Turkish Locale Skill Pack 🇹🇷

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:30 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed Turkish briefing automation package, but it has enough scope and documentation mismatches around market tracking, dependencies, and recurring outbound delivery to require Review before installation.

Review before installing. Confirm you actually want recurring Telegram or Discord delivery, verify the target chat or channel and removal process, avoid sending sensitive summaries, and treat the BIST/crypto market tooling as inconsistent until the publisher fixes the docs and script naming. Use pinned dependencies in an isolated environment if you run the bundled scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: turkish-news/SKILL.md:127
• Finding: Unsafe manual serialization of externally controlled RSS fields<![CDATA[ ## Vulnerability Details **File Location**: `turkish-news/SKILL.md`, lines 127–136 **Vulnerability Type**: Untrusted data handling and unsafe serialization **Risk Level**: Medium ### Vulnerable Code ```python result = terminal(f"curl -s -m 10 '{url}' | python3 -c \"\nimport sys, xml.etree.ElementTree as ET\ntry:\n tree = ET.parse(sys.stdin)\n for item in tree.findall('.//item')[:10]:\n title = item.findtext('title', '')\n link = item.findtext('link', '')\n desc = item.findtext('description', '')\n date = item.findtext('pubDate', '')\n print(f'{{\\\"title\\\": \\\"{title}\\\", \\\"link\\\": \\\"{link}\\\", \\\"source\\\": \\\"{name}\\\"}}')\nexcept: pass\n\"") # Parse results... ``` ### Technical Analysis The RSS `title` and `link` fields originate from external news servers and are inserted into a manually constructed JSON string without JSON encoding. Characters such as quotation marks, backslashes, line breaks, and control characters can corrupt the resulting record or create additional apparent fields or records. The URLs and source names in the documented implementation are fixed constants, so the reviewed code does not establish command injection through those values. The primary problem is unsafe output serialization and downstream content integrity, not execution of RSS content. The broad `except: pass` clause suppresses all parsing and serialization errors. This makes malformed or hostile feed content difficult to detect and can cause silent loss or manipulation of briefing data. ### Attack Path 1. An attacker compromises a configured RSS source, controls an upstream article title, or causes a source to return crafted RSS content. 2. The Skill downloads that RSS document using `curl`. 3. `ElementTree` extracts an attacker-controlled title or link. 4. The value is interpolated directly into JSON-like output without `json.dumps()`. 5. Embedded quotes, backslashes, or line breaks alter the downstrea ...[truncated 815 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the nested shell and inline Python construction. Fetch RSS using a Python HTTP client or a constrained platform network tool. 2. Store each item as a Python dictionary and serialize it with `json.dumps()`: ```python import json record = { "title": title, "link": link, "source": name, } print(json.dumps(record, ensure_ascii=False)) ``` 3. Validate links before presenting them: - Permit only `https`. - Restrict hosts to an explicit allowlist of configured news domains. - Reject embedded credentials and unexpected ports. 4. Normalize or reject control characters in titles and source names. 5. Replace `except: pass` with narrow exception handling and structured logging. 6. Treat fetched articles and RSS text as untrusted data, not Agent instructions. 7. Add tests containing quotes, backslashes, newlines, HTML, malformed XML, and oversized feed values. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/telegram_send.py:128
• Finding: Untrusted Telegram messages and captions are interpreted as HTML<![CDATA[ ## Vulnerability Details **File Location**: `scripts/telegram_send.py`, lines 128–186 **Vulnerability Type**: Unescaped externally derived content in an HTML-enabled messaging sink **Risk Level**: Medium ### Vulnerable Code ```python payload = { "chat_id": chat_id, "parse_mode": "HTML", } if caption: payload["caption"] = caption try: with open(path, "rb") as photo: files = {"photo": (path.name, photo, "image/png")} resp = requests.post(url, data=payload, files=files, timeout=30) ``` ```python if len(text) > MAX_MESSAGE_LENGTH: text = text[:MAX_MESSAGE_LENGTH - 20] + "\n\n[...kesik/truncated]" payload = { "chat_id": chat_id, "text": text, "parse_mode": "HTML", "disable_web_page_preview": True, } try: resp = requests.post(url, json=payload, timeout=15) ``` ### Technical Analysis The script accepts `text`, `caption`, and fallback text from command-line arguments or upstream briefing pipelines and submits them to Telegram with `parse_mode` set to `HTML`. No HTML escaping or permitted-tag validation is applied. When briefing text includes externally sourced headlines, source names, or links, an upstream content provider can introduce Telegram-supported markup. This may create deceptive hyperlinks, alter visual emphasis, or produce malformed markup that causes Telegram to reject the message. The transmission itself is expected behavior: the script sends requested content to the official Telegram Bot API. No hidden recipient or unrelated sensitive-file collection was identified. The vulnerability is the unsafe interpretation of message content at the delivery sink. ### Attack Path 1. An attacker controls or compromises a news field consumed by the briefing pipeline, or supplies crafted content to a caller that invokes the script. 2. The crafted content includes Telegram-compatible HTML, such as a deceptive anchor element. 3. The content reaches `--text`, `--caption`, or `--fallback-text`. 4. ...[truncated 946 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. If rich formatting is unnecessary, remove `parse_mode` entirely. 2. If HTML formatting is required, escape every untrusted value using `html.escape()` before inserting it into a trusted template: ```python from html import escape safe_text = escape(text, quote=False) payload = { "chat_id": chat_id, "text": safe_text, "parse_mode": "HTML", "disable_web_page_preview": True, } ``` 3. Keep formatting tags in application-controlled templates and never allow upstream RSS fields to provide raw tags. 4. Validate outbound links against allowed schemes and, where practical, expected news-source domains. 5. Add a strict mode that sends all user- or feed-derived content as plain text. 6. Test captions and messages containing `<`, `>`, `&`, nested tags, malformed tags, and deceptive anchors. 7. Require explicit confirmation before sending content to a destination supplied through `--channel`, especially in automated Agent workflows. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/telegram_send.py:22
• Finding: Unpinned requests dependency in the Telegram sender<![CDATA[ ## Vulnerability Details **File Location**: `scripts/telegram_send.py`, lines 22–29 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```python Bağımlılıklar / Dependencies: pip install requests """ import argparse import os import sys from pathlib import Path try: import requests except ImportError: print("\033[91m✗ 'requests' kütüphanesi gerekli / required\033[0m") print(" pip install requests") sys.exit(1) ``` ### Technical Analysis The installation guidance retrieves the current version of `requests` without an exact version, lock file, hash, or authenticated internal package policy. Consequently, separate installations may execute different dependency versions. `requests` is a legitimate package, and no malicious package is embedded in this project. The risk arises if a future release, transitive dependency, package-index response, or local package-source configuration is compromised. This is particularly sensitive because the script handles a Telegram bot token and sends files and text over the network. A compromised dependency executing in the Python process would inherit access to those values and to files readable by the invoking user. ### Attack Path 1. An attacker compromises a dependency release, transitive dependency, configured package index, or package-resolution environment. 2. A user follows the documented `pip install requests` instruction. 3. `pip` installs the attacker-controlled or vulnerable resolved version. 4. The package executes during installation or when imported by the Telegram sender. 5. Malicious code runs with the invoking user's privileges and can access the Telegram token, message content, selected image, and other resources available to that process. ### Impact Assessment If dependency compromise occurs, impact can include arbitrary code execution with the invoking user's privileges, theft of `TELEGRAM_BOT_TOKEN`, access to bri ...[truncated 274 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a reviewed dependency lock file with exact versions. 2. Pin both direct and transitive dependencies and record hashes. 3. Install with hash enforcement, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Use an isolated virtual environment rather than the system Python environment. 5. Document the expected package index and prohibit untrusted extra indexes. 6. Run automated dependency vulnerability and provenance checks. 7. Correct the root documentation claiming “stdlib only” and “zero dependencies.” 8. Execute the sender with a minimally privileged account and expose the Telegram token only to that process. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/bist100_prices.py:19
• Finding: Unpinned requests dependency in the cryptocurrency price script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bist100_prices.py`, lines 19–26 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```python Bağımlılıklar / Dependencies: pip install requests """ import argparse import json import sys from datetime import datetime, timezone, timedelta try: import requests except ImportError: print("\033[91m✗ 'requests' kütüphanesi gerekli / required\033[0m") print(" pip install requests") sys.exit(1) ``` ### Technical Analysis The script instructs users to install `requests` without an exact version or integrity hash. This makes installation non-reproducible and delegates trust to the package index and whatever dependency versions are selected at installation time. No malicious dependency or package name was found in the reviewed artifact. Exploitation requires compromise of the package supply chain, an unsafe package-index configuration, or installation of a vulnerable future version. The file name suggests a BIST100 price utility, while the implementation actually retrieves cryptocurrency prices from CoinGecko. This mismatch is not itself code execution, but it may cause users to run or install dependencies for behavior they did not accurately anticipate. ### Attack Path 1. An attacker compromises a resolved package release, transitive dependency, or configured package source. 2. A user follows `pip install requests`. 3. The unverified package is installed and subsequently imported. 4. Attacker code executes with the privileges of the user running the script. 5. The code can access the local environment and network resources available to that process. ### Impact Assessment A successful supply-chain compromise could provide arbitrary code execution under the invoking user's account. The reviewed script does not handle private keys, wallets, trading credentials, or transactions, so no direct cryptocurrency asset-theft path w ...[truncated 129 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `requests` and all transitive dependencies in a lock file. 2. Include cryptographic hashes and install with `--require-hashes`. 3. Use a dedicated virtual environment with no unnecessary credentials. 4. Scan locked dependencies for known vulnerabilities before release. 5. Document and restrict the permitted package index. 6. Rename the script to reflect its actual cryptocurrency behavior, or replace the implementation with the declared BIST100 functionality. 7. Update root documentation so dependency and functionality claims match actual behavior. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/turkish_brief_card.py:17
• Finding: Unpinned Pillow dependency in the briefing card generator<![CDATA[ ## Vulnerability Details **File Location**: `scripts/turkish_brief_card.py`, lines 17–27 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```python Bağımlılıklar / Dependencies: pip install Pillow """ import argparse import json import os import sys from datetime import datetime, timezone, timedelta from pathlib import Path try: from PIL import Image, ImageDraw, ImageFont except ImportError: print("\033[91m✗ 'Pillow' kütüphanesi gerekli / required\033[0m") print(" pip install Pillow") sys.exit(1) ``` ### Technical Analysis The script tells users to install the latest resolvable `Pillow` package without a pinned version, lock file, or integrity hash. Pillow includes native image-processing components, making release integrity and timely security updates important. No malicious Pillow component was found in the project. Exploitation depends on package-source compromise, a compromised future release, or resolution to a vulnerable version. The generator can read a user-selected JSON input and write to a user-selected output path. A compromised image dependency would execute in a process with those same file-system permissions. ### Attack Path 1. An attacker compromises the resolved Pillow package, one of its distribution artifacts, or the configured package source. 2. A user follows `pip install Pillow`. 3. The unverified package is installed. 4. The generator imports `PIL`, causing malicious package code to execute. 5. The attacker gains the file and network access available to the invoking account. ### Impact Assessment A successful dependency compromise could permit arbitrary code execution with the invoking user's privileges and access to briefing JSON, output paths, and other files readable by that account. The card generator itself does not request administrator access, collect credentials, establish persistence, or transmit data over the network. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Pillow to a reviewed version in a lock file. 2. Record and enforce package hashes. 3. Install dependencies inside an isolated virtual environment. 4. Use trusted binary distributions from a controlled package source. 5. Continuously scan the locked Pillow version for image-processing vulnerabilities. 6. Run the generator with minimal file-system permissions and restrict output locations in automated environments. 7. Correct the root claim that the project has no non-standard-library dependencies. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (36)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match

Content

�━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
# Sabitler / Constants
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

TELEGRAM_API_BASE = "https://api.telegram.org/bot{token}"

# Varsayılan caption (resim gönderiminde)
DEFAULT_CAPTION = "🌅 Günlük Brifing — Hermes Agent 🇹🇷"

# Telegram API limitleri
MAX_CAPTION_LENGTH = 1024       # sendPhoto caption limiti
MAX_MESSAGE_LENGTH = 4096       # sendMessage metin limiti
MAX_PHOTO_SIZE = 10 * 1024 * 1024  # 10 MB foto limiti

# ANSI renkleri
class C:
    RED    = "\033[91m"
    GREEN  = "\033[92m"
    YELLOW = "\033[93m"
    CYAN   = "\033[96m"
    DIM    = "\033[2m"
    BOLD   = "\033[1m"
    RESET  = "\033[0m"


# ━━━━━━━━━━━━━━━━━━━━━�

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tainted flow: 'url' from os.environ.get (line 207, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

try:
        with open(path, "rb") as photo:
            files = {"photo": (path.name, photo, "image/png")}
            resp = requests.post(url, data=payload, files=files, timeout=30)

        result = resp.json()

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'url' from os.environ.get (line 207, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

}

    try:
        resp = requests.post(url, json=payload, timeout=15)
        result = resp.json()

        if result.get("ok"):

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'url' from os.environ.get (line 207, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

"""
    url = f"{TELEGRAM_API_BASE.format(token=token)}/getMe"
    try:
        resp = requests.get(url, timeout=10)
        result = resp.json()
        if result.get("ok"):
            bot = result["result"]

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The code’s primary purpose is materially different from the declared description. Although it is Turkish-localized in language and TRY currency formatting, the functional behavior is a crypto market tracker, not a BIST100 stock tracker. It fetches data from CoinGecko and supports coin selection, sorting, and JSON/table output for cryptocurrencies. The declared description also mentions Turkish news sources, daily brief automation, and a Turkish personality template, none of which appear in this code chunk. Therefore this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description frames the skill as a Turkish locale pack focused on Turkish news, BIST100 tracking, daily brief automation, and Turkish personality templating. The supplied code does not fetch news, track stocks, generate briefs, or configure Turkish-language personality behavior. Instead, it is a Telegram delivery tool that posts images or text to a specified Telegram channel/chat and verifies bot connectivity using TELEGRAM_BOT_TOKEN and TELEGRAM_HOME_CHANNEL. While 'daily brief automation' could plausibly include distribution, Telegram broadcasting is a significant undeclared capability and appears to be the code's primary purpose here. Therefore the code materially differs from the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description presents a broader Turkish locale skill pack with news sources, BIST100 tracking, daily brief automation, and a Turkish personality template. The supplied code chunk is much narrower: it is a local image generator that reads optional JSON input or uses demo data and outputs a formatted PNG briefing card. It performs no network access, no source retrieval, no live market/news tracking, no scheduling/automation, and no personality/template logic. While the card generator could be a supporting component of a daily briefing system, this chunk alone does not accurately represent the broader declared capabilities, so this is a mismatch.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script materially diverges from the skill manifest by implementing a cryptocurrency tracker instead of the declared BIST100/Turkish stock-tracking capability. This kind of capability mismatch is dangerous because users, reviewers, or downstream agents may trust the manifest and invoke the script under false assumptions, causing unauthorized data flows, incorrect financial automation, or hidden expansion of the skill’s effective scope.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: turkish-daily-brief
version: 1.0.0
description: "Telegram veya Discord üzerinden otomatik günlük Türkçe brifing — haberler, piyasalar, hava durumu ve günün özeti. / Automated daily Turkish brief via Telegram or Discord — news, markets, weather, and day summary."
tags: [turkish, daily-brief, telegram, discord, automation, cronjob, morning-brief]
author: Hermes Agent Hackathon 2026
triggers:
  - "günlük brifing", "sabah brifing", "daily brief"
  - "her sabah haber gönder", "otomatik sabah özeti"
  - "Telegram'dan brifing", "günlük rapor"
  - user wants to schedule recurring Turkish news/market updates
---

# �

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Script Fetching

High

• Category: Supply Chain

Content

from hermes_tools import web_extract, terminal
import json

# Fetch RSS feeds via curl (faster than web_extract for XML)
sources = {
    "Hürriyet": "https://www.hurriyet.com.tr/rss/anasayfa",
    "NTV": "https://www.ntv.com.tr/son-dakika.rss",

• Confidence: 97% confidence
• Finding: The sample code fetches remote content by invoking curl via terminal(), then pipes it into an inline Python script. Using external command execution for network retrieval in a skill materially increases the risk surface: it can enable command injection if inputs later become user-controlled, weakens sandbox assumptions, and normalizes a dangerous pattern in a context that only needs straightforward RSS fetching.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises capabilities that inherently require network, file, and possibly environment access, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations increase the chance of over-broad tool use, hidden side effects, or execution under default privileges that exceed what users expect.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill prominently promotes automated Telegram brief delivery but does not pair that with clear warnings about recurring outbound messages, privacy implications, destination control, or credential handling. Users may enable ongoing automation without understanding that the agent could continue sending content externally on a schedule.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The quick-start workflow says the agent will set up a cronjob for Telegram delivery, but it does not explain persistence, how to audit or disable the job, what data will be transmitted, or how failures are handled. Persistent automation without safety disclosures can lead to accidental data leakage, unwanted spam, or hard-to-notice continued execution.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The auto-activation logic triggers on broad signals such as any Turkish-language input, then applies personality behavior or routes into domain-specific sub-skills. Over-broad activation can cause unintended tool use, unnecessary network access, or style/behavior changes during unrelated conversations, which weakens user consent and increases the chance of surprise actions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes broad, common phrases such as "borsa", "hisse", "döviz", and "piyasa" that can match many ordinary Turkish conversations and cause the skill to activate outside the user's intended scope. In a finance-oriented skill, overbroad activation can lead to unintended web requests, irrelevant financial responses, and context hijacking from other more appropriate skills.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file explicitly brands itself as a "Turkish Locale Skill Pack," and the implementation hard-codes Turkish formatting, timezone, labels, and TRY currency output. This creates a language/locale constraint without any visible opt-in or alternative locale selection, which matches the policy-violation criterion for forced language or locale.

External Transmission

Medium

• Category: Data Exfiltration

Content

MAGENTA = "\033[95m"

# CoinGecko API
COINGECKO_MARKETS_API = "https://api.coingecko.com/api/v3/coins/markets"


# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The CLI help and inline documentation explicitly advertise cryptocurrency tracking, confirming that the mismatch is not accidental at runtime but documented into the skill itself. This increases the risk of operator deception and misuse because a human reviewer may assume the package is safe for BIST100 use while the executable interface encourages a different financial domain.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file describes itself as a 'Turkish Locale Skill Pack', and its user-facing defaults and messaging are predominantly Turkish. This creates a language/locale constraint without offering the user a choice or opt-in, which matches the policy-violation criterion for forced language or locale.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Sabitler / Constants
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

TELEGRAM_API_BASE = "https://api.telegram.org/bot{token}"

# Varsayılan caption (resim gönderiminde)
DEFAULT_CAPTION = "🌅 Günlük Brifing — Hermes Agent 🇹🇷"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

    try:
        resp = requests.post(url, json=payload, timeout=15)
        result = resp.json()

        if result.get("ok"):

• Confidence: 80% confidence
• Finding: The script transmits message content to an external third-party service, Telegram, including arbitrary text and optional fallback content. In an agent context, this becomes dangerous if sensitive internal data, summaries, or user content can be routed here without explicit authorization, because it creates a data egress path outside the local trust boundary.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This code file includes natural-language descriptions and behavior that explicitly target Turkish output, such as Turkish-formatted dates and Turkish briefing text, but does not provide an opt-in or alternative locale selection. The policy requires flagging language or locale constraints unless they are clearly documented and justified as region-specific; here the file forces Turkish presentation for all runs of the script.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough that normal conversation about a daily summary or morning news could activate this automation skill unexpectedly. Because the skill can schedule recurring jobs and send messages to external channels, accidental activation expands from a simple UX issue into unintended automated actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The manifest and documentation describe a Turkish daily brief skill that gathers news, markets, and weather for delivery via Telegram, Discord, or CLI. However, the self-contained cronjob prompt explicitly tells the future agent to run `curl`, introducing shell-style command execution rather than using the documented higher-level retrieval tools; this is broader than necessary for the stated purpose.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI delivery mode writes files to a local directory without any explicit user-facing warning or consent step. Silent local file creation can surprise users, leak sensitive brief contents to shared systems, or create persistence artifacts the user did not intend.

Static analysis

No suspicious patterns detected.