scalingup-daily

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 3.0.0

Overview

The skill has a clear report-generation purpose, but it should go to Review because it mandates authenticated publishing and contains unsafe cross-skill script execution and scraping behavior.

Install only if you are comfortable with this skill searching external sites, saving reports locally, and publishing them through your IMA and Tencent Docs accounts. Before use, remove the recursive helper discovery, make upload destinations and publication opt-in, protect or rotate stored credentials, and review whether the Sogou/WeChat scraping behavior is acceptable for your environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: templates/daily_report_template.md:1

Finding

Mandatory Third-Party Branding Injected into Generated Reports

Content

View full analysis

本日报由 WorkBuddy 自动整理，涵盖6类优先级信息源，聚焦搜广推领域 Scaling Law、序列建模、统一建模等前沿技术动态。 ``` The template also appends the following fixed attribution: ```markdown > 本日报由 WorkBuddy 自动整理 | 涵盖 ArXiv / 微信公众号 / 知乎 / 技术博客 / GitHub / 会议论文等6类信息源 | 驱动模型：{AI模型名称} | 生成时间：{datetime} ``` ### Technical Analysis The report template unconditionally inserts WorkBuddy branding at both the beginning and end of generated reports. This attribution is not necessary to perform the declared technical task of searching sources, compiling findings, and publishing a daily report. Because the Skill directs the agent to use this template, the fixed statements alter the agent's output whenever the Skill is invoked. The user is not offered a per-run choice to include or omit the branding. This constitutes persistent output manipulation through Skill instructions. The separate requirement in `SKILL.md:142` to include a citation index is legitimate report formatting and is not, by itself, advertising or traffic diversion. ### Attack Path 1. A user invokes the daily-report Skill. 2. The agent loads the report-generation instructions and Markdown template. 3. The template causes the agent to place fixed WorkBuddy attribution in the report header and footer. 4. The Skill requires the report to be uploaded to IMA and Tencent Docs. 5. The third-party branding is consequently propagated to both externally published copies without an explicit per-run user request. ### Impact Assessment The issue can control a limited but predictable part of every generated and published report. It does not grant operating-system access or expose credentials, but it affects output integrity and can cause users to unknowingly distribute third-party promo ...[truncated 158 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/ima_upload.py:60

Finding

Untrusted Cross-Skill Script Discovery Can Execute Attacker-Controlled JavaScript

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ima_upload.py:134

Finding

Temporary COS Credentials Are Exposed Through Process Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior and the detected implementation behavior materially diverge: the skill is presented as a structured report generator and publisher, while the analysis indicates hidden scraping-oriented behavior including anti-bot-evasion techniques and output differences. This is dangerous because users and orchestrators may approve the skill based on an innocuous description while it actually performs undisclosed collection and scraping actions, expanding legal, security, and trust risk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

cd {skill_dir} && NODE_PATH={skill_dir}/node_modules {node_path} scripts/search_wechat.js "关键词" -n 5

Known Vulnerable Dependency: undici==7.25.0 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The lockfile pins transitive dependency undici to 7.25.0, and the supplied finding indicates this exact version is affected by multiple high-severity advisories. Because this skill appears to fetch and process external web content for daily aggregation, an HTTP client flaw in undici can materially increase risk of response confusion, information disclosure, or request/response desynchronization when interacting with untrusted remote servers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The randomized User-Agent pool is an anti-bot evasion technique intended to make automated scraping look like many different browsers/devices. In a skill whose stated purpose is generating daily reports, this increases the risk of undisclosed scraping against third-party services, bypassing rate limits or access controls, and can expose operators to account blocking, legal/compliance issues, or downstream misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code deliberately harvests cookies from an unrelated Sogou video endpoint and reuses them to support WeChat scraping and URL resolution. That is suspicious because it builds hidden state to work around anti-scraping controls, creating compliance and abuse risk and potentially enabling access patterns that the target service did not intend to grant.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation guide instructs users to place IMA credentials in plaintext files under ~/.config/ima without any guidance on file permissions, secret rotation, or safer secret storage. This increases the risk of local credential disclosure through multi-user access, backups, shell history mistakes, or malware reading predictable secret paths.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 66)May include surrounding context.

第 4 步：配置 IMA API 凭证

bash

mkdir -p ~/.config/ima
echo "你的_client_id" > ~/.config/ima/client_id
echo "你的_api_key" > ~/.config/ima/api_key

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 66)May include surrounding context.

第 4 步:配置 IMA API 凭证

bash

mkdir -p ~/.config/ima
echo "你的_client_id" > ~/.config/ima/client_id
echo "你的_api_key" > ~/.config/ima/api_key

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide retrieves a Tencent Docs token via shell commands and immediately registers it, but never warns that the token is a bearer secret or how to protect it. Tokens handled in shell workflows may be exposed via terminal logs, process inspection, copied command history, or insecure persistence in tool configuration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill declares broad operational behavior involving file reads, network access, and shell commands, but it does not declare any explicit tool scope or allowed-tools boundary. In a skill that performs external searches, local file output, and upload workflows, the lack of scope restriction increases the chance of over-privileged execution, unintended command use, or abuse if the skill is triggered in a broader agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mandates saving generated content locally and synchronizing it to external platforms automatically, but it provides no user-facing notice or consent checkpoint for data transmission and persistence. Even if the report is usually non-sensitive, prompts, embedded notes, internal summaries, or accidentally included proprietary information could be written to disk and exfiltrated to third-party services without the user's explicit awareness.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The uploader discovers and executes cos-upload.cjs from broad filesystem locations, including a recursive walk of ~/.workbuddy/skills, which expands the trust boundary far beyond the stated purpose of uploading a daily report. In the context of an agent skill, this is especially dangerous because any attacker able to place or replace that helper script can gain code execution in the user's environment and access short-lived cloud credentials, file contents, and API-linked operations.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · scripts/ima_upload.py (reported line 71)May include surrounding context.

python

return path
    
    # 尝试搜索
    for root, dirs, files in os.walk(os.path.expanduser("~/.workbuddy/skills")):
        for f in files:
            if f == "cos-upload.cjs":
                return os.path.join(root, f)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ima_upload.py (reported line 87)May include surrounding context.

python

return managed_node
    
    # 尝试系统 node
    result = subprocess.run(["which", "node"], capture_output=True, text=True)
    if result.returncode == 0:
        return result.stdout.strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

The script executes an external Node.js program assembled from a helper script located on disk and credentials returned by the API. Although subprocess.run is invoked without a shell, the danger is that the executed binary/script is discovered dynamically from user-writable locations, so a malicious or trojanized node binary or cos-upload.cjs helper could exfiltrate temporary COS credentials and uploaded content.

Content

Scanner excerpt · scripts/ima_upload.py (reported line 149)May include surrounding context.

python

"--expired-time", str(cos_credential["expired_time"])
    ]
    
    result_cos = subprocess.run(cos_cmd, capture_output=True, text=True)
    print("COS stdout:", result_cos.stdout)
    if result_cos.stderr:
        print("COS stderr:", result_cos.stderr)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a daily-report skill for collecting domain-relevant papers, technical articles, open-source projects, and conference news, then publishing a structured report. This file instead implements a dedicated scraper for WeChat public-account articles via Sogou, which is a materially different content source and behavior not reflected in the stated skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sends user-supplied search queries and request metadata such as IP-derived network identity, headers, and possibly cookies to external services without prominent disclosure or consent controls. In an agent skill context, this can leak sensitive research interests or internal topics to third parties and may surprise users who expect purely local processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire report template is written in Chinese, including headings, field labels, and boilerplate text, which indicates the skill is designed to always generate output in a specific language. The file does not mention any user-selectable language option or justified locale restriction, which fits the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill explicitly relies on stored API credentials and tokens from local configuration paths, but it does not warn the user that invoking the skill may access preconfigured secrets to perform authenticated operations. This is risky because users may not realize the skill is operating with their existing authority against external services, which can lead to unintended publication, account actions, or abuse if the skill is modified or triggered unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is written as a Chinese-only skill description ('搜广推领域模型 Scaling Up 日报生成技能'), which indicates a language-specific skill presentation without any note that users can choose another language. The policy requires flagging language or locale constraints when they are imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Using a caret range for a dependency allows newer compatible versions to be installed automatically, which can introduce supply-chain risk if an upstream release is compromised or contains an unexpected breaking/security change. In this skill context, the risk is limited because only a single common dependency is declared, but dependency drift still reduces build reproducibility and can expose consumers to unreviewed code.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"description": "搜广推领域模型 Scaling Up 日报生成技能",
  "private": true,
  "dependencies": {
    "cheerio": "^1.0.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The request headers force Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, and the script also formats dates specifically for China-oriented output elsewhere in the file. This is a natural-language locale policy concern because the tool imposes a language/locale preference rather than letting the user opt in or configure it.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The inline documentation frames getSogouCookie as merely obtaining cookies from a video page, but in code those cookies are used to enable or improve downstream scraping of WeChat/Sogou article URLs. This is not just incomplete documentation; it obscures the actual operational intent of using an unrelated page as a cookie source for another scraping workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.