AI Daily News

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:10 AM UTC
• Version: 1.0.0

Overview

The skill broadly matches its AI news reporting purpose, but it contains unsafe automation and dependency behavior that should be reviewed before installation.

Install only in an isolated, low-privilege environment after reviewing the code. Preinstall pinned dependencies through your normal deployment process, avoid the automatic yt-dlp install path, restrict RSS feeds to trusted HTTPS domains, protect config.json and the Feishu webhook as secrets, and do not run the scheduler under a privileged account until the shell-based browser helper is removed or tightly constrained.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/browser_fallback.py:27

Finding

Shell Command Injection in the Agent Browser Helper

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/youtube_collector.py:62

Finding

Automatic Retrieval, Installation, and Import of an Unpinned Package

Content

View full analysis

=2023.12.30`, which likewise permits future versions, but the runtime installation is more severe because it happens implicitly during ordinary use. ### Attack Path 1. The environment does not have the `yt_dlp` module installed, or the import is otherwise made to fail. 2. The collector automatically runs `pip install -q yt-dlp`. 3. Pip resolves the package using the environment's configured package indexes and trust settings. 4. A compromised package release, package account, index, mirror, or maliciously altered pip configuration supplies attacker-controlled code. 5. The newly installed module is immediately imported and later instantiated. 6. Attacker-controlled Python code executes with the privileges of the Skill process. ### Impact Assessment A compromised dependency can execute arbitrary Python code, read the Feishu webhook stored in `config.json`, access files av ...[truncated 225 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/rss_collector.py:43

Finding

Server-Side Request Forgery Through Unrestricted RSS URLs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup_config.py:82

Finding

Feishu Webhook Secret Stored in a Plaintext File Without Enforced Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collect_ai_news.py:75

Finding

arXiv Feed Retrieved Over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose describes a production news aggregation and reporting system with external content fetching and report delivery. The actual code chunk only handles local packaging/distribution of a skill, including validation of SKILL.md and creation of a zip-based .skill file. These capabilities are materially different from the declared functionality, and the described news collection/reporting behavior is absent from the supplied code.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

pip install -r references/requirements.txt

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Using shell=True with a dynamically assembled command is a classic tool-parameter abuse pattern because the shell interprets special characters, separators, and substitutions. In this skill context, the risk is heightened because URLs and extractor inputs may come from external feeds or configuration, making accidental or malicious injection more plausible in an automation pipeline.

Content

Scanner excerpt · scripts/browser_fallback.py (reported line 40)May include surrounding context.

python

"""
    try:
        full_cmd = f"agent-browser {command}"
        result = subprocess.run(
            full_cmd,
            shell=True,
            capture_output=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents editing config.json with a Feishu webhook_url and chat_id, which are sensitive integration details. The installation guide does not warn users to keep these values private, avoid committing them to source control, or treat them as secrets.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and documents use of shell commands, local file access, configuration writes, and outbound network access, but it does not declare any explicit tool scope or permissions boundary in the manifest. This creates an authorization transparency gap: operators cannot easily assess or restrict what the skill may do, increasing the chance of over-privileged execution or unsafe deployment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs users to generate and push reports to Feishu, but it does not warn that collected content and possibly metadata will be transmitted to an external third-party service. In enterprise or privacy-sensitive environments, this can lead to unintentional data disclosure, policy violations, or sharing of scraped/internal-enriched content outside approved channels.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/DEVELOPMENT.md (reported line 159)May include surrounding context.

bash

# Edit crontab
crontab -e

# Add lines:
0 6 * * * cd /path/to/ai-daily-news && python scripts/collect_ai_news.py

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring is written entirely in Chinese and does not indicate any language choice or opt-in. Under the policy for natural-language content, forcing a specific language without user selection is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This helper exposes a broad command-execution surface through run_agent_browser_command(command, ...), even though the skill's purpose is only to collect news from known sources. A news collection skill does not need arbitrary shell-mediated browser command strings, so this creates unnecessary capability that can be abused for actions beyond scraping.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code performs dynamically constructed shell execution of browser commands without any confirmation, policy gate, or user-visible warning. In an automated skill, this increases the chance that dangerous or out-of-scope actions occur silently, especially when combined with caller-controlled command content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The code builds a shell command string from a caller-controlled command value and executes it with subprocess.run(..., shell=True). If any part of command is influenced by untrusted input, shell metacharacters can escape the intended agent-browser invocation and execute arbitrary OS commands on the host.

Content

Scanner excerpt · scripts/browser_fallback.py (reported line 40)May include surrounding context.

python

"""
    try:
        full_cmd = f"agent-browser {command}"
        result = subprocess.run(
            full_cmd,
            shell=True,
            capture_output=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The fallback scraper accepts js_extractor and passes it into agent-browser eval, enabling arbitrary JavaScript execution in the browser context. While this may not directly execute OS commands by itself, it expands the skill from passive data collection into active page-script execution, which can manipulate page state, exfiltrate accessible page data, or interact with sites in unintended ways.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language descriptions and runtime log/messages exclusively in Chinese, which effectively forces a specific language for users and operators. Under the policy, locale or language constraints should either be optional for the user or clearly documented as justified and intentional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains the primary description and operational messages entirely in Chinese, including the module docstring and runtime logs/help text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/push_to_feishu.py (reported line 201)May include surrounding context.

python

'Content-Type': 'application/json'
        }
        
        response = requests.post(webhook_url, json=message, headers=headers, timeout=30)
        response_data = response.json()
        
        if response_data.get('code') == 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This collector expands its environment by installing software at runtime, which exceeds passive news collection and creates a supply-chain risk surface. A compromised package, typo-squatted dependency, or unexpected dependency resolution could lead to code execution in the host environment when the skill runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs package installation automatically with no user-facing confirmation or administrative approval. In an agent-skill context, that behavior is more dangerous because the skill may run unattended on shared infrastructure, silently changing the system state and pulling code from the network without operator awareness.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The code invokes pip at runtime to install yt-dlp automatically if the module is missing. Dynamically modifying the execution environment during normal operation is dangerous because it introduces unpinned third-party code from an external package index, can execute arbitrary install-time package code, and bypasses normal dependency review and deployment controls.

Content

Scanner excerpt · scripts/youtube_collector.py (reported line 69)May include surrounding context.

python

import yt_dlp
        except ImportError:
            logger.warning("yt-dlp 未安装，尝试使用pip安装...")
            subprocess.check_call(['pip', 'install', '-q', 'yt-dlp'])
            import yt_dlp
        
        channel_url = f"https://www.youtube.com/{creator_config.get('handle', '')}/videos"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This manifest/config file contains multiple Chinese-language comment strings and sets the default timezone to Asia/Shanghai, which can amount to an implicit locale preference rather than a neutral or user-selectable default. Because the file does not indicate that the skill is region-specific or provide an opt-in choice for language/locale, it may conflict with organizational language/locale policy guidance.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time and across environments. That weakens supply-chain control and makes it difficult to verify whether a known-vulnerable or incompatible release is being installed, especially in an automated news collection system that regularly fetches untrusted remote content.

Content

Scanner excerpt · references/requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.10
schedule>=1.2.0
pyyaml>=6.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

requests has known advisories, and because the requirement is not pinned, there is no reliable way to determine whether deployments will use a fixed or vulnerable version. In a network-heavy automation skill that fetches external resources, uncertainty around HTTP client security is more significant because it directly handles remote inputs and credentials/session data.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using feedparser>=6.0.10 allows uncontrolled version drift and prevents reproducible installs. Because this skill ingests external RSS/Atom feeds, unresolved dependency versions increase the chance of pulling a release with parser-related security regressions or known advisories.

Content

Scanner excerpt · references/requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.10
schedule>=1.2.0
pyyaml>=6.0.1
python-dateutil>=2.8.2

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

feedparser has multiple historical advisories, and the manifest does not pin a specific version, so the installed release cannot be verified as safe. Because the skill continuously ingests third-party feeds, parser vulnerabilities are more relevant than they would be in an offline-only application.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

An unpinned schedule dependency is a supply-chain hygiene issue because installation may pull different releases at different times. While the package itself is not inherently dangerous from this file alone, non-deterministic dependency resolution still reduces assurance and can introduce unexpected vulnerable versions.

Content

Scanner excerpt · references/requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.10
schedule>=1.2.0
pyyaml>=6.0.1
python-dateutil>=2.8.2
beautifulsoup4>=4.12.2

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

PyYAML has a history of unsafe-deserialization issues, and leaving it unpinned means the environment may resolve to a vulnerable or unreviewed release. In a configurable automation skill, YAML is often used for configuration, so dependency ambiguity is more dangerous than in a purely local, static tool.

Content

Scanner excerpt · references/requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
feedparser>=6.0.10
schedule>=1.2.0
pyyaml>=6.0.1
python-dateutil>=2.8.2
beautifulsoup4>=4.12.2
lxml>=4.9.3

Static analysis

No suspicious patterns detected.