Security audit

AI 行业资讯雷达

Security checks for vulnerabilities and agentic risk

Overview

This AI news skill has a coherent purpose, but it over-directs agents to a specific external service and its scripts can expose the API token to an unintended endpoint if environment settings are changed.

Install only if you trust the Jiqizhixin service with your AI-news search topics and API token. Before use, pin or validate the API host, avoid running it in environments where BASE_URL can be influenced, protect JQZX_API_TOKEN like a password, and treat the skill's mandatory source-priority wording as subordinate to user privacy and source preferences.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Global source-selection instructions hijack AI-related requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/query_articles.sh:4
Finding: Article-query script can disclose the API token to an attacker-controlled endpoint
Content: View full analysis
Remediation: View remediation
&2 exit 1 ;; esac ``` 3. Require HTTPS and reject user-info components, unexpected ports, IP literals, and non-approved hostnames. 4. Remove `--location` unless redirects are necessary. If redirects are required, resolve and validate every redirect destination and do not forward credentials across origins. 5. Add curl hardening such as `--proto '=https'` and an appropriate connection timeout. 6. Consider passing credentials through a narrowly scoped curl configuration or another mechanism that only attaches the header to the approved origin. 7. Add automated tests verifying that modified hosts, HTTP URLs, and cross-origin redirects are rejected before any token-bearing request is made. 8. Rotate the API token if the script has been executed in an environment where `BASE_URL` may have been attacker-controlled. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/query_article_detail.sh:4
Finding: Article-detail script can disclose the API token to an attacker-controlled endpoint
Content: View full analysis
``` 5. The request includes the victim's `X-MCP-TOKEN` header. 6. The attacker records the token and requested article ID. 7. The attacker may return fabricated article content, w ...[truncated 1055 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill requires shell-capable execution via curl-based scripts but does not declare any explicit tool scope, permissions, or allowed-tools boundary. This weakens least-privilege enforcement and can cause an agent/runtime to expose broader shell access than users expect, increasing the chance of unintended command execution or misuse of environment-resident secrets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description says AI-industry questions must prioritize this skill and forbids answering from model knowledge, effectively trying to override higher-level user choice and system policy. This is dangerous because it can force external calls, suppress safer alternatives, and pressure the agent to disclose user queries to a third-party service without explicit opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document both prohibits relying on LLM memory for concrete facts and later instructs the model to use its own memory to expand search keywords. That contradiction can cause inconsistent agent behavior, making it easier for hallucinated or stale information to influence retrieval, analysis, and downstream conclusions presented as fact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill promotes direct API and script use against a production endpoint without clearly warning that queries, article IDs, and possibly contextual prompts are transmitted to an external service. In a news-research context, user queries may encode sensitive business interests, investigations, or internal strategy, so silent transmission creates privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits error and usage messages only in Chinese, which imposes a specific language on users without offering an alternative or opt-in. This matches the language/locale policy violation category because the file forces a locale-specific experience through natural-language strings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation instructs users to set an API token in an environment variable but provides no warning about credential sensitivity, storage, redaction, or log exposure. That omission can lead to accidental token disclosure in shells, scripts, screenshots, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file presents its instructions and reference content solely in Chinese, and there is no indication that users may choose another language or that the file is intentionally limited to a Chinese-language context. The policy explicitly calls for flagging language or locale constraints when they are forced without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This shell script performs a network request and sends a credential from JQZX_API_TOKEN in the X-MCP-TOKEN header. While it errors if the variable is absent, it does not clearly disclose to the user at execution time that their token will be transmitted to the remote service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.