T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_news.py:20- Finding
Server-Side Request Forgery Through Unrestricted Deep Article Fetching
- Content
View full analysis
- Remediation
View remediation
Security audit
News Aggregator Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate news aggregation skill, but its deep-fetch mode can retrieve arbitrary article URLs from untrusted feeds and save reports without enough containment or user control.
Review this before installing if your agent runs inside a private network or has access to sensitive files, credentials, or internal services. Use it only in a constrained environment, avoid deep-fetch mode for untrusted sources, pin dependencies, and treat fetched article text and generated reports as untrusted content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/fetch_news.py:20- Finding
Indirect Prompt Injection Through Untrusted Article Content
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Python and NPX Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The phrase '自动生成杂志级排版的中文日报/周报' specifies Chinese output as the default behavior, and the README does not mention any option to choose another language. This is a natural-language locale policy issue because it imposes a language constraint without documented user opt-in or justification.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README instructs users to install the skill via
npx skills addfrom a remote repository without pinning a specific version, commit, or release. This creates a supply-chain risk: the fetched package or remote content could change after review, causing users to install different code than expected.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
cp -r news-aggregator-skill YourProject/.claude/skills/
4. 验证：确保 SKILL.md 存在于目标目录
ls YourProject/.claude/skills/news-aggregator-skill/SKILL.md
text ### 第二步：安装 Python 依赖（如果你的agent足够聪明，可以跳过）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
cp -r news-aggregator-skill YourProject/.claude/skills/
4. 验证：确保 SKILL.md 存在于目标目录
ls YourProject/.claude/skills/news-aggregator-skill/SKILL.md
text ### 第二步：安装 Python 依赖（如果你的agent足够聪明，可以跳过）
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes a network-capable script (
fetch_news.py) across multiple external sources but does not declare any tool scope, permissions, or allowed-tools boundary in the manifest. This creates an authorization and transparency gap: the runtime may permit broader external access than users or reviewers expect, increasing the risk of unintended data access or outbound requests.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description advertises broad, everyday trigger phrases like 'daily scans', 'tech news briefings', and 'finance updates', which overlap with common user requests. This can cause the skill to activate unexpectedly or too eagerly, leading to unanticipated network activity, content retrieval, and report generation when the user did not intend to invoke this specific skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The menu logic treats not only a specific phrase but also unspecified 'similar' help/menu triggers as valid activation signals. Ambiguous trigger matching increases the chance of accidental activation and can induce the agent to read local files (
templates.md) and begin skill-directed behavior without clear user intent.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The response guidelines require the output language to be Simplified Chinese, which is a locale/language constraint. There is no user opt-in, alternative language option, or region-specific justification in the file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill mandates saving every full report to the
reports/directory with a timestamped filename, but it provides no user warning or consent step about local file creation and persistence. This can silently store potentially sensitive queries, fetched article content, and derived analysis on disk, creating privacy, retention, and data leakage risks.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The title and usage instruction are written as directives in Chinese, including '请回复序号…或直接复制指令来执行任务', with no indication that other languages are supported. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency 'requests' is unpinned, so installs may resolve to different versions over time, reducing build reproducibility and creating supply-chain risk if a vulnerable or breaking release is pulled. In a news aggregation skill that fetches remote content from multiple external sources, the HTTP client is security-relevant, so lack of version control modestly increases exposure.
- Content
text requests beautifulsoup4
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The manifest references 'requests' without a version, and that package has multiple known advisories affecting some releases. Because the skill makes outbound requests to numerous remote sources, using an affected version could expose the system to credential leakage, TLS/verification issues, or other request-handling weaknesses, and the lack of pinning prevents verification that the installed version is safe.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency 'beautifulsoup4' is also unpinned, which creates non-reproducible installations and allows unexpected upstream changes to enter the environment. Because this skill parses large amounts of untrusted third-party content from many news sources, parser/library behavior matters and should be controlled.
- Content
text requests beautifulsoup4
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
Several built-in sources are explicitly Chinese platforms such as Weibo, 36Kr, Tencent News, and Wall Street CN, and the script presents them as first-class defaults alongside global sources. Because the file provides no natural-language indication that these locale-specific sources are optional or region-targeted, it effectively imposes a locale/content-region choice without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The template encourages broad external news retrieval across multiple third-party sources but does not disclose that using the skill may trigger network access or send user queries to outside services. While this is not code execution or direct data exfiltration by itself, the lack of transparency can mislead users about where their prompts may go and creates privacy and consent risks, especially if users include sensitive context in requests.
- Content
Static analysis
No suspicious patterns detected.