Security audit

Ai Daily

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches AI news from a fixed public RSS feed and formats it; the main cautions are normal dependency, network, and untrusted-content handling risks.

Install in a virtual environment, consider pinning dependency versions, and treat fetched RSS content as untrusted when generating HTML. The skill is appropriate for AI-news summaries from smol.ai, but users wanting general tech news or non-Chinese output may need to be explicit.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:65
Finding: Unpinned Third-Party Runtime Dependencies
Content: View full analysis
Remediation: View remediation
requests== ``` 2. Generate and verify package hashes, then install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin transitive dependencies through a reproducible lockfile generated by a tool such as `pip-compile`. 4. Configure installation to use an explicitly trusted package index and avoid untrusted extra indexes or mirrors. 5. Run dependency vulnerability and provenance checks in CI. 6. Recommend installation inside an isolated virtual environment without administrator or root privileges. 7. Periodically update pinned versions through a controlled review and testing process. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_news.py:121
Finding: Unsanitized Remote RSS Content Can Reach Generated HTML and Agent Context
Content: View full analysis
').replace('&', '&') return content ``` The documented downstream workflow is: ```text 1. User: "昨天AI资讯，生成网页" 2. Claude: "可选主题: 苹果风 / 深海蓝 / 秋日暖阳" 3. User: "苹果风" 4. Claude: Uses Apple Style Theme prompt to generate HTML 5. Save to `docs/{date}.html` ``` ### Technical Analysis RSS entry content is controlled by the remote feed and is therefore untrusted. The script extracts the remote `content` or `summary` field and manually decodes selected HTML entities. In particular, converting `<` and `>` back to angle brackets can turn previously encoded text into active markup. The resulting value is emitted as JSON without sanitization or a trust-boundary marker. The Skill documentation then directs the Agent to transform fetched material into Markdown or a complete HTML file. If downstream generation inserts that content without context-aware escaping, attacker-controlled tags, event attributes, dangerous links, or other active constructs could be written into the generated page. The same content can also contain instruction-like text intended to influence the Agent. Because the workflow does not instruct the Agent to treat feed content strictly as data, a compromised feed entry could attempt indirect prompt injection. The script itself does not execute the fetched content, so exploitation requires a downstream ...[truncated 1967 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/output-format.md (reported line 132)May include surrounding context.
md
--- ## Output Guidelines 1. **Title format**: `# AI Daily · {年}年{月}月{日}日` 2. **Summary**: 3-5 bullet points, one sentence each

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to perform live network access to an external RSS feed but does not declare any explicit tool scope, permissions, or allowed-tools boundary. This creates an authorization and transparency gap: an agent may invoke network-capable execution without clear policy constraints, increasing the risk of unintended external requests or capability creep.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest says to use the skill when the user asks about "AI news or daily tech updates," but "daily tech updates" is broader than the skill's actual scope of AI news from a specific RSS source. This ambiguity could cause unintended invocation for generic technology-update requests that the skill is not clearly designed to handle.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example interaction is written entirely in Chinese and presents the assistant's theme selection response in Chinese as the expected behavior. Because the file does not indicate that language is user-selectable or that the skill is intentionally region-specific, this suggests a locale/language constraint without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly requires Chinese category names and uses Chinese-only title/date formatting and content conventions. This is a natural-language locale policy constraint, but the file does not offer an opt-in choice or explain why the skill must operate only in Chinese.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill does not clearly warn users that it will make live requests to an external RSS source. This weakens informed consent and can lead to privacy or policy issues in environments where external network access should be explicit, especially if user queries are incorporated into requests or logs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The example queries and input table are primarily Chinese-specific, which may effectively constrain usage to one language without stating whether other languages are supported. The file does not offer a language choice or clarify that Chinese is only illustrative.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs an HTTP request to https://news.smol.ai/rss.xml, which transmits system-originated network traffic to a third-party service. While the module docstring says it fetches news, the runtime behavior provides no confirmation prompt or explicit user-facing notice at the point of the network operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.