T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_site_content.py:27- Finding
Unvalidated URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
TopHotCN
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent TopHub scraping tool, but its article fetcher can browse any URL from local JSON files without validation, which needs careful review before use.
Install and run this only in an isolated environment or network context where browser requests cannot reach sensitive internal services. Use it on trusted TopHub-generated JSON files, prefer --output to avoid modifying originals, and consider pinning dependencies before installation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:7- Finding
Unpinned Runtime Dependencies Create a Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example trigger phrases are broad, natural-language requests like '帮我获取这篇文章的正文' and '把这个目录下的文章都抓取一下', which can easily overlap with ordinary user requests outside this specific skill. In agent routing systems, this increases the chance of unintended activation, causing the agent to run web-scraping or file-processing actions in the wrong context and potentially touch arbitrary local paths or external URLs supplied indirectly through JSON inputs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code file performs HTTP/content retrieval from arbitrary URLs and, by default, writes fetched results back into the original JSON files. While the CLI help mentions that content is fetched and rewritten, it does not clearly warn users that running the script will contact external sites and transmit request metadata to those sites, which is a relevant safety/privacy disclosure for a URL-crawling tool.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The argparse description says '今日热榜爬虫 + 内容抓取', which indicates the tool also fetches content. However, the implemented workflow only fetches ranking entries from tophub.today and writes title/description/url metadata, with content explicitly left empty and a later message directing users to a different script for body fetching.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions, examples, and operational guidance are presented entirely in Chinese, but the file does not state that the skill is intended only for Chinese-speaking users or provide any language opt-in. This can violate language/locale policy when a skill implicitly forces one language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
Natural-language strings in the module docstring and CLI help are exclusively Chinese, and the script does not offer a language or locale choice. Per the policy, forcing a specific language without opt-in is a locale/language policy issue unless explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTTP session sets the Accept-Language header to 'zh-CN,zh;q=0.9', which hard-codes a language/locale preference. This is a natural-language locale constraint and the file does not offer user opt-in or explain why a Chinese locale is required.
- Content