T01 · Skill Instruction Hijacking
Warning
- Location
scripts/scout.py:74- Finding
Untrusted RSS Content Enters the Agent Workflow Without Prompt-Injection Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
news-scout 热点新闻聚合简报
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed news-fetching skill with ordinary network and dependency risks, but no evidence of hidden persistence, data theft, or destructive behavior.
Install this only if you are comfortable with it making external news requests and installing Python packages from your configured package index. Prefer a virtual environment, pin dependencies, remove the stale duckduckgo-search install instruction, and treat all fetched news titles, snippets, and article text as untrusted content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Note
- Location
README.md:17- Finding
Unpinned and Unnecessary Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code broadly matches the high-level theme of aggregating AI and investment news, but several important parts of the declared description are not implemented. It fetches news from RSS and Bing News RSS, deduplicates results, and returns them as JSON. However, there is no logic for ranking by heat, no impact-analysis generation, and no visible implementation of the promised distinction between global and domestic China AI news except whatever may exist externally in the config file. Likewise, the stated focus on key U.S. stock market movements is not enforced by the code itself. The trigger description refers to user news queries, while the code is a standalone CLI fetcher. These are material description-to-behavior gaps, so this should be flagged as a mismatch.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains natural-language statements enforcing Chinese as the required language, such as '全中文文档和注释'. Under the policy, forcing a specific language without user opt-in or a clearly justified regional constraint is a language/locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Lines in this section describe '中文覆盖 100%' and '中文输出要求', which indicate the skill is designed to always use Chinese output. Because no user choice or justified locale limitation is provided in this file, this appears to violate the language/locale policy.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README advertises broad natural-language triggers like “新闻简报” and “今日新闻”, which are common user requests rather than narrowly scoped invocation phrases. In an agent environment, this can cause the skill to activate unintentionally on ordinary conversation, leading to unnecessary network access, unexpected tool execution, or the skill intercepting requests better handled by safer/default flows.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to install dependencies and run a script that performs network access and likely reads local files, but it declares no explicit tool scope or permissions boundary. That increases the chance of unintended capability use and makes review/enforcement harder if the skill is invoked automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description says the skill triggers when the user asks news-related questions, but that condition is vague and may match a large set of ordinary conversation. In an agent environment, ambiguous invocation criteria can cause unintended tool activation and broaden the skill's operational footprint.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger keywords are broad everyday terms like '新闻' and '简报', which can cause the skill to activate in contexts the user did not intend. Because the skill then encourages network fetching and script execution, accidental activation can lead to unnecessary external requests and tool use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The rule "所有交流和分析使用中文" forces a specific language for all interactions. This is a language-policy constraint presented as mandatory and does not offer the user a choice or opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural language in the module docstring that forces a specific language/locale. The policy explicitly calls for flagging language or locale constraints when the skill does not offer a user choice or document a justified regional limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script emits user-facing strings for errors, help text, examples, and debug output only in Chinese. Because the file does not offer language selection or clearly justify a Chinese-only locale, this is a natural-language policy violation under the language/locale rule.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This JSON config includes both English and Chinese sources and search queries via explicit language fields and mixed-language query strings, but it does not document how the skill chooses which language content to use for a given user. That can create a locale-policy issue if the skill presents or prioritizes one language without user opt-in or a clearly justified region-specific constraint.
- Content
Static analysis
No suspicious patterns detected.