Security audit

德胧外网舆情采集工具

Security checks for vulnerabilities and agentic risk

Overview

This skill is a hotel public-opinion monitoring tool, but its install and automation instructions create review-worthy risks around unpinned code execution, broad scraping, and recurring Feishu delivery to a hardcoded chat.

Review this skill before installing. Do not run the unpinned npx or GitHub build commands on a sensitive machine without pinning versions and verifying integrity. Replace the Feishu chat ID with an approved destination, keep scheduled delivery disabled until explicitly needed, and narrow invocation triggers to Delonix-specific phrases.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:145
Finding: Unverified Remote AutoCLI Source Retrieval, Build, and System-Wide Installation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:350
Finding: Automatic Execution of an Unpinned npm Package
Content: View full analysis
Remediation: View remediation
`. 2. Record and verify the package integrity digest through a lockfile or trusted package-management workflow. 3. Remove `-y` so users can inspect the resolved package and version before execution. 4. Prefer installing dependencies from a reviewed lockfile with `npm ci` rather than executing an implicitly resolved package directly. 5. Verify npm provenance, publisher identity, signatures where available, and the package's lifecycle scripts. 6. Disable lifecycle scripts during installation unless they are required and separately reviewed. 7. Run the installer in a restricted environment without unrelated credentials or privileged filesystem access. 8. Document the precise Feishu permissions requested and require users to approve only the minimum scopes needed to send reports. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:264
Finding: Hardcoded Feishu Recipient in Persistent Daily Delivery Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are generic terms like ‘搜索’, ‘监控’, and ‘行业动态’, which are likely to match many ordinary user requests and cause the skill to activate unintentionally. In a skill that performs external search, scheduled automation, and outbound Feishu delivery, overbroad activation materially increases the chance of unauthorized data collection or transmission from benign conversations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The description presents a fairly full-featured external intelligence collection and automation tool with multiple integrated capabilities: web search summaries, deep collection from many platforms, Feishu card delivery, and scheduled automation. The supplied code chunk only partially matches that: it does automate a daily-report-style workflow and uses a web search summary command, but it does not show any AutoCLI/deep multi-platform scraping, does not actually send Feishu cards, and produces only a minimal markdown template rather than a substantive analysis pipeline. This is a material description-to-behavior mismatch because key advertised capabilities are absent from the code provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises integrated Feishu card delivery and scheduled pushing but does not clearly warn users that external data transmission may continue automatically after setup. This creates a transparency and consent problem: users may invoke or install the skill without understanding that collected content could be sent to third-party services on an ongoing basis.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Documenting ‘每日9:00自动推送’ without a nearby warning or consent flow normalizes continuous background behavior without making the operational or privacy implications explicit. In context, the skill is designed for intelligence gathering and competitor monitoring, so silent recurring push behavior increases the risk of unreviewed dissemination of collected information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description promotes automatic collection and Feishu delivery without a clear upfront warning that the skill may perform scheduled outbound messaging. In context, that is risky because users may invoke what appears to be a search/reporting skill without realizing it could later push content to group chats on a schedule.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes very common terms such as '搜索' and '监控', making accidental invocation more likely during unrelated conversations. In a skill that can lead to external searches, reporting workflows, and scheduled delivery, overbroad activation increases the chance of unintended data collection or action initiation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest declares only web_search, but the documentation relies on Feishu messaging and cron automation capabilities. This mismatch can bypass user expectations and reviewer understanding, making it easier for a skill to cause outbound messaging or persistent scheduled actions without transparent declaration of all required capabilities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill advertises broad scraping across 50+ platforms and even mentions comment collection and user profiling, which materially exceeds narrow hotel-opinion monitoring. In context, this increases privacy, compliance, and abuse risk by enabling expansive surveillance-style collection under a benign-seeming monitoring label.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation expands the skill from web-intelligence usage into downloading, cloning, and compiling third-party software from external sources. That broadens the trust boundary and introduces supply-chain and arbitrary code execution risk unrelated to the core skill purpose, especially in environments where operators may follow instructions verbatim.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill instructs users to execute an unpinned npx package, which fetches and runs whatever version is currently published under that name. This creates a supply-chain risk: a malicious update, account compromise, or unexpected breaking change could result in arbitrary code execution during installation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script’s title, usage text, default keywords, and generated report content are all hard-coded in Chinese, and there is no indication that users can choose another language. This is a natural-language policy concern because it imposes a specific locale without opt-in or an explicit region-specific justification in the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.