Security audit

ai-daily-report

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI news report generator, but its self-hosted Feishu deployment example exposes a public webhook without real request authentication, which could let outsiders trigger paid AI calls.

Review before installing for any shared or enterprise Feishu bot. The main skill is not deceptive or destructive, but do not deploy the provided self-hosted webhook example as-is: add Feishu signature verification, timestamp and nonce replay checks, schema validation, rate limits, dependency pinning, and clear rules for what chat data may be sent to external AI providers.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: deploy-guide.md:46
Finding: Feishu Webhook Signature Headers Are Read but Never Validated
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: deploy-guide.md:96
Finding: Python Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description activates on broad requests like generating AI daily reports, organizing AI updates, or analyzing AI news, which can match many ordinary prompts and cause the skill to trigger unexpectedly. Over-broad activation increases the chance the agent performs autonomous web retrieval and structured output when the user did not explicitly request this skill behavior, creating scope overreach and possible unintended data handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata and content prescribe Chinese-language output without offering user choice, which can override user preferences or higher-level assistant language settings. This is risky because it can degrade reliability, produce unexpected responses, and create prompt-priority conflicts in multilingual environments, though it is not directly a security compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The deployment guide instructs operators to forward Feishu user messages to external AI providers such as OpenAI or Claude, but it does not warn that chat content may leave the organization and be processed by third-party services. In an enterprise messaging context, users may send sensitive business data, so the omission can lead to unintentional data disclosure, privacy violations, or compliance issues during deployment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and source descriptions only in Chinese, with no indication that the skill is region-specific or that users can opt into this language, which may conflict with an organizational policy requiring language choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.