cctv1-news on 20:00

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:46 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward CCTV news scraper that writes a local daily text file, with disclosed but optional scheduling and some hardening gaps.

Reasonable to install if you want a Chinese-language personal CCTV News fetcher. Use a virtual environment, consider pinning dependencies, review the output directory, and only add the cron or scheduled task if you want it to keep running every day until you remove it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24 and references/使用说明.md:14
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:24:

bash

pip install requests pytz lxml

references/使用说明.md:14:

bash

pip install requests pytz lxml

Technical Analysis

The installation instructions retrieve the latest available versions of requests, pytz, and lxml without version constraints or package integrity hashes. Consequently, the installed code can change after the Skill has been reviewed.

The packages are legitimate and there is no evidence that the project intentionally specifies a malicious dependency. Nevertheless, an upstream package or package-distribution account compromise could cause users following these instructions to install an unsafe release. Dependency hashes are especially important because package installation can execute build-related code, while imported packages execute with the privileges of the Python process at runtime.

Attack Path

1. An attacker compromises an upstream dependency release or its package-distribution account.
2. The attacker publishes a malicious version under one of the dependency names.
3. A user follows the documented unpinned pip install command.
4. Package resolution selects the compromised version.
5. Malicious code executes during installation, import, or subsequent script execution under the user's account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running pip or the script. This may permit access to that user's files, environment variables, network credentials, and network resources. If the installation command is run with elevated privileges, the impact could extend to system-wide compromise, although this project does not instruct users to elevate privileges.

Remediation

View remediation

Remediation Suggestions

• Add a reviewed dependency file containing exact versions.

• Generate and verify cryptographic hashes for every package and transitive dependency.

• Install dependencies with hash enforcement, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Use an isolated virtual environment rather than the system Python environment.

• Periodically review pinned versions for security updates and update them through a controlled process.

• Keep both documentation files synchronized with the hardened installation procedure.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_cctv_news_simple.py:49

Finding

Unvalidated Outbound Requests to Page-Controlled URLs

Content

View full analysis

Vulnerability Details

File Location: scripts/get_cctv_news_simple.py:49-58
Vulnerability Type: Server-side request forgery through unvalidated scraped links
Risk Level: Medium

Vulnerable Code

python

# 循环获取每个视频的内容
for i in range(1, count + 1):
    try:
        xpath2 = '//*[@id="content"]/li[{}]/div/a/@href'.format(i) 
        urls = html.xpath(xpath2)
        
        for url2 in urls:
            if not url2:
                continue
                
            sub_html = parse_html(url2) 

The request sink used by this flow is:

python

def parse_html(url):
    """解析HTML页面"""
    try:
        response = requests.get(url, timeout=30)
        response.encoding = 'utf-8'
        html = etree.HTML(response.text)
        return html
    except Exception as e:
        print(f"解析HTML失败: {e}")
        return None

Technical Analysis

Links are extracted from the remotely fetched CCTV page and passed directly to requests.get. The code does not enforce HTTPS, restrict destination hostnames, reject embedded credentials or unusual ports, check resolved IP addresses, or validate redirect destinations.

Therefore, control over the upstream page or its relevant content could allow an attacker to make the Skill contact an attacker-selected HTTP endpoint. A crafted destination could target loopback, private, link-local, or otherwise internal addresses reachable from the execution environment. Redirects can also bypass a check that only validates the initial URL unless every redirect destination is independently checked.

The fetched response is parsed locally and is not deliberately returned to an attacker. As a result, internal response disclosure is limited in the current implementation. The behavior can nevertheless produce blind requests, interact with internal services, and reveal request occurrence through attacker-controlled server logs.

Attack Path

1 ...[truncated 1390 chars]

Remediation

View remediation

Remediation Suggestions

• Parse every extracted URL before making a request.
• Permit only the https scheme and an explicit allowlist of required CCTV hostnames.
• Reject URLs containing user-information components or unexpected ports.
• Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and unspecified addresses for both IPv4 and IPv6.
• Disable automatic redirects or validate every redirect target using the same policy.
• Re-resolve and validate destinations at connection time where possible to reduce DNS-rebinding risk.
• Apply response-size limits in addition to the existing timeout.
• Use a dedicated request function for validated CCTV URLs rather than accepting arbitrary URL strings.

Example policy outline:

python

from urllib.parse import urlparse

ALLOWED_HOSTS = {"tv.cctv.com"}

def validate_cctv_url(url):
    parsed = urlparse(url)
    if parsed.scheme != "https":
        raise ValueError("Only HTTPS URLs are allowed")
    if parsed.hostname not in ALLOWED_HOSTS:
        raise ValueError("Destination host is not allowed")
    if parsed.username or parsed.password:
        raise ValueError("URL credentials are not allowed")
    if parsed.port not in (None, 443):
        raise ValueError("Unexpected destination port")

This hostname policy should be supplemented with IP-address validation and redirect validation before being relied upon as a complete defense.

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 80% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/get_cctv_news_simple.py (reported line 28)May include surrounding context.

python

try:
        response = requests.get(url, timeout=30)
        response.encoding = 'utf-8'
        html = etree.HTML(response.text)
        return html
    except Exception as e:
        print(f"解析HTML失败: {e}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents behaviors that require network access and local file writes, but it does not declare any explicit tool scope or permissions. This can cause the skill to run with broader-than-expected capabilities, reducing transparency and increasing the chance of unintended file modification or outbound requests in agent environments that rely on manifest-level restrictions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents all user-facing instructions in a single language and does not indicate that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

编辑crontab：

bash

crontab -e

添加以下行（22:00北京时间 = 14:00 UTC）：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/使用说明.md (reported line 50)May include surrounding context.

编辑crontab：

bash

crontab -e

添加以下行（22:00北京时间 = 14:00 UTC）：

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill says it saves fetched content to a local file but does not clearly warn that running it will create or potentially overwrite files on disk. This is a safety and transparency issue because users may trigger persistent local changes without understanding where data is stored or whether existing files could be replaced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file documents behavior that writes output to local files, which can affect user data and disk contents. Although file generation is mentioned descriptively, there is no clear user warning or caution section highlighting that execution will create persistent files and scheduled runs may continue doing so automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language descriptions and console messages exclusively in Chinese, which can force a specific language experience on users without opt-in. The policy calls for flagging language or locale constraints when the skill does not offer a choice or clearly justify the restriction.

Content

No source excerpt is available for this finding.