T08 · Insecure Dependencies
Warning
- Location
scripts/fetch_and_digest.py:12- Finding
Unpinned Dependencies Are Installed Automatically at Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
News Digest Aggregator - 新闻聚合
Security checks for vulnerabilities and agentic risk
Overview
This is a mostly coherent news digest skill, but it can silently install unpinned Python packages at runtime and fetch or post to user-configured network URLs, so it needs review before use.
Install only if you are comfortable reviewing and controlling the runtime environment. Preinstall pinned dependencies instead of allowing automatic pip installs, use only trusted RSS and webhook URLs, avoid running it with access to internal networks or sensitive environment variables, and verify any cron schedule and destination channel before enabling recurring delivery.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_and_digest.py:35- Finding
Unrestricted Configurable URLs Permit Server-Side Request Forgery
- Content
View full analysis
List[Dict[str, Any]]: """Fetch articles from all configured RSS sources.""" all_articles = [] for source in self.config.get('sources', []): try: print(f"Fetching: {source['name']}...") feed = feedparser.parse(source['url']) for entry in feed.entries[:max_per_source]: article = { 'title': entry.get('title', 'No title'), 'link': entry.get('link', ''), 'summary': entry.get('summary', '')[:300], 'published': entry.get('published', ''), 'source': source['name'], 'category': source.get('category', 'general') } all_articles.append(article) except Exception as e: print(f"Error fetching {source['name']}: {e}") ``` ### Technical Analysis The `url` field is read from a configurable JSON file and passed directly to `feedparser.parse` without validating the scheme, hostname, resolved IP address, port, or redirect destination. The bundled configuration contains recognizable public HTTPS news feeds, but the implementation accepts replacement configurations through `--config`. A user or process able to supply or modify that configuration can direct the Skill toward loopback, link-local, private-network, or other non-public destinations reachable from the Agent host. Fetching arbitrary RSS sources is part of the declared functionality, but access to internal services and non-HTTPS schemes is not necessary. The absence of network-boundary validation therefore exceeds a least-privilege implementation. ### Attack Path 1. An attacker ...[truncated 1379 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/fetch_and_digest.py:89- Finding
Network Operations Lack Timeouts and Can Block Scheduled Runs Indefinitely
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description promises RSS retrieval and webhook delivery but does not accurately represent implementation details or privilege needs, especially the undeclared outbound network access. Description-behavior mismatches are dangerous because operators may approve or invoke the skill under false assumptions, leading to unexpected data egress, package installation, or messaging actions.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Automatic dependency installation via shell commands is not necessary for the stated business logic of fetching feeds and sending digests. In this context, it is more dangerous because the script is intended to run unattended on a schedule, so it may repeatedly execute package-installation code and silently pull remote code into a privileged environment.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
The script executes a shell command at runtime to install a missing dependency. Even though the package name is hardcoded, invoking pip from the running process causes unreviewed code from an external package index to be fetched and executed automatically, which is risky in an automation skill and expands the attack surface considerably.
- Content
python import feedparser except ImportError: print("Installing required package: feedparser") os.system(f"{sys.executable} -m pip install feedparser") import feedparser # HTTP requests
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
This repeats the same unsafe behavior for the requests package: the script launches a shell command to install code at execution time. That enables automatic retrieval and execution of third-party code without review or user approval, which is unjustified for a news aggregation utility.
- Content
python import requests except ImportError: print("Installing required package: requests") os.system(f"{sys.executable} -m pip install requests") import requests
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example trigger phrases are very broad and can cause the skill to activate in response to common user requests without clearly signaling that it will fetch external content and potentially distribute outputs. In a skill that performs scheduled aggregation and outbound delivery, vague activation language increases the risk of unintended invocation and data handling beyond user expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly advertises sending news to Feishu but does not warn that content will be transmitted to an external messaging platform. This can mislead users about where data goes, and in practice could expose article selections, generated summaries, or configuration metadata to third-party services without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Describing scheduled push functionality without warning about automatic outbound delivery obscures that the skill may continue sending content on a recurring basis after initial setup. In an automation context, this raises the risk of unintended persistent data transmission, spam, or delivery to the wrong destination if configuration is mistaken or outdated.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares operational behavior that requires environment access, file reads, network access, and shell execution, but it does not declare any tool scope or permissions. This creates a transparency and containment problem: an agent or reviewer cannot accurately assess what the skill is allowed to do, increasing the chance of unintended outbound requests or secret handling without explicit approval.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says to use the skill whenever a user wants daily news summaries, RSS aggregation, or scheduled content delivery, which are broad intents that can overlap with common requests and many other skills. It does not define specific trigger phrases, scope limits, or exclusion conditions that clarify when this skill should activate versus when it should not.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The top-level docstring explicitly states that the script summarizes articles using an LLM. The actual implementation only parses RSS feeds and truncates entry summaries in fetch_feeds and generate_digest, so the documentation actively misrepresents the behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Both the manifest and module docstring claim the skill aggregates articles using LLM summarization. In practice, the code only reads the existing RSS 'summary' field and truncates it to fixed lengths when storing and rendering articles, with no LLM invocation or article summarization logic present.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Installing packages automatically without user confirmation is unsafe operationally and security-wise, especially for a scheduled agent skill. The code changes the runtime environment and executes remote package installation implicitly, which can surprise operators and undermine change control even if no direct command injection is present.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "content": chunk, "username": "News Digest" } response = requests.post(webhook_url, json=payload) if response.status_code != 204: print(f"Discord error: {response.status_code} - {response.text}") else:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "content": chunk, "username": "News Digest" } response = requests.post(webhook_url, json=payload) if response.status_code != 204: print(f"Discord error: {response.status_code} - {response.text}") else:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "content": chunk, "username": "News Digest" } response = requests.post(webhook_url, json=payload) if response.status_code != 204: print(f"Discord error: {response.status_code} - {response.text}") else:
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The functional description and usage examples are entirely in Chinese, and the examples imply operation in that language only. Because no user language choice or locale justification is documented, this may violate the policy against forcing a specific language without opt-in.
- Content
Static analysis
No suspicious patterns detected.