Insight Radar (洞察雷达)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:22 AM UTC
• Version: 1.0.6

Overview

This news-briefing skill is mostly coherent, but it automatically turns web content into persistent agent knowledge and depends on unpinned external skills, so users should review its data-retention and trust-boundary behavior before installing.

Install only if you are comfortable with daily web-derived news analysis being stored under memory/news-log and occasionally promoted into knowledge-base files. Review or disable scheduled triggers, inspect what USER.md contains before personalization, pin or audit the two dependencies where possible, and be cautious about any Feishu/Bitable export because it may send personalized briefing content to a third-party service.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:8

Finding

Untrusted Web Content Can Influence Persistent Agent Knowledge

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-28, 134-136, 156, 185-270
Vulnerability Type: Persistent memory poisoning through untrusted external content
Risk Level: Medium

Vulnerable Code

yaml

permissions:
  filesystem:
    read:
      - USER.md  # User context for [E] Execution personalization
      - memory/news-sources.json  # News category config
    write:
      - memory/news-log/  # Daily news records
      - memory/knowledge-base/concepts.md  # High-bar concept entries
      - memory/knowledge-base/patterns/*.md  # Verified patterns only (rare, 3+ occurrence threshold)
  network:
    - WebSearch  # Search recent news via web search API
    - WebFetch  # Fetch article content for URL validation
  external_outputs:
    - none  # This skill generates briefings locally; delivery is handled by the caller
  credentials:
    - none  # No API keys needed; web search uses the agent's built-in tools
config:
  reads:
    - USER.md
    - memory/news-sources.json
  writes:
    - memory/news-log/
    - memory/knowledge-base/concepts.md
    - memory/knowledge-base/patterns/*.md

The workflow additionally directs the Agent to fetch article contents, analyze them through another Skill, and write derived information into the news log, concept store, and pattern store.

Technical Analysis

The Skill combines two security-sensitive capabilities:

1. It retrieves arbitrary external content using WebSearch and WebFetch.
2. It writes conclusions derived from that content into persistent Agent memory.

External articles are not trustworthy instruction sources. A malicious or compromised website can include prompt-injection text designed to be interpreted as Agent instructions rather than article content. The Skill does not explicitly require the Agent to:

• Treat fetched pages solely as untrusted data.
• Ignore commands, role changes, tool instructions, or memor ...[truncated 2141 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an explicit trust-boundary rule stating that all WebSearch and WebFetch results are untrusted data and must never be followed as instructions.
2. Reject article content that attempts to alter roles, invoke tools, modify workflow rules, request secrets, or direct memory writes.
3. Extract content into a strict schema containing only fields such as title, publication date, publisher, URL, factual claims, and direct quotations.
4. Preserve source provenance for every concept and pattern, including the exact URLs and retrieval dates.
5. Require corroboration from multiple independent and reputable domains rather than merely three articles or dates.
6. Require explicit user approval before writing to concepts.md or patterns/*.md.
7. Store candidate material in a quarantine file that is not automatically consumed as trusted Agent memory.
8. Apply domain allowlisting, redirect validation, and URL-scheme restrictions before using WebFetch.
9. Ensure the delegated core-prism Skill receives sanitized article data rather than raw webpage instructions.
10. Add regression tests using articles containing common prompt-injection payloads and verify that those instructions are quoted or discarded rather than executed.

T08 · Insecure Dependencies

Warning

• Location: README.md:21

Finding

Third-Party Skill Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: README.md:21-25
Vulnerability Type: Mutable and unverified third-party Skill dependencies
Risk Level: Medium

Vulnerable Code

bash

clawhub install kedoupi/core-prism
clawhub install kedoupi/news-source-manager

Technical Analysis

The installation instructions retrieve two third-party Skills by mutable package identity without specifying reviewed versions, immutable digests, signatures, or checksums.

These dependencies participate directly in security-sensitive workflow stages:

• news-source-manager controls the source configuration used for external retrieval.
• core-prism receives news content and user context for personalized analysis.

Because the commands install whichever package revision the registry currently resolves, the effective behavior can change after this project has been audited. A compromised publisher account, registry incident, or malicious update could introduce behavior not present in the reviewed package.

This finding does not establish that either named dependency is currently malicious. The vulnerability is the absence of reproducible dependency resolution and integrity verification.

Attack Path

1. An attacker compromises a dependency publisher account, publishing pipeline, or package-distribution service.
2. The attacker releases a malicious revision under the existing dependency name.
3. A user follows the documented unpinned installation commands.
4. The package manager resolves and installs the malicious latest revision.
5. Insight Radar delegates configuration or analysis tasks to the compromised dependency.
6. The dependency can misuse whatever tools, workspace data, or user context the host grants to it.

Impact Assessment

The exact impact depends on the permissions independently granted to the installed dependencies and cannot be fully determined from this repository alone.

Within the document ...[truncated 566 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to a reviewed, immutable version.
2. Prefer content-addressed package digests or lockfile entries where supported.
3. Verify registry signatures, publisher identity, and package checksums before installation.
4. Document the minimum permissions expected by each dependency.
5. Audit dependency updates before changing pinned versions.
6. Prevent dependencies from inheriting the parent Skill's filesystem or network permissions automatically.
7. Pass only the minimum required user context to core-prism, preferably a redacted and purpose-specific profile.
8. Maintain a dependency inventory recording package identity, version, digest, audit date, and approved permissions.
9. Fail closed if an installed dependency does not match the approved version or integrity digest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README mentions optional output to Feishu Bitable and references external database configuration, but it does not clearly warn that generated briefing content may be transmitted to a third-party service. Because the system produces personalized strategic intelligence influenced by USER.md, sending this content externally could expose sensitive preferences, analysis, or internal context to an outside platform.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill metadata declares external_outputs: none, but the body later instructs the agent to deliver the briefing to the user through a trigger channel. This kind of capability mismatch can bypass operator expectations, interfere with policy enforcement, and cause data gathered from USER.md, web sources, and local memory to be transmitted through an undeclared output path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions require personalization using Chinese second-person language, including an explicit mandate to '始终使用第二人称' and the document overall specifies Chinese output structure and examples. This imposes a language/locale style choice on users without offering an opt-in or alternative language selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This guide presents all instructions and example user/assistant exchanges exclusively in Chinese, and it does not provide any user opt-in, alternative language option, or explicit justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title and core instructions are written in Chinese, indicating the skill content is localized to a specific language by default. There is no accompanying note that users may choose another language or that the file is intended only for a Chinese-language or region-specific deployment.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/category-recommendations.md (reported line 67)May include surrounding context.

md

业者、品牌方、投资人

### Real Estate (房地产)
- **Keywords**: real estate, property, housing market, construction
- **Sources**:
  - The Real Deal
  - Housing Wire
  - Commercial Observer
- **适合人群**: 房地产投资人、开发商

---

## 🏥 健康 & 生活

### Health/Bio (默认)
- **Keywords**: biotech, pharma, health tech, medical
- **Sources**: STAT News, The Lancet, Fierce Biotech, MedTech Dive
- **适合人群**: 医疗从业者、投资人、患者

### Fitness/Wellness (健身健康)
- **Keywords**: fitness, wellness, mental health, nutrition
- **Sources**:
  - Well+Good
  - Men's Health / Women's Health
  - Healthline
- **适合人群**: 健身爱好者、教练、健康产品从业者

### Food/Beverage (餐饮)
- **Keywords**: food industry, restaurants, beverage, culinary
- **Sources**:
  - Food Dive
  - Restaurant Business
  - Eater (餐饮文化)
- **适合人群**: 餐饮从业者、美食爱好者

---

## 🎨 创意 & 设计

### Design/UX (�

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains a sample output whose headings and scope are explicitly in Chinese, including bilingual search but Chinese-formatted presentation. Under the policy rule, forcing a specific language or locale without offering user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly states that the skill records news events to news-log/ and may write extracted concepts and thinking patterns into a persistent knowledge base, but it does not clearly warn users that these writes are automatic and durable. This can lead to unintended retention of user-contextualized or sensitive derived content, especially because the briefing is personalized via USER.md and stored over time.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.