T08 · Insecure Dependencies
Warning
- Location
SKILL.md:21- Finding
Unpinned Third-Party Dependencies Are Downloaded and Executed at Installation Time
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily-EnglishNews-Reader
Security checks for vulnerabilities and agentic risk
Overview
The skill's reading workflow is mostly disclosed, but its install path asks users to run unpinned network packages and even suggests sudo, which needs review before use.
Review this before installing. Avoid using sudo, prefer pinned dependency versions or a sandbox/virtual environment, and review RSS sources before testing or running. Also confirm you are comfortable granting Feishu permissions and storing article titles, source URLs, and generated materials in Feishu cloud documents.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/random_source_picker.py:27- Finding
Configuration-Controlled HTTP Requests Permit Access to Internal or Link-Local Destinations
- Content
View full analysis
bool: """Test if all RSS sources are reachable""" all_ok = True groups = rss_config["groups"] for group_name, sources in groups.items(): print(f"\nTesting {group_name} sources:") for source in sources: try: response = requests.get(source["url"], timeout=10) response.raise_for_status() print(f"✅ {source['name']}: OK") except Exception as e: print(f"❌ {source['name']}: Failed - {str(e)}") all_ok = False return all_ok ``` ### Technical Analysis The `--test` execution path sends an HTTP request to every URL supplied through `config/rss_sources.json`. The project documentation permits users to add or modify RSS source URLs, but the script does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Loopback, private, link-local, multicast, or reserved address ranges. - Embedded credentials. - Redirect destinations. The `requests` library follows redirects by default. Therefore, even a URL that initially references a permitted public host could redirect the request to an internal or link-local destination. This behavior forms an SSRF-like outbound request primitive. An attacker who can modify the RSS configuration, distribute a modified configuration, or persuade a user to add a crafted feed can cause the machine running the Skill to issue requests to destinations that may not be reachable from the attacker's own network position. The reviewed function does not print response bodies, which limits direct extraction of returned data. However, status-dependent output and exception differences can reveal service reachability, and the re ...[truncated 1953 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A description-behavior mismatch is dangerous because reviewers and users may approve the skill for one purpose while it performs additional actions such as RSS selection or external requests. Even if the extra behavior is not overtly malicious here, undisclosed network activity materially changes the trust and review assumptions.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to execute
npx -y @larksuite/openclaw-lark-tools installwithout pinning an exact package version. This creates a supply-chain risk: whoever controls the package or a compromised latest release can cause arbitrary code to run on the user's machine at install time, and the-yflag reduces friction by auto-confirming execution.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The README suggests adding
sudoif there are permission issues when installing a package from the network. Runningnpx/package installation with root privileges greatly increases the blast radius of any malicious or compromised install script, potentially leading to full system compromise instead of user-level impact.- Content
- 安装插件：执行命令：
bash npx -y @larksuite/openclaw-lark-tools install # 如遇权限问题请加 sudo - 创建/关联机器人：按终端提示选择「新建机器人」并扫码，或「关联已有机器人」。
- 激活机器人：在飞书客户端给该机器人发送任意消息。
- 安装插件：执行命令：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill requires file reads and network access but does not declare any explicit tool scope or permissions boundary. This makes the operational surface less transparent to users and hosts, increasing the chance the agent performs filesystem or external network actions without clear authorization expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description states the skill generates English reading material and the workflow consistently requires rewritten English articles and English vocabulary explanations. This is a language/locale constraint expressed in natural language, but the file does not indicate any user opt-in or alternative language choice.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx -y @larksuite/openclaw-lark-tools installwithout a pinned version allows the latest package to be fetched at install time, which creates a supply-chain risk. If the upstream package is compromised or a breaking version is published, users may execute unreviewed code during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The repeated unpinned
npxinstall instruction creates the same supply-chain exposure in user guidance, not just metadata. Because the skill explicitly tells users to run it, the risk is more likely to be realized in practice.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to modify configuration files and append tracking data without clearly warning the user at the time of use. Silent local state changes can surprise users, persist unintended preferences, and create integrity/privacy issues if files are shared or later consumed by other processes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation wording says the skill should run when the user sends commands with a similar meaning, and includes the generic phrase "生成英语阅读材料". This does not clearly bound what counts as an invocation, which increases the risk of unintended activation from ordinary requests about English reading materials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill writes article source URLs and metadata into a Feishu cloud document without presenting a privacy warning or clarifying the visibility and retention implications of cloud storage. Publishing metadata to a third-party platform can expose reading interests, internal research topics, or sensitive source patterns depending on the user context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes a skill that generates CEFR-adapted English reading material and creates a Feishu cloud document. This helper script adds a separate capability to probe all configured RSS URLs over the network, which is not part of the described user-facing generation flow and goes beyond a straightforward implementation detail of producing one reading output.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language description frames the skill as an English-only experience and the outputs described are English reading materials with English vocabulary explanations. Under the policy for this audit, forcing a specific language without user opt-in can be a locale/language policy issue unless the restriction is explicitly justified as region- or purpose-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This config mixes English source names with Chinese description text, and the Chinese descriptions appear to assume a specific user language preference. Because the file provides no documented user opt-in or stated locale constraint, this may conflict with an organizational policy requiring language choice rather than forcing a locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This config mixes English source names with Chinese description text, and the Chinese descriptions appear to assume a specific user language preference. Because the file provides no documented user opt-in or stated locale constraint, this may conflict with an organizational policy requiring language choice rather than forcing a locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This config mixes English source names with Chinese description text, and the Chinese descriptions appear to assume a specific user language preference. Because the file provides no documented user opt-in or stated locale constraint, this may conflict with an organizational policy requiring language choice rather than forcing a locale.
- Content