Security audit

Silver Daily

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent news-report generator, but its HTML report renderer can turn untrusted news data into active browser content.

Review before installing if you plan to use real web results, user-supplied JSON, share generated reports, or host them online. The HTML generator should escape text, validate URLs to http/https, and add safer external-link attributes before it is used for distributed reports.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_report.py:146
Finding: Stored HTML and JavaScript Injection Through Unescaped Report Data
Content: View full analysis
{news["summary"]}' if news.get("summary") else "" return f'''
{news["rank"]}

{news["title"]}

{news["source"]} {news["time"]} {news["tag"]}
{summary_html}
''' def render_section(section): news_html = "\n".join(render_news_card(n) for n in section["news"]) count = len(section["news"]) return f'''

{section["icon"]}

{section["name"]}

{count} 条

{news_html}
''' def render_stats(stats): cards = "" for s in stats: cards += f'''

{s["num"]}

{s["label"]}

''' return f'
{cards}\n
' ``` The top-story fields are interpolated in the same unsafe manner: ```python def generate_html(data): top = data["top_story"] sections_html = "\n".join(render_section(s) for s in data["sections"]) stats_html = render_stats(data["stats"]) return f''' ...[truncated 3036 chars]
Remediation: View remediation
"> javascript:alert(1) data:text/html, ``` Tests should verify that markup is rendered as inert text and that unsafe URLs are rejected rather than included in the output. 7. Consider deploying a restrictive Content Security Policy when reports are hosted. This should be treated as defense in depth and not as a replacement for output escaping and URL validation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 319)May include surrounding context.
html
</head> <body>  <div class="header"> <div class="header-logo">SILVER AGE DAILY · 银发每日头条</div> <div class="header-title">银发<span>每日</span>头条</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 425)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">🛍️</div> <div class="section-name">银发消费</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 425)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">🛍️</div> <div class="section-name">银发消费</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 515)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">🤖</div> <div class="section-name">银发科技</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 515)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">🤖</div> <div class="section-name">银发科技</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 605)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">🎭</div> <div class="section-name">银发文娱</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 605)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">🎭</div> <div class="section-name">银发文娱</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 683)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">💼</div> <div class="section-name">银发就业·老有所为</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · preview.html (reported line 683)May include surrounding context.
html
</a> </div>  <div class="section-head"> <div class="section-icon">💼</div> <div class="section-name">银发就业·老有所为</div>

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The summary states that the skill performs web_search across multiple categories and supports local HTML report generation, but it does not disclose that user requests may trigger external network access or create files on disk. This lack of transparency can surprise users, expose query context to external services, and cause unintended local side effects such as writing reports to the filesystem.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger examples include broad natural-language phrases such as asking what new silver-economy news exists today, which can match ordinary conversation and cause the skill to activate when the user may only want a simple answer. In a skill that performs web searches and generates reports, unintended invocation can lead to unnecessary external requests, longer responses, and confusing behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The suggested trigger phrases are broad, natural-language requests such as asking what news is new today or to generate a daily headline roundup. Because they closely resemble ordinary user queries, the skill may activate unintentionally and take over requests that should be handled by a more general or better-scoped assistant flow. In a news-aggregation skill, this can cause scope confusion, reduce user control, and route sensitive or adjacent queries into an automated summarization workflow without clear consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill performs file read/write actions and invokes a local script, but it does not declare an explicit tool scope or permission boundary. This can lead to overbroad access at runtime, making it harder to enforce least privilege and increasing the risk of unintended filesystem access if the skill is triggered in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad enough to match ordinary discussion about aging-related news, which can cause the skill to activate unexpectedly. Because the skill then performs searches and may write files, ambiguous activation expands the chance of unintentional external actions and output generation without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to generate and save an HTML file to disk but does not clearly warn the user that persistent local output will be created. Silent file creation can surprise users, create privacy or storage concerns, and becomes more risky when combined with broad triggers or automated scheduling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Line L002 sets the document language to "zh-CN", and the visible content throughout the page is exclusively in Simplified Chinese. For SQP-3, this is a natural-language locale policy concern because the file imposes a specific language/locale without offering user opt-in or explaining that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill metadata explicitly says it is NOT for querying personal pension accounts, but the content framework includes '个人养老金账户动态' under the financial coverage area. This creates scope ambiguity that can cause the agent to handle disallowed retirement-account-related requests, increasing the chance of policy drift into regulated financial guidance or sensitive account assistance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document title and instructions require responses in a specific language and format, with no indication that users can opt into another language or locale. This is a natural-language policy issue because it forces a locale/language constraint rather than offering a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s usage text, generated content, and HTML metadata indicate the skill is designed to always produce Chinese-language output, including lang="zh-CN" and Chinese UI strings. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language content, trigger phrases, and usage are all written in Chinese, and the document does not state that the skill is China-specific or otherwise limited to Chinese-language interaction. Under the language/locale policy, forcing a single language without opt-in or explicit justification can be a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document declares lang="zh-CN", and all visible content is presented only in Simplified Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or language choice is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire framework is written as a fixed Chinese-language content specification, including section names and source requirements centered on Chinese outlets, with no indication that users can choose another language or locale. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly documented as a justified region-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire template documentation is written only in Chinese, with no indication that language choice is optional or that the file is intended solely for a Chinese-language or region-specific workflow. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.