Daily-EnglishNews-Reader

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:23 AM UTC
• Version: 1.0.0

Overview

The skill's reading workflow is mostly disclosed, but its install path asks users to run unpinned network packages and even suggests sudo, which needs review before use.

Review this before installing. Avoid using sudo, prefer pinned dependency versions or a sandbox/virtual environment, and review RSS sources before testing or running. Also confirm you are comfortable granting Feishu permissions and storing article titles, source URLs, and generated materials in Feishu cloud documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21
• Finding: Unpinned Third-Party Dependencies Are Downloaded and Executed at Installation Time<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21–32 **Vulnerability Type**: Unpinned runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml "requires": { "bins": ["python3", "pip3"] }, "install": [ { "id": "lark-plugin", "kind": "shell", "command": "npx -y @larksuite/openclaw-lark-tools install", "label": "Install official Lark/Feishu plugin", }, { "id": "pip-deps", "kind": "shell", "command": "pip3 install requests feedparser", "label": "Install Python dependencies (requests + feedparser)", }, ], ``` The related installation instructions in `SKILL.md`, line 51, also recommend retrying with elevated privileges: ```text 1. Execute the installation command: `npx -y @larksuite/openclaw-lark-tools install` (if installation fails, retry with `sudo`) ``` ### Technical Analysis The Skill downloads and executes npm and Python packages without pinning exact versions or validating package integrity. The `npx -y` command automatically accepts installation and executes whichever version the package registry resolves at installation time. Similarly, `pip3 install requests feedparser` installs the latest versions permitted by the active package index. Consequently, the code reviewed during this audit does not fully determine the code that will execute during installation. A compromised maintainer account, malicious upstream release, package-registry compromise, DNS or registry configuration manipulation, or dependency-resolution attack could cause arbitrary third-party code to execute. The recommendation to retry installation with `sudo` exceeds the minimum privileges normally necessary for a user-scoped Skill. If followed, package lifecycle scripts or installer code may execute with root privileges, substantially increasing the potential impact of a supply-chain compromise. ### Attack Path 1. An attacker compromises an upstream package, its mai ...[truncated 1423 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed, exact version. For example, use an exact npm version rather than an unqualified package name. 2. Commit and enforce an npm lockfile with integrity hashes where the Skill packaging model permits it. 3. Pin Python packages to exact versions and hashes in a requirements file, then install with a command such as: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Review and pin transitive dependencies, not only direct dependencies. 5. Install Python dependencies in a dedicated virtual environment rather than the global Python environment. 6. Remove the recommendation to use `sudo`. Provide user-scoped installation instructions and correct ownership or virtual-environment guidance instead. 7. Restrict dependency downloads to trusted registries and document the expected registry configuration. 8. Consider packaging reviewed dependencies or verifying signed release artifacts where supported. 9. Run plugin installation in a sandbox with limited filesystem, credential, and network access. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/random_source_picker.py:27
• Finding: Configuration-Controlled HTTP Requests Permit Access to Internal or Link-Local Destinations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/random_source_picker.py`, lines 27–43 **Vulnerability Type**: Unvalidated outbound request destination **Risk Level**: Medium ### Vulnerable Code ```python def test_sources(rss_config: Dict) -> bool: """Test if all RSS sources are reachable""" all_ok = True groups = rss_config["groups"] for group_name, sources in groups.items(): print(f"\nTesting {group_name} sources:") for source in sources: try: response = requests.get(source["url"], timeout=10) response.raise_for_status() print(f"✅ {source['name']}: OK") except Exception as e: print(f"❌ {source['name']}: Failed - {str(e)}") all_ok = False return all_ok ``` ### Technical Analysis The `--test` execution path sends an HTTP request to every URL supplied through `config/rss_sources.json`. The project documentation permits users to add or modify RSS source URLs, but the script does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Loopback, private, link-local, multicast, or reserved address ranges. - Embedded credentials. - Redirect destinations. The `requests` library follows redirects by default. Therefore, even a URL that initially references a permitted public host could redirect the request to an internal or link-local destination. This behavior forms an SSRF-like outbound request primitive. An attacker who can modify the RSS configuration, distribute a modified configuration, or persuade a user to add a crafted feed can cause the machine running the Skill to issue requests to destinations that may not be reachable from the attacker's own network position. The reviewed function does not print response bodies, which limits direct extraction of returned data. However, status-dependent output and exception differences can reveal service reachability, and the re ...[truncated 1953 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Accept only `https` URLs unless plaintext HTTP is explicitly required. 2. Parse URLs with a strict URL parser and reject malformed URLs, embedded credentials, fragments, and unexpected ports. 3. Resolve the hostname before connecting and reject every resolved address in loopback, private, link-local, multicast, unspecified, documentation, or otherwise reserved ranges for both IPv4 and IPv6. 4. Protect against DNS rebinding by ensuring the validated address is the address actually used for the connection. 5. Disable automatic redirects with `allow_redirects=False`, or validate every redirect target using the same scheme, hostname, and resolved-address checks. 6. Maintain an explicit allowlist of approved RSS domains if arbitrary user-defined feeds are not necessary. 7. Run feed retrieval in a network-restricted sandbox that cannot reach cloud metadata services, loopback administration endpoints, or private network ranges. 8. Return generic failure messages rather than detailed connection exceptions when output may be visible to an untrusted party. 9. Limit response size and streaming duration to reduce resource-exhaustion risk: ```python requests.get(validated_url, timeout=(3, 10), allow_redirects=False, stream=True) ``` 10. Treat configuration files from downloaded or shared Skill packages as untrusted input and review changes before executing source tests. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A description-behavior mismatch is dangerous because reviewers and users may approve the skill for one purpose while it performs additional actions such as RSS selection or external requests. Even if the extra behavior is not overtly malicious here, undisclosed network activity materially changes the trust and review assumptions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to execute `npx -y @larksuite/openclaw-lark-tools install` without pinning an exact package version. This creates a supply-chain risk: whoever controls the package or a compromised latest release can cause arbitrary code to run on the user's machine at install time, and the `-y` flag reduces friction by auto-confirming execution.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. **安装插件**：执行命令：
   ```bash
   npx -y @larksuite/openclaw-lark-tools install
   # 如遇权限问题请加 sudo
   ```
2. **创建/关联机器人**：按终端提示选择「新建机器人」并扫码，或「关联已有机器人」。
3. **激活机器人**：在飞书客户端给该机器人发送任意消息。

• Confidence: 90% confidence
• Finding: The README suggests adding `sudo` if there are permission issues when installing a package from the network. Running `npx`/package installation with root privileges greatly increases the blast radius of any malicious or compromised install script, potentially leading to full system compromise instead of user-level impact.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill requires file reads and network access but does not declare any explicit tool scope or permissions boundary. This makes the operational surface less transparent to users and hosts, increasing the chance the agent performs filesystem or external network actions without clear authorization expectations.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The description states the skill generates English reading material and the workflow consistently requires rewritten English articles and English vocabulary explanations. This is a language/locale constraint expressed in natural language, but the file does not indicate any user opt-in or alternative language choice.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Using `npx -y @larksuite/openclaw-lark-tools install` without a pinned version allows the latest package to be fetched at install time, which creates a supply-chain risk. If the upstream package is compromised or a breaking version is published, users may execute unreviewed code during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The repeated unpinned `npx` install instruction creates the same supply-chain exposure in user guidance, not just metadata. Because the skill explicitly tells users to run it, the risk is more likely to be realized in practice.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to modify configuration files and append tracking data without clearly warning the user at the time of use. Silent local state changes can surprise users, persist unintended preferences, and create integrity/privacy issues if files are shared or later consumed by other processes.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation wording says the skill should run when the user sends commands with a similar meaning, and includes the generic phrase "生成英语阅读材料". This does not clearly bound what counts as an invocation, which increases the risk of unintended activation from ordinary requests about English reading materials.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill writes article source URLs and metadata into a Feishu cloud document without presenting a privacy warning or clarifying the visibility and retention implications of cloud storage. Publishing metadata to a third-party platform can expose reading interests, internal research topics, or sensitive source patterns depending on the user context.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest describes a skill that generates CEFR-adapted English reading material and creates a Feishu cloud document. This helper script adds a separate capability to probe all configured RSS URLs over the network, which is not part of the described user-facing generation flow and goes beyond a straightforward implementation detail of producing one reading output.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The natural-language description frames the skill as an English-only experience and the outputs described are English reading materials with English vocabulary explanations. Under the policy for this audit, forcing a specific language without user opt-in can be a locale/language policy issue unless the restriction is explicitly justified as region- or purpose-specific.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: This config mixes English source names with Chinese description text, and the Chinese descriptions appear to assume a specific user language preference. Because the file provides no documented user opt-in or stated locale constraint, this may conflict with an organizational policy requiring language choice rather than forcing a locale.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: This config mixes English source names with Chinese description text, and the Chinese descriptions appear to assume a specific user language preference. Because the file provides no documented user opt-in or stated locale constraint, this may conflict with an organizational policy requiring language choice rather than forcing a locale.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: This config mixes English source names with Chinese description text, and the Chinese descriptions appear to assume a specific user language preference. Because the file provides no documented user opt-in or stated locale constraint, this may conflict with an organizational policy requiring language choice rather than forcing a locale.

Static analysis

No suspicious patterns detected.