News Summary Local

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:20 AM UTC
• Version: 1.0.0

Overview

The skill is a simple local RSS title summarizer, but one script can accidentally run an attacker-controlled helper from the current directory.

Review before installing. The skill does not show exfiltration, persistence, or destructive intent, but it should resolve extract.sh relative to its own installed directory before use. Until fixed, only run it from the trusted skill directory and do not run it while your current directory contains untrusted files named extract.sh.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: summarize.sh:10

Finding

Working-Directory Helper Script Hijacking

Content

View full analysis

Vulnerability Details

File Location: summarize.sh, line 10
Vulnerability Type: Untrusted helper-script resolution
Risk Level: High

Vulnerable Code:

bash

./extract.sh "$RSS_FILE"

Technical Analysis

The script invokes extract.sh relative to the process's current working directory rather than relative to the installed location of summarize.sh. This conflicts with the documented ability to run the skill from any path.

Consequently, ./extract.sh can resolve to an attacker-supplied executable in the directory from which the user launches the genuine summarize.sh. Quoting "$RSS_FILE" protects the RSS argument from shell word splitting but does not protect the helper executable's path.

Attack Path

1. An attacker creates or controls a directory that the victim will use as the current working directory.
2. The attacker places an executable named extract.sh in that directory and embeds arbitrary shell commands in it.
3. The victim invokes the genuine summarize.sh by its absolute or relative path while remaining in the attacker-controlled directory.
4. The RSS file check succeeds for the supplied input or a local news.rss.
5. At line 10, summarize.sh executes the attacker's ./extract.sh instead of the helper shipped with the skill.
6. The malicious commands run with the invoking user's privileges.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the skill. The attacker can access, modify, or delete data available to that user; execute additional local programs; and perform network or persistence actions permitted by the user's privileges. The flaw does not independently elevate privileges beyond those already held by the invoking process, so its scope is limited by that account's permissions.

Remediation

View remediation

Remediation Suggestions

Resolve the helper relative to the directory containing summarize.sh, not the current working directory:

bash

#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
RSS_FILE="${1:-news.rss}"

if [[ ! -f "$RSS_FILE" ]]; then
  printf 'RSS file not found: %s\n' "$RSS_FILE" >&2
  exit 1
fi

printf '%s\n' 'News highlights (first 10):'
"$SCRIPT_DIR/extract.sh" "$RSS_FILE"

Additionally:

• Ensure the packaged extract.sh is owned by a trusted account and is not writable by untrusted users.
• Preserve argument quoting and use -- with supporting utilities where appropriate.
• Add a regression test that launches summarize.sh from a directory containing a decoy extract.sh and verifies that the packaged helper is used.
• Consider validating that the resolved helper is a regular executable file before invoking it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing description is written in Chinese and presents the skill as a Chinese-language experience without offering any language or locale choice. This can violate language/locale policy when users are not given an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description is written only in Chinese ("本地 RSS 新闻摘要"), which indicates a language-specific presentation without any stated user choice or opt-in. Under the policy, language constraints should be optional or clearly justified, and no such justification appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script contains Chinese-language description and output strings, including the headline shown to users, with no indication that language choice is optional. This is a natural-language policy concern because it imposes a specific locale on all users without opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.