hfnews

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:05 PM UTC
• Version: 1.0.0

Overview

The skill is a disclosed news fetcher, but it opens remote websites with Chromium sandboxing disabled and includes risky Puppeteer dependencies, so it should be reviewed before installation.

Install only if you are comfortable with a news-fetching skill making outbound requests to the listed news sites. Prefer the RSS-based script or require the browser fetcher to run with Chromium sandboxing enabled, updated dependencies, and restricted network egress before trusting it in an environment with sensitive files or secrets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: fetcher.js:85
• Finding: Chromium Sandbox Disabled While Rendering Untrusted Remote Content<![CDATA[ ## Vulnerability Details **File Location**: `fetcher.js:85-95` **Vulnerability Type**: Unsafe browser isolation configuration **Risk Level**: High ```javascript browser = await puppeteer.launch({ headless: true, executablePath: '/usr/bin/chromium', args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage', '--disable-gpu'] }); const page = await browser.newPage(); await page.setViewport({ width: 1280, height: 800 }); await page.setUserAgent('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'); await page.goto(url, { waitUntil: 'networkidle2', timeout: 30000 }); ``` ### Technical Analysis The Skill launches Chromium with both `--no-sandbox` and `--disable-setuid-sandbox`, disabling critical Chromium security boundaries. It then navigates to externally controlled news websites and loads their active content, including JavaScript and potentially third-party advertisements, redirects, and embedded resources. A browser sandbox is designed to contain a compromised renderer and prevent it from directly exercising the filesystem, operating-system interfaces, and other resources available to the browser process. Disabling it does not itself execute malicious code, but it significantly increases the consequences of a Chromium vulnerability. External network access is necessary for the declared news-fetching functionality. Removing browser isolation is not necessary, particularly because the project also contains an RSS-based implementation that does not render active web content. ### Attack Path 1. An attacker compromises a configured news source, advertising network, analytics resource, or another third-party resource loaded by that source. 2. The Skill invokes `fetchSource()` and navigates Chromium to the affected page. 3. The page delivers JavaScript or other browser content crafted to exploit a vulnerability in the installed Chromium version. 4. The exploit compromises a Chromium renderer or related browser ...[truncated 1224 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` and `--disable-setuid-sandbox` from the Chromium launch arguments. 2. Run Chromium as a dedicated, unprivileged operating-system user with its supported sandbox enabled. 3. Prefer the RSS-based implementation in `scripts/news.py` where browser rendering is unnecessary. 4. If browser rendering remains required, execute it in a hardened container or equivalent isolation boundary with: - A read-only root filesystem. - No host filesystem mounts containing sensitive data. - Dropped Linux capabilities. - No privileged container mode. - Strict CPU, memory, process, and execution-time limits. - Network egress restricted to explicitly approved news domains. 5. Intercept browser requests and block unnecessary third-party scripts, advertisements, trackers, downloads, and non-HTTP(S) schemes. 6. Keep Chromium and Puppeteer on supported, security-patched releases. The lockfile identifies Puppeteer `23.11.1` as deprecated and no longer supported. 7. Where possible, disable JavaScript and retrieve only static document content, or parse RSS/Atom feeds instead of executing website content. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Known Vulnerable Dependency: basic-ftp==5.1.0 — 4 advisory(ies): CVE-2026-27699 (Basic FTP has Path Traversal Vulnerability in its downloadToDir() method); GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The lockfile pins basic-ftp 5.1.0, which is flagged for multiple upstream issues including path traversal, CRLF/command injection, and denial of service. In this skill, basic-ftp is only a transitive dependency via get-uri/pac-proxy-agent/proxy-agent/puppeteer rather than a directly used library, so exploitability depends on whether the skill allows attacker-controlled FTP or PAC/proxy inputs; that makes it real but somewhat context-limited.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: extract-zip 2.0.1 is present and has advisories for arbitrary file write and symlink path traversal during archive extraction. Because puppeteer commonly downloads and extracts browser binaries through @puppeteer/browsers, this dependency is relevant in this skill’s installation/runtime supply chain and could permit overwrite of files if a malicious archive is processed.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: ip-address 10.1.0 is included transitively through socks-related proxy handling and has advisories involving octet parsing ambiguity and XSS in HTML-emitting helpers. In this skill context, the package is unlikely to render HTML and may only be used for proxy/address parsing, so the issue is real upstream but probably has limited direct exploitability here unless untrusted proxy/address data is accepted and displayed.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: js-yaml 4.1.1 is present and has CPU consumption / denial-of-service advisories related to complex YAML parsing. Here it appears transitively through cosmiconfig used by puppeteer, so risk depends on whether the skill loads attacker-controlled YAML configuration; without that, practical exposure is limited but the vulnerable package is genuinely present.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: ws 8.19.0 is included by puppeteer-core and has advisories for memory disclosure and memory-exhaustion denial of service. Since puppeteer uses WebSocket connections to communicate with browsers/devtools, this package is operationally relevant; if an attacker can influence or access those channels, they may trigger crashes or potentially expose memory contents.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly relies on network access to fetch news, but the manifest does not declare any explicit tool scope or allowed tools. Missing scope declarations weaken least-privilege controls and can allow the runtime to grant broader capabilities than reviewers or users expect, increasing the chance of unintended external access.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Natural-language strings, keyword extraction, blacklist terms, navigation filters, and output messaging are all tailored to German, with no indication that the user can opt into or change locale. The policy requires flagging language or locale constraints when a skill forces a specific language without user choice or clear justification.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a news fetcher focused on IT and Cybersecurity with political and sports noise filtered out. However, the SOURCES configuration includes a large 'Allgemeines' general-news category, and later keyword extraction explicitly models political topics such as AfD, BSW, Ampel, migration, Israel, China, and Europa, indicating broader general/political aggregation than the stated focused scope.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest frames this skill as customized for IT and cybersecurity interests while filtering political and sports noise. However, the source list explicitly includes a 'general' category with broad mainstream news outlets, so the implemented behavior is wider than the described specialized scope.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The usage examples and output format require German terms such as "Allgemeines" and "Titel" while the skill description does not state that the tool is intentionally German-only or provide an alternative language option. This can violate language/locale policy when users are not given an explicit opt-in or justified locale restriction.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: This code launches a browser and makes HTTP requests to multiple third-party news sites, but there is no comment, docstring, or explicit user-facing notice describing that outbound network access will occur. For code files, network calls that transmit user or system data should have some form of disclosure unless clearly covered by the skill description, which is not present here.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The code lowercases the user argument and validates it against SOURCES keys, but the actual keys are 'Allgemeines', 'IT', and 'Cybersecurity'. The usage text claims valid arguments are 'general|it|cybersecurity', while `SOURCES[category]` will reject 'general' and also reject lowercase 'it'/'cybersecurity' because the object keys are mixed-case German/English labels.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"description": "News fetcher with headless browser",
  "main": "fetcher.js",
  "dependencies": {
    "puppeteer": "^23.0.0"
  }
}

• Confidence: 94% confidence
• Finding: The dependency uses a caret range (^23.0.0), which allows automatic installation of newer minor and patch releases. This can introduce supply-chain risk because upstream changes, regressions, or a compromised package release could be pulled in without explicit review; the use of Puppeteer also increases sensitivity because it is a large, complex dependency that downloads browser components and processes untrusted web content.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The top-level docstring states 'News fetcher using RSS feeds', which implies RSS/XML-only behavior. In practice, the code falls back to JSON parsing for at least one source, so the documentation is not accurate about what formats the script handles.

Static analysis

No suspicious patterns detected.