Daily EnglishNews Reader

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.0.1

Overview

The skill’s core behavior matches its English-learning and Feishu-document purpose, but its setup instructions include risky unpinned installs and suggest retrying an npm installer with sudo.

Review this skill before installing. Its normal behavior is to fetch RSS articles, generate learning content, create a Feishu cloud document, and keep local article history. Do not run the npx installer with sudo; install as an unprivileged user, prefer pinned reviewed package versions, and check the Feishu authorization scopes before granting access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-33
Vulnerability Type: Unpinned package installation and execution
Risk Level: Medium

Relevant code snippet:

yaml

"command": "npx -y @larksuite/openclaw-lark-tools install",
"label": "Install official Lark/Feishu plugin",

yaml

"command": "pip3 install requests feedparser",
"label": "Install Python dependencies (requests + feedparser)",

Technical Analysis

The installation commands do not pin exact package versions or verify package integrity. The npx -y command automatically downloads and executes the package version selected by the registry at installation time. The pip command similarly resolves mutable package releases without a lock file or cryptographic hashes.

Consequently, the code executed during installation can differ from the code that was reviewed. A compromised package publisher, registry account, transitive dependency, or newly published malicious release could introduce arbitrary installation-time code. This exceeds the trust assumptions appropriate for a reviewed Skill because its effective executable dependency set remains mutable.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the relevant registry account.
2. The attacker publishes a malicious release under one of the referenced package names or dependencies.
3. A user installs the Skill dependencies using the documented commands.
4. The package manager resolves the attacker-controlled release because no exact version or integrity constraint is specified.
5. Malicious package installation or lifecycle code executes with the privileges of the user running the command.
6. If the installation is combined with the separately documented privilege-escalation advice, the malicious code may execute with administrative privileges.

Impact Assessment

Under ordinary installation, malicious dependency cod ...[truncated 510 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version.
2. Commit lock files that include transitive dependency versions.
3. Use integrity verification, such as npm lock-file integrity metadata and pip hash checking with --require-hashes.
4. Install Python dependencies from a reviewed requirements file, for example:

   text

   requests==<reviewed-version> --hash=sha256:<reviewed-hash>
   feedparser==<reviewed-version> --hash=sha256:<reviewed-hash>
   

5. Replace the mutable npx -y invocation with installation of a pinned and reviewed plugin version.
6. Use trusted registries and consider disabling unnecessary package lifecycle scripts.
7. Perform installation inside an isolated, non-administrative environment.
8. Regularly scan and review both direct and transitive dependencies before updating pins.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:58

Finding

Documentation Encourages Unnecessary Administrative Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Unnecessary privilege escalation during dependency installation
Risk Level: Medium

Relevant command referenced by the vulnerable instruction:

shell

npx -y @larksuite/openclaw-lark-tools install

The documentation instructs users to retry this installation with sudo if the ordinary command fails.

Technical Analysis

Prefixing a remote package installation command with sudo grants administrative privileges to the package manager, the downloaded package, its lifecycle scripts, and relevant transitive dependencies. Root access is not required for the Skill's declared function of retrieving RSS articles, rewriting their content, and creating a Feishu document.

The risk is amplified because the referenced npm package is not pinned to an exact version. The recommendation therefore permits mutable, remotely obtained code to execute beyond the minimum privileges necessary for the Skill.

Attack Path

1. The normal installation fails because of a permissions or environment configuration problem.
2. The user follows the documentation and retries the package installation with sudo.
3. npm downloads the currently resolved unpinned package and its dependencies.
4. A compromised package or lifecycle script executes with root privileges.
5. The malicious code modifies protected files, installs persistent components, accesses system credentials, or changes services and executables.
6. The attacker gains control over the host within the scope available to the administrative account.

Impact Assessment

Exploitation could provide root-level or equivalent administrative privileges. The resulting scope may include reading or modifying files belonging to other users, extracting credentials, replacing system executables, altering services, disabling security controls, creating persistence, and fully compromising the host.

...[truncated 174 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to retry the installation with sudo.
2. Explicitly state that the plugin must be installed as an unprivileged user.
3. Provide user-scoped setup instructions using a Node version manager or a user-owned package directory.
4. Diagnose and repair ownership or package-manager configuration problems instead of bypassing them with administrative privileges.
5. Pin the plugin to an exact reviewed version and verify its integrity before execution.
6. Where practical, perform installation in a container, virtual machine, or other restricted environment.
7. Document the minimum filesystem, network, and Feishu permissions required by the plugin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description emphasizes English-learning content generation, but the actual behavior also includes random source selection, external HTTP retrieval, local file access, deduplication history, and cloud document creation. This mismatch can mislead users and reviewers about the true data flows and side effects, reducing informed consent and making hidden risk easier to overlook.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares install steps and operational behavior that require local file reads and outbound network access, but it does not declare any explicit tool scope or permissions boundary. This weakens reviewability and can cause the agent to invoke broader capabilities than users expect, especially because the skill also performs persistent state updates and cloud publication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description requires generation of English reading material and the rest of the instructions assume English output, but the skill does not explicitly present this as a user choice or justify a mandatory language policy. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Using npx -y @larksuite/openclaw-lark-tools install without pinning a version allows the latest package version to be fetched at execution time, creating a supply-chain risk. If the upstream package is compromised or a breaking release is published, users may install malicious or unsafe code during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends generated content plus source titles and URLs to a Feishu cloud document, but it does not disclose this cloud transfer as a privacy-impacting action. Users may reasonably assume local-only processing from the learning-focused description and may not realize external publication occurs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The repeated unpinned npx installation instruction exposes users to the same supply-chain risk during manual setup. Because it appears in user-facing instructions, it increases the chance that end users execute an unreviewed latest-version install directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill persists user preferences and article history to local files, but the description does not clearly warn users that data will be stored across runs. Hidden persistence can expose reading habits, source history, and configuration data to later sessions or other local users/processes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Trigger phrases like '生成英语阅读材料' are broad enough to match ordinary conversation, which can cause unintended automatic invocation. In this skill, accidental invocation is more concerning because it can read local files, fetch remote content, write persistent history, and publish to Feishu.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON config contains user-facing natural-language descriptions in both Chinese and English across entries. Because the file does not indicate that language selection is optional, user-driven, or region-specific, it may violate a language/locale policy requiring explicit opt-in or documentation.

Content

No source excerpt is available for this finding.