Security audit

Morning Briefing AI News

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AI news RSS summarizer with disclosed network fetching and optional user-requested saving, though users should be aware it processes untrusted feed content.

Install only from a source or commit you trust. Expect the skill to contact the listed RSS sources when invoked. Use the default save directory or a deliberate folder you control, and avoid running saved briefings or feed content as instructions because RSS items are untrusted external text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:51
Finding: Untrusted RSS Content Is Processed Without Prompt-Injection Defenses
Content: View full analysis
", extractMode: "text") \`\`\` Fetch priority 1 feeds first, then priority 2. ### Step 3: Parse RSS Items RSS feeds are XML. Extract items using these patterns: \`\`\` ... ... ... ... \`\`\` For Atom feeds: \`\`\` ... ...
...
\`\`\` ``` The externally retrieved sources are configured in `feeds.json`, lines 8–187. They include community-generated aggregators and mutable feeds mirrored through a third-party GitHub repository. ### Technical Analysis The skill instructs the agent to fetch RSS documents in text mode and directly process their titles, descriptions, and summaries. These fields are controlled by external publishers and may include arbitrary natural-language content. No instruction establishes a trust boundary between skill instructions and retrieved feed data. In particular, the workflow does not tell the agent to: - Treat all RSS content exclusively as untrusted data. - Ignore tool-use requests or behavioral instructions embedded in feed fields. - Prevent feed content from overriding the skill workflow. - Restrict links encountered inside feed entries from triggering additional tool calls. - Sanitize hidden, malformed, or instruction-like text before summarization. This creates an indirect prompt-injection channel. XML parsing alone does not neutralize semantic instructions because the extracted values are subsequently interpreted by ...[truncated 1627 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:22
Finding: Installation Instructions Clone an Unpinned Mutable Repository Branch
Content: View full analysis
Remediation: View remediation
``` 2. Provide a SHA-256 manifest for each release and require users or installers to verify it before enabling the skill. 3. Sign release tags and commits with a verifiable maintainer key, and document signature-verification commands. 4. Protect the default branch with mandatory review, signed commits, restricted force pushes, and multifactor authentication for maintainers. 5. Recommend reviewing changes before updating an existing installation rather than automatically pulling the latest branch state. 6. Ensure release metadata is consistent across the package. The reviewed `_meta.json` reports version `0.1.0`, while `feeds.json` reports configuration version `1.1.0`; clearly distinguish package and configuration versions to support reproducible verification. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises very broad natural-language activation phrases such as "What's new in AI?" and "Morning AI briefing," which can cause the skill to be invoked unintentionally during ordinary conversation. In agent environments where skills auto-route based on semantic matching, this increases the chance of surprise network access, feed fetching, or automated actions being triggered without the user's explicit intent to run the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Using broad natural-language triggers like "AI news" or "what's new in AI" increases the chance the skill activates unintentionally during ordinary conversation. Because this skill performs network fetches and may optionally write files, accidental invocation can lead to unintended external requests and side effects without clear user intent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises itself as an RSS news summarizer, but its instructions add a file-writing capability that can persist content to disk, including at user-directed locations. This expands the skill's effective privilege surface beyond its stated purpose, increasing the chance of unintended file creation or overwriting when invoked in contexts where the user did not expect filesystem side effects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Allowing output to be written to an exact user-specified filesystem path creates a path-injection/unsafe write primitive. Even if the content is only a news briefing, an attacker could abuse ambiguous prompting or social engineering to cause writes into sensitive locations, overwrite existing files, or place attacker-influenced content where other tools or users will consume it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill fetches content from multiple third-party RSS sources but does not clearly warn users that invoking it causes external network access. This can create privacy and policy issues in environments where outbound requests must be explicit, especially if prompts unintentionally trigger the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The knownGaps list annotates organizations with country labels such as China, France, and USA, which introduces locale/nationality-specific framing in natural language. This file does not explain why those locale labels are needed or offer any user-facing choice around regional categorization, so it may conflict with the policy against undocumented language/locale constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.