are free from disclosed issues. The risk is somewhat reduced here because the dependency is marked optional, but if used to render untrusted text, vulnerable versions could still create security problems.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function docstring and CLI help imply the script fetches news within a specified time range, and line L140 computes a cutoff timestamp. But the cutoff is never used, so results are not actually restricted by the requested hours value, creating a direct intent-code divergence in the documented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.