sre-news-digest

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:50 PM UTC
• Version: 1.0.3

Overview

This skill transparently fetches SRE news, reads article pages, and writes a markdown digest, with no hidden persistence, credential use, or destructive behavior found.

Before installing, know that the skill will access an external RSS mirror at news.imzye.com, then open article links from many sites to summarize them. Use a user-selected output path if you want to avoid overwriting an existing sre_news_digest.md file, and request another language explicitly if English is not desired.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description says it generates a curated digest from sre.news, but the actual workflow directs use of a different domain, news.imzye.com, and only describes scraping plus manual browsing rather than a self-contained, transparent digest pipeline. This mismatch is dangerous because users and policy systems may trust the declared purpose while the agent is actually sent to an alternate source and broader browsing behavior, which can hide supply-chain risk or bypass user expectations about what data is being accessed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. Line L45 explicitly requires output in English, and the README does not offer an alternative language choice or explain that the skill is region- or compliance-bound.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to fetch remote content and browse external sites, but it does not declare any explicit tool scope or network permissions. This creates an authorization and review gap: an agent may make outbound requests to unvetted domains without clear least-privilege controls, increasing exposure to malicious content, tracking, or unintended data flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

For markdown files, missing-warning findings apply when the skill description omits warnings about behaviors that could affect user data or system integrity. Line L60 directs the agent to save output to sre_news_digest.md or another path, but provides no caution about creating or overwriting an existing file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction explicitly says to generate the digest in English, which imposes a language choice in natural-language guidance. Under the policy, forced language selection is a violation unless the skill offers a user choice or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.