Guangzhou Daily News

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:26 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a Guangzhou news helper, but it overstates automatic fetching, scheduled pushes, and WeChat delivery compared with the included code.

Review before installing. The included code does not actually fetch news, send WeChat messages, or configure cron despite the documentation claiming those behaviors. If used, confirm any scheduler or push setup separately, expect Markdown files under ~/News, and install dependencies in a virtual environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:98

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 98
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

Relevant Code Snippet:

bash

pip3 install requests beautifulsoup4

Technical Analysis

The installation instructions request third-party packages without specifying exact versions or validating package hashes. Consequently, the installed code depends on whichever package versions the configured Python package index serves at installation time.

The listed package names are established packages, and the audited project contains no evidence that they are currently malicious. However, the absence of version constraints and integrity verification creates a supply-chain weakness: future incompatible or compromised releases, a compromised package-maintainer account, or an untrusted package-index configuration could cause users to install code that was not reviewed with this skill.

Python package installation can execute package build hooks and other installation logic. Installed packages also execute code when imported. In this project, beautifulsoup4 is imported by scripts/fetch_news.py, so a compromised installed release could execute when article parsing is invoked.

Attack Path

1. A user follows the dependency installation command documented in SKILL.md.
2. pip3 resolves the latest available versions from the user's configured package index because no versions or hashes are specified.
3. An attacker would first need to compromise an upstream package release, its publishing account, or the package index used by the victim.
4. The user installs the attacker-controlled distribution.
5. Malicious code executes during package installation or later when the dependency is imported.

This is a conditional supply-chain attack path. No malicious dependency or direct remote payload execution was identified in the audited files.

Impact Assessment

A compromised d ...[truncated 440 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare dependencies in a dedicated lock or requirements file using reviewed, exact versions, for example:

   text

   requests==<reviewed-version>
   beautifulsoup4==<reviewed-version>
   

2. Generate and require cryptographic hashes for all distributions:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Review pinned releases before updating them and use automated dependency vulnerability scanning.

4. Install dependencies inside an isolated virtual environment rather than into the system Python environment.

5. Avoid running package installation as root or with sudo.

6. Remove requests from the installation instructions if it is not required by the final implementation; the audited script does not import it.

7. Document the trusted package index explicitly where deployment environments may use custom or mirrored indexes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill's claimed behavior does not match what is actually documented or apparently implemented: it promises live news retrieval and WeChat push support, yet the finding indicates no real fetching, local file writes as a side effect, and only message generation rather than delivery. This mismatch is dangerous because users and orchestration systems may grant trust or automation based on false expectations, causing silent data handling or persistence they did not knowingly approve.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill describes writing Markdown output to ~/News and configuring scheduled tasks, but it does not declare any explicit permissions or allowed tools. Undeclared file-write capability weakens user consent and platform enforcement, because the agent may perform local side effects that are not visible from the manifest or scope configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description advertises automatic WeChat pushes and scheduled execution without a clear warning that the skill may act without an immediate user prompt and may affect outbound messaging or user data. In an automation context, hidden scheduled behavior is security-relevant because it can create persistent actions and repeated data flows that users may not realize they enabled.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation phrases are broad enough to overlap with ordinary requests for local news, increasing the chance that the skill auto-runs when a user did not intend to invoke it. Because the skill also writes files and may schedule or prepare outbound messaging, accidental triggering can cause unintended side effects beyond a simple conversational response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains user-facing natural-language strings exclusively in Chinese, including the top-level script description and console guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

All user-facing instructions and invocation phrases are presented only in Chinese, which can amount to a language policy constraint if the skill implicitly requires a specific language without opt-in. The file does not state that the skill is region- or language-specific by design, nor does it offer users a language choice.

Content

No source excerpt is available for this finding.