Security audit

botlearn-rss-manager

Security checks for vulnerabilities and agentic risk

Overview

This RSS skill has a coherent purpose, but it directs broad outbound fetching and silent feed URL changes without enough safety boundaries for untrusted URLs.

Install only if you are comfortable with the agent contacting third-party feed and article URLs from its runtime. Before use, restrict accepted URLs to http/https, block localhost/private/metadata addresses, validate every redirect and discovered URL, limit response sizes and redirects, and require confirmation before permanently changing stored feed URLs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: strategies/main.md:11
Finding: Unrestricted Feed and Article URL Fetching Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `strategies/main.md:11-20`; related behavior in `knowledge/domain.md:161` and `knowledge/domain.md:199-203` **Vulnerability Type**: Server-Side Request Forgery (SSRF) caused by unrestricted outbound URL fetching and redirect handling **Risk Level**: High ### Vulnerable Code Snippets From `strategies/main.md:11-20`: ```markdown - Enumerate all subscribed feed URLs from the user's feed list - For each feed, execute a conditional HTTP GET request: - Include `If-None-Match` (ETag) and `If-Modified-Since` headers from the previous poll - Set `Accept: application/rss+xml, application/atom+xml, application/xml, text/xml;q=0.9` - Set a 30-second timeout per feed - Process HTTP responses: - IF **304 Not Modified** THEN skip parsing, record successful poll, move to next feed - IF **301 Moved Permanently** THEN update the stored feed URL and process the redirect target - IF **410 Gone** THEN mark the feed as dead, alert the user, and remove from active polling - IF **429 Too Many Requests** THEN read `Retry-After` header, schedule retry, and double the polling interval for this feed ``` From `knowledge/domain.md:161`: ```markdown 5. **Fetch the linked URL** -- fallback when feed only provides a title or minimal snippet ``` From `knowledge/domain.md:199-203`: ```markdown When given a website URL instead of a feed URL, discover feeds by: 1. Check `<link rel="alternate" type="application/rss+xml">` in HTML `<head>` 2. Check `<link rel="alternate" type="application/atom+xml">` in HTML `<head>` 3. Try common paths: `/feed`, `/rss`, `/atom.xml`, `/feed.xml`, `/rss.xml`, `/index.xml`, `/feeds/posts/default` (Blogger) 4. Check `/.well-known/` resources 5. Parse the page for embedded feed links in the body content ``` ### Technical Analysis The Skill instructs the Agent to perform HTTP requests against feed URLs supplied by users, process redirect targets, discover additional URLs from remote HTML, and f ...[truncated 3243 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. **Restrict supported schemes** - Permit only `https` and, where explicitly necessary, `http`. - Reject `file`, `ftp`, `gopher`, `data`, and other schemes. - Reject URLs containing embedded credentials. 2. **Validate every destination** - Resolve the hostname before connecting. - Block IPv4 and IPv6 loopback, private, link-local, multicast, reserved, unspecified, and carrier-grade NAT ranges. - Explicitly block known cloud metadata destinations. - Apply the same checks to user-supplied feeds, discovered feeds, embedded article links, media URLs, and every redirect target. 3. **Harden redirect processing** - Disable automatic redirect following unless each hop is validated. - Set a small redirect limit. - Reject redirects that change to a forbidden scheme, port, hostname, or address range. - Do not permanently store a redirected feed URL until its destination passes validation. 4. **Mitigate DNS rebinding** - Bind the connection to the address that passed validation. - Revalidate after DNS resolution changes. - Ensure all returned addresses are safe rather than accepting a hostname when only one of several addresses is permitted. 5. **Minimize secondary fetching** - Do not fetch linked article pages by default. - Require explicit user approval or a clearly defined trusted-host policy before following article links. - Treat all feed, article, media, and HTML-discovered URLs as untrusted input. 6. **Apply resource controls** - Limit response size, decompressed size, request count, concurrent requests, and total processing time. - Retain the existing timeout but supplement it with these controls. - Reject malformed or excessively long URLs before issuing requests. 7. **Enforce network isolation** - Route outbound requests through a restricted proxy with deny rules for internal networks and metadata services. - Run the Skill in an environment without access to ...[truncated 477 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger list contains very generic terms such as 'feed', 'digest', and 'subscribe' that are common in many unrelated user requests. This can cause the skill to activate outside its intended RSS-management context, leading to unintended tool behavior, response hijacking, or interference with more appropriate skills.

Ae1

High

Category: analysis-evasion
Content: 2. Apply the appropriate phase from strategies/main.md based on the task
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - **Fix**: Resolve all elements by their full namespace URI (`http://purl.org/rss/1.0/modules/content/`), not the prefix string. Use a namespace-aware XML parser ### 3. Trusting Feed-Declared Encoding - **Problem**: Accepting the XML declaration's encoding attribute (`encoding="UTF-8"`) without verification. Many feeds declare UTF-8 but actually serve Windows-1252 or ISO-8859-1, causing mojibake in non-ASCII characters - **Fix**: Detect actual encoding using BOM detection and byte-pattern analysis. If detected encoding conflicts with declared encoding, trust the detection. Always validate that decoded text is valid Unicode before processing ### 4. Ignoring Content Type Negotiation
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation rule 'WHEN the user requests RSS feed management, digest generation, or feed subscription' is broad and does not define exclusion conditions or required RSS-specific signals. Because 'digest generation' and 'feed subscription' are ambiguous, the skill may activate on unrelated tasks, increasing the chance of unintended delegation and incorrect handling of user requests.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The strategy directs the agent to make outbound HTTP requests to all subscribed feed URLs and to automatically persist URL changes on 301 redirects, but it does not require explicit user awareness, consent, or validation of redirect targets. In an RSS skill this behavior is functional, yet it can still expose the user's environment to unwanted external requests, tracking, SSRF-like access to internal endpoints if feed URLs are untrusted, or silent source changes that alter what is being monitored.

Static analysis

No suspicious patterns detected.