hot-news-tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.1

Overview

This news-tracking skill has a coherent purpose, but it tells agents to run user-provided search terms through shell-style commands and to globally install an unpinned npm CLI if missing.

Review before installing. Use this only in an environment where the agent runs commands with limited filesystem and network privileges, avoid passing suspicious search strings, and prefer a pinned, local gnomic-cli installation invoked with structured arguments rather than shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:59

Finding

Shell Command Injection Through an Untrusted News Search Keyword

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–65 and 108
Vulnerability Type: Shell command injection
Risk Level: High

The Skill repeatedly instructs the Agent to place a user-provided search keyword inside a shell command. The relevant command pattern, rendered with an English placeholder, is:

bash

gnomic news search "<user-supplied keyword>"

The same unsafe pattern is prescribed in the command-selection table:

text

Search for a topic or keyword: gnomic news search "<user-supplied keyword>"

Technical Analysis

The keyword originates from the user's request and is therefore untrusted. If the Agent constructs the documented command as a string and submits it to a shell, surrounding the keyword with double quotes is not sufficient shell escaping.

In common POSIX shells, command substitution using $() or backticks remains active inside double-quoted strings. Depending on how substitution is implemented, quote characters and shell metacharacters in the input may also terminate the intended argument and append additional commands.

For example, a malicious keyword conceptually containing $(attacker_command) can cause the shell to execute attacker_command while preparing the argument passed to gnomic. This occurs before or alongside execution of the legitimate news-search operation.

The vulnerability is conditional on the Agent using a shell command string and directly substituting the keyword, but that is the execution pattern encouraged by the Skill's fenced shell examples.

Attack Path

1. An attacker asks the Agent to search for news using a keyword containing shell command-substitution syntax or quote-breaking metacharacters.
2. The Agent follows SKILL.md and replaces the documented keyword placeholder with the attacker-controlled value.
3. The Agent submits the resulting command string to a shell.
4. The shell interprets the injected syntax rath ...[truncated 903 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by interpolating the keyword into a command string.

• Invoke the executable through an argument-array API that bypasses shell parsing, for example:

  javascript

  execFile("gnomic", ["news", "search", keyword], callback);
  

• If the Agent platform exposes a structured process-execution tool, pass gnomic, news, search, and the keyword as separate arguments.

• Explicitly state in the Skill that the keyword must never be evaluated through sh -c, bash -c, or an equivalent shell.

• Apply reasonable length limits and reject NUL bytes and control characters as defense in depth.

• Do not rely solely on allowlisting ordinary language characters, because legitimate news keywords may contain broad Unicode content.

• If shell execution is unavoidable, use a well-tested, platform-specific argument-escaping library rather than manual quoting.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:149

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 149–157
Vulnerability Type: Mutable and globally installed third-party dependency
Risk Level: Medium

The fallback installation instructions contain the following vulnerable dependency-installation segment:

bash

npm install -g gnomic-cli

text

https://github.com/huyi9531/gnomic_cli

Technical Analysis

The installation command does not specify an exact package version or integrity value. Consequently, the effective code installed when the Skill is used can differ from the code available when the Skill was audited.

npm installation can execute package lifecycle scripts, including scripts from the selected package and parts of its dependency tree. A compromised package release, maintainer account, transitive dependency, or registry response could therefore introduce executable code without any modification to this Skill.

The -g option installs the package globally. This broadens the change beyond the project, may place an executable on the user's command search path, and can affect other sessions or projects. On systems where global npm installation is run with elevated privileges, the impact is correspondingly greater.

The GitHub repository URL provides useful provenance information but does not cryptographically establish that the mutable npm package fetched by this command corresponds to a reviewed repository revision.

Attack Path

1. The Agent attempts to run gnomic and finds that the command is unavailable.
2. Following the fallback instructions, the Agent executes npm install -g gnomic-cli.
3. npm resolves the current package version and its transitive dependencies from the configured registry.
4. An attacker who has compromised the package, a maintainer account, a dependency, or the relevant package-delivery channel supplies malicious code.
5. npm installs the mutable content and may execute malicious lifecycle scr ...[truncated 862 chars]

Remediation

View remediation

Remediation Suggestions

• Pin gnomic-cli to a reviewed exact version rather than installing the current latest release:

  bash

  npm install --save-exact gnomic-cli@REVIEWED_VERSION
  

• Prefer a project-local dependency over global installation.

• Commit a lockfile and use npm ci so dependency resolution is reproducible.

• Verify registry provenance, package ownership, release signatures where available, and integrity hashes before installation.

• Review the package's lifecycle scripts and transitive dependency tree.

• Use --ignore-scripts when package functionality does not require lifecycle scripts.

• Run installation and the CLI in a least-privileged sandbox with restricted filesystem and network access.

• Do not instruct users or Agents to run the installation through sudo.

• Bind the documented source repository to a specific reviewed commit and document how that commit maps to the pinned npm artifact.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description includes broad, everyday phrases such as '最近发生了什么大事' and 'XX最新动态', which can match requests that are not clearly asking for news retrieval. This can cause the agent to invoke the skill in ambiguous contexts, leading to incorrect tool use, unnecessary external data access, and user confusion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.