T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:162- Finding
Mandatory Promotional and Update-Solicitation Content Injected into Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Ebrun Original News
Security checks for vulnerabilities and agentic risk
Overview
This news skill mostly matches its stated purpose, but it also performs automatic update checks and uses an unsafe shared temp cache, so it should be reviewed before install.
Before installing, confirm you are comfortable with this skill contacting Ebrun for news and also checking Ebrun/GitHub/Gitee for skill version data. Treat any update prompt as advisory only, verify the repository yourself, and prefer disabling or fixing the update checker/cache behavior before use in shared or sensitive environments.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update.py:34- Finding
Predictable Shared Python Cache Allows Version-State Poisoning and Symlink File Overwrite
- Content
View full analysis
Dict[str, Any]: try: data = json.loads(CACHE_FILE.read_text(encoding='utf-8')) except FileNotFoundError: return {} except json.JSONDecodeError: return {} return data if isinstance(data, dict) else {} ``` ```python CACHE_FILE.write_text(json.dumps(cache_payload, ensure_ascii=False, indent=2) + '\n', encoding='utf-8') ``` ### Technical Analysis The update checker stores state at a fixed, publicly predictable path in the system temporary directory. It neither verifies that the cache is a regular file owned by the current user nor rejects symbolic links. The read path accepts any syntactically valid JSON object at that location. Fields such as `last_check_time`, `last_known_version`, `last_check_source`, and `last_update_available` influence whether the checker skips networking and what update status it reports. The write path uses `Path.write_text`, which follows an existing symbolic link. An attacker who can create the predictable cache path before the victim runs the Skill can therefore point it at another file writable by the victim process. The update checker may then truncate and replace that target with cache JSON. ### Attack Path #### Cache Poisoning 1. A local attacker creates `/tmp/ebrun-original-news-version-cache.json` before the victim invokes the update checker. 2. The attacker inserts valid JSON with a recent `last_check_time`, a matching `version_api_url`, an attacker-selected `last_known_version`, and `last_update_available` set to `true`. 3. The victim runs `scripts/update.py` without `--force`. 4. `read_cache_info()` accepts the attacker-controlled object. 5. The interval lo ...[truncated 1131 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update.sh:14- Finding
Predictable Shared Shell Cache Allows Version-State Poisoning and Symlink File Overwrite
- Content
View full analysis
/dev/null 2>&1; then if ! python3 -c 'import sys, json; data=json.loads(sys.stdin.read()); assert isinstance(data, dict)' <<< "$json" >/dev/null 2>&1; then log_warn "忽略损坏的版本缓存文件: $CACHE_FILE" echo '{}' return 0 fi elif command -v jq >/dev/null 2>&1; then if ! jq -e 'type == "object"' >/dev/null 2>&1 <<< "$json"; then log_warn "忽略损坏的版本缓存文件: $CACHE_FILE" echo '{}' return 0 fi elif [[ ! "$json" =~ ^[[:space:]]*\{ ]]; then log_warn "忽略损坏的版本缓存文件: $CACHE_FILE" echo '{}' return 0 fi echo "$json" } ``` ```bash with open(file_path, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2) f.write('\n') ``` ```bash cat > "$CACHE_FILE" <- Remediation
View remediation
"$CACHE_FILE"` and direct Python writes to the predictable path. 6. Use `noclobber` and platform-appropriate no-follow protections where available, while recognizing that these are supplements rather than substitutes for a private directory and ownership checks. 7. Strictly validate cached timestamps, source names, booleans, URLs, and bounded semantic-version strings. 8. Do not use cached data alone to generate unsolicited update calls-to-action. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Beyond news retrieval, the skill reads local version files, may write cache-like state, queries remote version sources, and exposes script-oriented operational controls. This mismatch matters because a content-fetching skill is being used as a vehicle for additional local-state and software-maintenance behavior, which broadens attack surface and complicates trust review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Beyond news retrieval, the skill reads local version files, may write cache-like state, queries remote version sources, and exposes script-oriented operational controls. This mismatch matters because a content-fetching skill is being used as a vehicle for additional local-state and software-maintenance behavior, which broadens attack surface and complicates trust review.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/update.sh --json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/update.sh --json
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md import subprocess from pathlib import Path skill_dir = Path(".claude/skills/ebrun-original-news") channel_file = skill_dir / "references" / "channel-list.json" data = json.loads(channel_file.read_text(encoding="utf-8"))
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md import subprocess from pathlib import Path skill_dir = Path(".claude/skills/ebrun-original-news") channel_file = skill_dir / "references" / "channel-list.json" data = json.loads(channel_file.read_text(encoding="utf-8"))
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to read local files, invoke shell/Python scripts, perform network requests, and maintain runtime cache behavior, but it does not declare any explicit tool restrictions or allowed-tools scope. In an agent environment, this expands the effective authority of a seemingly simple news skill and increases the chance of unintended file, shell, or network use beyond user expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The natural-language instructions, activation phrases, and output templates are entirely specified in Chinese, with no indication that users may interact in other languages or choose a locale. This creates a locale/language constraint in the skill behavior without explicit opt-in or justification as a region-specific tool.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The listed triggers "看看有什么AI新闻" and "品牌有什么新动态" are much broader than the skill's stated ecommerce-news scope and overlap with common user requests about general AI or brand news. Although some exclusion cases are listed later, these phrases can still cause unintended invocation because they do not clearly restrict the request to 亿邦动力网 or ecommerce-related coverage.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
该 markdown 文件属于 SQP-1 适用范围。
看看AI新闻、看品牌全球化报道、产业有什么新动态这类表述接近日常通用说法，文档又未给出排除条件或更明确的触发边界，容易与普通对话重叠并造成误调用。- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md import subprocess from pathlib import Path skill_dir = Path(".claude/skills/ebrun-original-news") channel_file = skill_dir / "references" / "channel-list.json" data = json.loads(channel_file.read_text(encoding="utf-8"))
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md import subprocess from pathlib import Path skill_dir = Path(".claude/skills/ebrun-original-news") channel_file = skill_dir / "references" / "channel-list.json" data = json.loads(channel_file.read_text(encoding="utf-8"))
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documented version-check and update behavior expands the skill's network reach beyond its stated purpose of fetching Ebrun news, including contacting GitHub/Gitee-derived URLs. This creates unnecessary external connectivity and increases supply-chain and data exfiltration risk if an attacker can influence repository URLs or remote version metadata.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Contacting GitHub/Gitee for version metadata is not necessary to retrieve latest Ebrun news and broadens the trust boundary to unrelated third-party infrastructure. Even without direct code execution, this can leak environment/network metadata, create an unexpected outbound channel, and expose users to spoofed update signals or repository-based supply-chain abuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This manifest-style JSON defines aliases used for channel selection, and the alias "产业" is very generic and lacks scope constraints. As a trigger term, it could collide with many ordinary references to industry rather than specifically invoking this channel.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill manifest describes a user-facing capability to retrieve the latest ecommerce news from 亿邦动力网, but this file is a maintenance utility for checking the skill's own version updates. Its logic reads local version metadata, caches results, and queries remote version endpoints and repository files rather than fetching news articles. This is a semantic mismatch between the declared skill purpose and the actual code behavior in this file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
技能清单描述该技能用于获取亿邦动力网最新电商新闻，但此脚本实现的是技能自身版本更新检查：读取本地 version.json、请求远程版本接口、探测 GitHub/Gitee 地址可达性并写入本地缓存。这些操作与“获取新闻报道”这一用户可见目的并不一致，属于独立的维护/更新功能。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
脚本允许访问版本接口以及 GitHub、raw.githubusercontent.com、Gitee 等仓库域名，并在主流程中主动请求这些地址以判断技能版本和仓库可达性。对于一个声明用途仅为获取亿邦动力网新闻的技能，这类面向代码仓库和更新元数据的网络能力并非实现新闻抓取的直接必要条件。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
SQP-3 适用于所有文件类型。当前文件从标题、触发示例到输出格式均默认强制使用中文，没有看到允许用户选择语言/locale 的说明；若该技能面向通用用户环境，这可能构成未经用户选择的语言策略限制。
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a skill for retrieving the latest Ebrun e-commerce news articles when users ask for news. In this file, Examples 8 and 10 document invoking
scripts/update.pyto check remote versions and surface upgrade notices, which is a maintenance capability rather than part of the user-facing news retrieval purpose.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Running
scripts/update.py --json --forceand checking remote APIs or repository version files introduces a software-update lookup capability unrelated to retrieving latest news content. For a skill whose declared purpose is to fetch Ebrun news reports, this maintenance/network behavior is not obviously required by that purpose.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file uses Chinese throughout and does not indicate that the skill is limited to Chinese-speaking users or provide an opt-in language choice. Under the language/locale policy, forcing a single language without user choice can be a natural-language policy violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The document frames the built-in scripts as defensive wrappers for news fetching, yet later sections describe separate update/version-check logic with different remote endpoints and fallback repository probing. This creates an intent-level inconsistency within the documentation about the skill's operational scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
All natural-language labels and aliases in the configuration are in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This can constitute a language/locale policy concern when users are not given an explicit opt-in or alternative.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language strings that force a specific language/locale for usage instructions and CLI interaction. Under the policy, a skill should not impose a language without giving the user a choice unless the constraint is clearly documented and justified as region-specific.
- Content