Security audit

AI News Pusher

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AI news aggregation and Feishu push skill with disclosed network services and local storage, though users should handle webhook and API credentials carefully.

Install only if you are comfortable with the skill fetching news from external services, optionally sending article content to an LLM provider for scoring, storing local JSON history, and posting selected content to a Feishu webhook. Use a dedicated Feishu webhook, keep API keys and gateway tokens out of shared environments, prefer dry-run before sending, and consider pinning dependencies before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/push_to_feishu.py:121
Finding: Unrestricted Webhook Destination Enables Server-Side Request Forgery and Unintended Data Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/news_sources.py:141
Finding: Default RSS Sources Use Plaintext HTTP and Permit News Content Tampering
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/news_scorer.py:150
Finding: Untrusted News Content Is Directly Embedded in LLM Scoring Instructions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Unbounded Third-Party Dependency Versions Create Supply-Chain Exposure
Content: View full analysis
=6.0.0 requests>=2.25.0 tavily-python>=0.3.0 openai>=1.0.0 anthropic>=0.20.0 ``` The installation guidance also recommends direct package installation without hashes or a lock file: ```bash pip install tavily-python feedparser requests openai anthropic ``` ### Technical Analysis Every dependency uses a lower-bound-only constraint. A future package release satisfying the `>=` expression can therefore be installed without having been reviewed with this Skill. Python packages may execute code during installation and are imported into the Skill process at runtime. Compromise of a package maintainer account, package index, release pipeline, or dependency tree could consequently introduce arbitrary code into the environment. No hash-pinned lock file or constraints file is supplied to verify the exact artifacts expected by the project. ### Attack Path 1. A direct or transitive dependency publishes a compromised future version, or its package-distribution account is taken over. 2. A user installs the Skill dependencies using `requirements.txt` or the documented `pip install` command. 3. The package resolver selects the newer version because it satisfies the lower-bound constraint. 4. Malicious installation or import-time code executes with the permissions of the user running the installation or Skill. 5. That code can access the process environment, local files available to the user, and network resources available to the Skill runtime. ### Impact Assessment A successful supply-chain compromise could execute arbitrary Python code with the privileges of the installing or executing user. This could expose API keys and webhook secrets stored in environment variables, alter local data, or make unauthorized network requests. The audit found no e ...[truncated 217 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (30)

Tainted flow: 'webhook_url' from os.environ.get (line 230, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/push_to_feishu.py (reported line 138)May include surrounding context.
python
try: print(f"正在发送消息到Feishu...") response = requests.post( webhook_url, json=payload, headers={"Content-Type": "application/json"},

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill declares itself as a news-fetch/push utility, yet the manifest prominently includes OpenClaw gateway configuration and cron-style task management, indicating external scheduling/control capabilities beyond the stated core purpose. Hidden or underemphasized control-plane behavior raises the risk of persistent automated actions, misuse of sensitive gateway tokens, and user misunderstanding about the real trust boundary.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill declares itself as a news-fetch/push utility, yet the manifest prominently includes OpenClaw gateway configuration and cron-style task management, indicating external scheduling/control capabilities beyond the stated core purpose. Hidden or underemphasized control-plane behavior raises the risk of persistent automated actions, misuse of sensitive gateway tokens, and user misunderstanding about the real trust boundary.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises and documents capabilities that require environment access, file I/O, network access, and shell execution, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an over-privilege risk because an agent/runtime may grant broader capabilities than users expect, increasing the chance of unintended outbound requests, local data exposure, or command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger text is broad enough to activate on many general requests about AI news, automation, aggregation, or filtering, which can cause the skill to run in situations where the user did not intend to invoke networked fetching, local storage, or outbound message delivery. Over-broad triggering increases the likelihood of unnecessary exposure of environment-backed secrets and accidental execution of side-effecting functionality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code file contains natural-language documentation and comments exclusively in Chinese, including the module docstring and initializer documentation. Under the policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring at L199 says the method retrieves filtered news for recent days, but L202 calls datetime.timedelta(...), which will raise because datetime here is the class imported from datetime, not the module. The same contradiction appears in analogous recent-item and cleanup logic, meaning the code cannot carry out the documented behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: The script sends user-supplied search queries and associated request metadata to Brave's external API. In this skill context, outbound transmission is expected for a news retrieval tool, but it still creates a privacy and data-governance risk if queries contain sensitive information or if operators assume the tool is fully local.
Content: Scanner excerpt · scripts/fetch_ai_news.py (reported line 134)May include surrounding context.
python
try: response = requests.get( "https://api.search.brave.com/res/v1/web/search", headers=headers, params=params, timeout=30

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest emphasizes news retrieval, aggregation, filtering, scoring, and push-related workflows. In addition to those expected behaviors, this file writes categorized results into persistent storage via DataStorage, which is a broader stateful data-management behavior not disclosed in the manifest description of this script itself.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and CLI description frame this as a news acquisition tool. The --output path handling adds a filesystem write capability that goes beyond simple fetching and formatting, and this side effect is not reflected in the top-level documentation or manifest summary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module description and all user-facing prompts are written exclusively in Chinese, which imposes a specific language on users. The file does not provide any opt-in, fallback, or explanation that this tool is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Natural-language strings throughout the file instruct the model and describe the tool exclusively in Chinese, including the system message and scoring prompt. There is no indication that the user can choose another language or that the Chinese-only behavior is a justified locale-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code sends full news content and related metadata, including title, content, source, publication date, and URL, to third-party LLM providers when an API key is present. In a news aggregation/push skill, this creates a real data-governance and privacy risk because externally sourced content, internal curation signals, and potentially sensitive URLs or unpublished material may be transmitted off-platform without any user-facing notice, consent, or minimization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Brave search request hard-codes search_lang to en, which imposes a specific language/locale behavior in the skill. The file does not provide a user opt-in, configurable alternative, or justification for restricting results to English.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/news_sources.py (reported line 105)May include surrounding context.
python
try: response = requests.get( "https://api.search.brave.com/res/v1/web/search", headers=headers, params=params, timeout=30

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains its title, help text, warnings, and runtime output entirely in Chinese, including the CLI description and operational prompts. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the tool is clearly documented as region-specific, which is not indicated here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest describes AI news retrieval, aggregation, filtering, and push delivery, but this file also launches another program using subprocess. Spawning a process is a broader execution capability than the stated purpose requires and is not explicitly justified in the manifest.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/push_to_feishu.py (reported line 35)May include surrounding context.
python
import subprocess try: script_dir = get_script_dir() result = subprocess.run( ['python3', str(script_dir / 'fetch_ai_news.py'), '--limit', str(limit), '--format', 'json'], capture_output=True, text=True,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/push_to_feishu.py (reported line 138)May include surrounding context.
python
try: print(f"正在发送消息到Feishu...") response = requests.post( webhook_url, json=payload, headers={"Content-Type": "application/json"},

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with only a lower bound, which allows future installs to pull newer unreviewed versions and makes builds non-reproducible. In a news aggregation skill that fetches and parses untrusted RSS content, this increases supply-chain risk and makes it harder to verify whether vulnerable versions of feedparser are in use.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
# AI News Pusher v3.0 - Dependencies # Core dependencies (required) feedparser>=6.0.0 requests>=2.25.0 # Optional dependencies for news sources

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: feedparser has known historical advisories, and because the manifest does not pin a version, it is impossible to verify from this file whether deployment uses a fixed, unaffected release. This matters more here because the skill consumes and parses untrusted RSS feeds, so parser vulnerabilities could be exercised by attacker-controlled feed content.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Using requests with only a minimum version means installations may resolve to different versions over time, including versions later found vulnerable or behaviorally incompatible. Because this skill retrieves remote content from external sources, an unpinned HTTP client raises supply-chain and security maintenance concerns.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
# Core dependencies (required) feedparser>=6.0.0 requests>=2.25.0 # Optional dependencies for news sources tavily-python>=0.3.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: requests has multiple advisories, and the absence of an exact version prevents confirming whether the deployed package includes fixes. Since this skill makes outbound network requests to third-party sources, using an unverifiable HTTP library version can expose it to known client-side flaws or credential-handling issues.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The optional tavily-python package is also unpinned, so environments that enable this source may install inconsistent or newly introduced vulnerable releases. Even though it is optional, it still expands the skill's attack surface when used for external news retrieval.
Content: Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.
text
requests>=2.25.0 # Optional dependencies for news sources tavily-python>=0.3.0 # Optional dependencies for LLM scoring openai>=1.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: An unpinned openai SDK version can change API behavior and introduce security-relevant defects or transitive dependency issues without notice. Since this skill may use the SDK for scoring or processing external content, predictable and reviewed dependency versions are important.
Content: Scanner excerpt · requirements.txt (reported line 11)May include surrounding context.
text
tavily-python>=0.3.0 # Optional dependencies for LLM scoring openai>=1.0.0 anthropic>=0.20.0

Static analysis

No suspicious patterns detected.