Security audit

Newspulse

Security checks for vulnerabilities and agentic risk

Overview

This crypto news skill is not clearly malicious, but users should review it because installation runs an unpinned remote package and the main news command shows mock data as if it were current news.

Before installing, verify the exact registry package and pin a reviewed version instead of running the floating npx command. Treat the main news output as demo data, not market-current information, and be cautious with links printed from live RSS search results.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: README.md:30
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/search.mjs:24
Finding: Untrusted RSS Content Is Written to the Terminal Without Sanitization
Content: View full analysis
([\s\S]*?)<\/item>/g; let match; while ((match = itemRegex.exec(text)) !== null) { const item = match[1]; const title = item.match(/([\s\S]*?)<\/title>/)?.[1] || ''; const link = item.match(/<link>([\s\S]*?)<\/link>/)?.[1] || ''; const pubDate = item.match(/<pubDate>([\s\S]*?)<\/pubDate>/)?.[1] || ''; const description = item.match(/<description>([\s\S]*?)<\/description>/)?.[1] || ''; if (title && link) { items.push({ title, link, pubDate, description }); } } ``` The resulting untrusted values are written directly to the terminal: ```js filtered.forEach(item => { const time = timeAgo(item.pubDate).padEnd(8); const source = item.source.padEnd(14); const title = item.title.substring(0, 60) + (item.title.length > 60 ? '...' : ''); console.log(`${time} ${source} ${title}`); if (item.link) { console.log(` 🔗 ${item.link}`); } console.log(); }); ``` ### Technical Analysis RSS content is controlled by external servers. The script treats remote `title`, `link`, `pubDate`, and `description` values as trusted strings and prints `title` and `link` directly through `console.log`. A malicious or compromised feed can embed ANSI escape sequences, operating-system command terminal sequences, carriage returns, backspaces, bidirectional text controls, or OSC 8 terminal hyperlinks. Modern terminals may interpret these characters rather than displaying them literally. The regular-expression-based RSS parsing does not provide XML normalization or safe decoding. It can also preserve ...[truncated 1612 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/search.mjs:23
Finding: RSS Requests Lack Effective Time and Response-Size Limits
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to execute npx @gztanht/newspulse without pinning a specific package version. Because npx fetches the latest published package at execution time, a compromised maintainer account, malicious new release, or dependency-chain issue could cause users to run unexpected code immediately on their systems. In a skill intended for broad public installation, this increases supply-chain risk rather than being a purely theoretical concern.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises and requires Node/npm and describes fetching remote RSS feeds, which implies network-capable execution, but it does not declare any explicit tool scope or permission boundaries. This weakens sandbox transparency and can allow broader-than-expected network access, increasing the risk of unintended outbound connections or abuse if the package behavior changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This file contains user-facing description and usage headings primarily in Chinese, while the policy requires flagging language or locale constraints that are imposed without user opt-in. Although line L037 mentions English/Chinese news support, the skill documentation itself does not offer a language choice for users consuming the skill instructions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx @gztanht/newspulse without pinning an exact version causes execution of whatever package version is current at install time. This creates a supply-chain risk: if the package is updated maliciously, compromised, or publishes breaking behavior, users may execute unreviewed code with network access immediately.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code file contains natural-language strings and help text that present the skill as Chinese-only, including the title, usage, options, and output labels. The policy allows locale constraints only when the skill offers opt-in choice or clearly documents a justified regional limitation, neither of which is present here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises real-time crypto news aggregation, but the implementation serves only hard-coded mock items and never performs live retrieval or push delivery. In a financial/news context, this can mislead users into making time-sensitive decisions based on fabricated or stale data, which is a trust and integrity issue even though it is not direct code execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language strings and comments that force a specific language/locale for help output and status messages. Under the policy, a skill should not impose a language choice on users unless it offers opt-in or clearly documents a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The status output, error messages, usage text, and help content are all presented only in Chinese. This is a natural-language policy violation because the skill forces a specific language rather than allowing user choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language description is entirely in Chinese, which can impose a specific language on users without any opt-in or indication that the skill is intentionally region- or language-specific. Under the policy rules, language constraints should either provide user choice or be clearly justified.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: Using a caret range for node-fetch allows future compatible releases to be installed implicitly, which weakens build reproducibility and can unexpectedly introduce vulnerable or malicious upstream code. In a network-facing news aggregation skill, dependency drift matters because HTTP client behavior directly affects remote content fetching and trust boundaries.
Content: Scanner excerpt · package.json (reported line 23)May include surrounding context.
json
"author": "@gztanht", "license": "MIT", "dependencies": { "node-fetch": "^3.3.2" }, "repository": { "type": "git",

Unverifiable Dependency: node-fetch has 3 known advisory(ies) (CVE-2022-0235 (node-fetch forwards secure headers to untrusted sites); CVE-2022-2596 (node-fetch Inefficient Regular Expression Complexity ); CVE-2020-15168 (The `size` option isn't honored after following a redirect in node-fetch)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: The manifest references node-fetch without an exact pin, while known advisories exist for some node-fetch versions, so consumers cannot verify whether installation resolves to an affected release. Because this skill fetches external news content, weaknesses in the HTTP client can expose requests, headers, or resource handling to attacker-controlled endpoints.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The comments describe a legitimate live RSS path, but the executed path intentionally uses mock data instead, increasing the chance that reviewers or users believe the script is operating on real feeds. This mismatch is dangerous because it obscures actual behavior and reinforces deceptive output in a market-sensitive crypto setting.
Content: No source excerpt is available for this finding.