Security audit

Cailianpress Unified

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches public Cailian Press telegraph data and stores/query it locally in ways that match its stated purpose, with some operational caveats but no evidence of malicious behavior.

Before installing, expect the skill to contact CLS/Cailian Press endpoints and store fetched telegraph/news records locally. Review retention needs before using the prune script or cron examples, and prefer pinning dependencies plus fixing the SQLite binding bug for reliable operation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cls_sqlite_ingest.py:53
Finding: SQLite ingestion fails because date_key is bound twice
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cls_migrate_jsonl_to_sqlite.py:39
Finding: JSONL-to-SQLite migration fails because date_key is bound twice
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill documentation is entirely in Chinese and does not provide a language choice, translation, or clear opt-in for non-Chinese readers. In a multi-user or mixed-language environment, this can prevent reviewers and downstream users from understanding operational constraints, usage rules, and security-relevant caveats, increasing the chance of misuse or missed risks.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/cls_migrate_jsonl_to_sqlite.py (reported line 83)May include surrounding context.
python
tags_json, sub_titles_json, timeline_json, ad_json, assoc_fast_fact_json, assoc_article_url, assoc_video_title, assoc_video_url, assoc_credit_rating_json, stock_list_json, subjects_json, plate_list_json, content_hash, first_seen_at, last_seen_at, seen_count, date_key ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) """, (article_id, *values, captured_at, captured_at, 1), )

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/cls_sqlite_ingest.py (reported line 97)May include surrounding context.
python
tags_json, sub_titles_json, timeline_json, ad_json, assoc_fast_fact_json, assoc_article_url, assoc_video_title, assoc_video_url, assoc_credit_rating_json, stock_list_json, subjects_json, plate_list_json, content_hash, first_seen_at, last_seen_at, seen_count, date_key ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) """, (article_id, *values, captured_at, captured_at, 1), )

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script fetches remote data via fetch_telegraph_list() and then persists raw and derived content into multiple database tables, but there is no docstring, comment, or user-facing notice explaining that network retrieval and local storage will occur. While the script prints a summary at the end, that output does not disclose the safety-relevant behavior before or during execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The formatter emits all user-facing Markdown labels and messages in Chinese, such as the heading and field names, with no indication that language selection is configurable or intentionally limited to a specific locale. This creates a natural-language policy concern because the skill imposes a language choice on all users without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file defines a fixed timezone of "Asia/Shanghai" and uses it for timestamp normalization, which imposes a specific locale behavior on all outputs. Under the policy, locale-specific behavior should either be user-selectable or clearly justified as region-specific; neither is present in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 70% confidence
Finding: The document leads with Chinese title and primary Chinese explanatory content before the later English overview, which may signal a default language requirement or expectation without explicitly offering a language choice to the user. Under the stated policy, skills should avoid forcing a specific language unless the constraint is documented and justified or users are given an explicit option.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file documents that the skill stores collected telegraph data in a local SQLite database, keeps raw ingest logs for 30 days, and deletes older logs, but it does not explicitly warn users that running the skill will persist fetched data on disk and perform retention-based deletion. For a skill description, these data-affecting behaviors should be disclosed clearly as operational warnings because they can impact local storage, audit expectations, and data lifecycle management.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency is specified as requests>=2.31.0, which allows future unreviewed versions to be installed and makes builds non-reproducible. This increases supply-chain risk because a later vulnerable or malicious release could be pulled in without explicit review or testing.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: Because requests is not pinned to a specific version, it is impossible to verify from this manifest whether the installed package includes fixes for known advisories. The danger is not that requests is inherently unsafe, but that the open-ended constraint can resolve to an affected version in some environments, leaving the skill exposed to publicly known issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The function performs a network request to an external domain using a supplied article_id and custom headers, but there is no docstring, comment, logging, or other user-facing disclosure indicating that external communication occurs. For code files, outbound network calls can warrant a warning when the file itself provides no visible notice of that behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code fixes its timezone to Asia/Shanghai via a global constant, and that locale is then used for date formatting and batch IDs. Because the file contains no natural-language justification or user opt-in for this locale constraint, it can violate the policy against forcing a specific locale without user choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The function is annotated as returning str, but the docstring says Return raw dict for JSON serialization. and the implementation returns result.to_dict(), which is consistent with a dict-like object rather than a string. This is an active contradiction between documentation/type intent and actual behavior, not merely missing detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-facing strings produced by this formatter are all in Chinese, including result summaries and item labels. For a general-purpose formatter, this imposes a fixed language/locale without any opt-in, selection mechanism, or documented region-specific justification, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code appends serialized item data to a persistent JSONL file, which is a file-write operation covered by the missing-warning rule for code files. There is no confirmation prompt, logging/print output, docstring, or comment in this file explaining that snapshot data will be written to disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.