T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_and_send.py:24- Finding
TLS Certificate and Hostname Verification Disabled for All Network Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
news-daily
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to send RSS news to Feishu as advertised, but its network handling can expose or misuse the webhook credential.
Review before installing. Use this only after restoring normal TLS certificate validation, replacing the plain HTTP feed if possible, validating that the webhook URL is an HTTPS Feishu webhook, and avoiding logs that expose the webhook token. If it has already run on an untrusted network, rotate the Feishu webhook.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_and_send.py:247- Finding
Unrestricted Configuration Value Used as an Outbound POST Destination
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
整体上，代码的核心功能与声明基本一致：它确实直接通过 RSS 拉取新闻，并发送到飞书，类别也与声明相符。没有发现与新闻抓取/发送无关的可疑能力，也没有额外敏感行为。主要不一致点在于声明称“不依赖本地工程，直接从 RSS 获取数据”，但实际代码仍会读取脚本目录下的 config.json 或 config.example.json 来获取 webhook、日期和分类数量配置，因此并非完全不依赖本地配置。此外，它还依赖环境变量 NEWS_DAILY_WEBHOOK 作为配置来源。若将“不依赖本地工程”理解为“不需要原始项目的其他模块或服务”，则这属于轻度表述偏差；但按字面理解，描述未充分披露本地配置依赖，因此应标记为轻微不匹配。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content of the README is presented only in Chinese, which can amount to forcing a specific language without user opt-in under the stated policy. The file does not offer an alternative language, note that the skill is China-specific, or otherwise justify the locale constraint.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill documents capabilities that read environment variables, access local files, and perform outbound network requests, but it does not declare any explicit tool scope or permissions. This weakens reviewability and user consent because operators cannot easily see the effective access the skill requires before installation or execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example configuration uses only Chinese category names such as "国内", "国际", and "科技", which implies a fixed language/locale for user-facing configuration. Because the file does not state that the skill is China-specific or provide an alternative locale option, this can violate the policy against forcing a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script globally disables TLS certificate and hostname verification for all outbound HTTPS requests, including fetching RSS feeds and posting to the Feishu webhook. This enables man-in-the-middle interception or tampering, allowing an attacker on the network path to alter news content, redirect requests, or capture the webhook destination and posted data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README instructs users to configure a Feishu webhook and send aggregated news externally, but it does not clearly disclose that article titles, links, timing, and potentially usage metadata will be transmitted to a third-party service. This is primarily a transparency and privacy-consent issue rather than a direct exploit, but it can cause unintended data sharing in environments with stricter data-handling requirements.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documentation tells users to configure a Feishu webhook and run a script, but it does not clearly disclose that fetched content will be sent to an external service endpoint. This can lead to uninformed data egress, especially if RSS content, metadata, or future extensions include sensitive or regulated information.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content throughout the file is Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The top-level description and usage instructions are presented only in Chinese, and the script's user-facing runtime messages are likewise fixed to Chinese. Under the stated policy, forcing a specific language without opt-in or justification is a locale-policy issue.
- Content