News Noon Digest - 新闻午报

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:04 AM UTC
• Version: 1.0.0

Overview

This skill should be reviewed because it can set up scheduled external message posting while misrepresenting hardcoded sample text as fetched news and claiming QQ delivery that is not implemented.

Install only if you are comfortable configuring a Feishu webhook and an OpenClaw cron job yourself. Treat this as a placeholder: it posts a canned Chinese digest, does not fetch current news, and QQ delivery appears unimplemented, so it should be fixed before being used for real automated news delivery.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'req' from os.getenv (line 118, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method='POST'
        )
        
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read().decode('utf-8'))
            if result.get("code") == 0:
                print("✅ 飞书推送成功")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior materially differs from the apparent implementation: it claims automatic scheduled execution, real news fetching, and QQ/Feishu delivery, while the analyzed behavior suggests missing scheduling logic, no real QQ delivery, and mostly static content. Such mismatches are dangerous because they mislead users about what the skill actually does, preventing informed consent and masking unimplemented or substituted behavior that could later be changed to something unexpected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README states that the skill automatically pushes a noon news digest to QQ and Feishu but does not clearly warn users that content will be sent to external platforms. This weakens informed consent and can lead to unintentional disclosure of user-selected content, account linkage effects, or unexpected outbound messaging.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example trigger phrases are generic everyday language and can easily overlap with normal user conversation, which may cause the skill to activate unintentionally. In a skill that sends scheduled or external communications, accidental invocation increases the risk of unwanted automation, misconfiguration, or message delivery without clear user intent.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares network and environment-variable dependent behavior but does not explicitly scope or document its required permissions. This creates a trust and review gap: users may install or run the skill without understanding that it can exfiltrate data externally via webhooks or consume sensitive environment configuration.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill does not prominently warn that it will send generated content to external messaging platforms on a schedule. Automatic outbound posting increases the risk of unintended disclosure, spam, or operational surprises if users do not realize content will be pushed to third-party services without manual review.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s description and all user-facing behavior are hard-coded in Chinese, indicating the skill is intended to operate only in that language. The policy requires flagging language/locale constraints when the skill does not offer user opt-in or clearly document a justified region-specific limitation.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: 生成的午报正文声明“数据来源：World Monitor、网络聚合”“由 OpenClaw AI 自动整理”，但代码中的新闻内容均为硬编码静态文本，既没有进行网络聚合，也没有实际抓取或整理外部新闻数据。这会让接收者误以为内容来自实时外部来源。

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: 函数注释和文档字符串声称该函数会“发送到QQ/通过 OpenClaw 消息接口”，但实际实现仅打印一条提示信息并直接返回 True，没有执行任何 QQ 发送操作。这属于代码文档对实际行为的主动误导，而非单纯信息不完整。

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The skill name, description, and example trigger phrases are entirely in Chinese, and the invocation examples imply Chinese-only use. There is no indication that users may choose another language or locale, which can violate language-choice policy when not justified or documented as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The natural-language content of the skill forces Chinese for the description, setup guidance, and output example. Under the policy, language constraints should be optional or explicitly justified; here there is no opt-in, alternative locale, or documented reason for restricting the skill to Chinese.

Static analysis

No suspicious patterns detected.