科技资讯日报

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:43 AM UTC
• Version: 1.0.1

Overview

This is a disclosed tech-news skill that uses Tavily or named public tech sites to fetch current news; its remaining risks are normal API-key/network use and minor documentation inconsistencies.

Install only if you are comfortable with the skill making outbound requests for news retrieval. If you configure TAVILY_API_KEY, treat it as a third-party API credential with quota/billing implications; otherwise the skill falls back to scraping named public tech-news sites. Expect Chinese-language queries and output unless you modify it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'request' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_tech_news_enhanced.py (reported line 103)May include surrounding context.

python

)
    
    try:
        with urllib.request.urlopen(request, timeout=30) as response:
            result = json.loads(response.read().decode("utf-8"))
            return result.get("results", [])
    except urllib.error.HTTPError as e:

Tainted flow: 'request' from os.environ.get (line 54, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_tech_news_tavily.py (reported line 64)May include surrounding context.

python

)
    
    try:
        with urllib.request.urlopen(request, timeout=30) as response:
            result = json.loads(response.read().decode("utf-8"))
            return result.get("results", [])
    except urllib.error.HTTPError as e:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述的是一个能够主动获取今日热门科技资讯、并在多个数据源之间自动切换的技能。但实际代码的 main 仅打印 JSON 配置，其中包含固定查询词、结果数量、时间范围和一条让外部工具执行搜索的指令。代码没有任何 Tavily API 调用、没有直连科技网站的抓取逻辑、没有自动切换数据源机制，也没有实际执行新闻检索。虽然存在 format_news_results 函数用于格式化搜索结果，但这只是辅助函数，且当前主流程并未使用。因此，代码实际行为与声明的核心能力存在明显不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documents use of environment variables and outbound network access but does not declare any tool scope or allowed-tools boundary. In an agent ecosystem, missing capability declarations can lead to overbroad execution privileges, reduced reviewability, and unintended access to secrets or network resources when the skill runs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill description, trigger phrases, examples, output format, and scheduled payload are written only in Chinese, implying the skill is intended to operate in Chinese by default. There is no opt-in language choice or statement that other languages are supported, which can violate language/locale policy when a skill constrains user interaction to a specific language without consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Broad trigger phrases can cause the skill to activate in contexts the user did not intend, leading to unnecessary network calls, external data retrieval, or use of configured API-backed capabilities. In a system with other sensitive skills, over-triggering increases the chance of cross-context mistakes and unintended disclosure of user intent to third-party services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The title and all operational guidance are written exclusively in Chinese, which effectively constrains use to a specific language. The file does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-language or region-specific workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill uses Chinese search queries and Chinese-only user-facing output strings throughout the file, which imposes a specific language choice on all users. There is no option to select another language or any documented justification for the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file consistently describes its behavior in Chinese and later enforces a Chinese locale in HTTP headers, while all user-facing output is emitted in Chinese. That creates a language/locale policy concern because the skill forces a specific language experience without any opt-in or configurable locale selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Accept-Language header is set to prefer zh-CN,zh for all outbound web requests, which imposes a specific locale on fetched content. Under the policy, forcing a language/locale without offering choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_tech_news_enhanced.py (reported line 24)May include surrounding context.

python

from datetime import datetime

# Tavily API configuration
TAVILY_API_URL = "https://api.tavily.com/search"
TAVILY_API_KEY = os.environ.get("TAVILY_API_KEY", "")

# Search queries for tech news (优先级从高到低)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_tech_news_tavily.py (reported line 17)May include surrounding context.

python

from datetime import datetime

# Tavily API configuration
TAVILY_API_URL = "https://api.tavily.com/search"
TAVILY_API_KEY = os.environ.get("TAVILY_API_KEY", "")

# Search queries for tech news (优先级从高到低)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code hard-codes Chinese search queries and later formats all user-facing output in Chinese, which imposes a specific language/locale by default. The file does not offer any opt-in, language selection, or explanation that this is a region-specific tool, so it conflicts with the language-choice policy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

该技能在清单与全文档中反复声明主数据源是 Tavily API，并通过 TAVILY_API_KEY 配置自动切换到网站直连。但 L143 的注意事项却写成“没有 Brave API 密钥时”，这与前文声明的实现和配置方式直接矛盾，属于文档意图与实现说明不一致。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L105-L110 明确列出了 Tavily 搜索参数，仅包含 search_depth、max_results、include_answer 和 include_raw_content。但 L144 又要求使用 freshness: pd，这与本文档前面描述的实现参数集不一致，显示出文档内容混入了另一套搜索接口/实现说明。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.