Security audit

RSS & Atom Feed Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent RSS generator, but its page-fetching instructions use overbroad third-party, authenticated, and shell-based routes without enough safety limits.

Review before installing. Use it only for public pages, do not provide private or signed URLs, cookies, Authorization headers, API keys, or intranet targets, and avoid the shell and authenticated LLM routes unless you have a controlled environment. Generated HTML should be escaped or sanitized before hosting.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: references/protocol-routing.md:15
Finding: Default Third-Party Fetch Routing May Disclose Sensitive URLs and Headers
Content: View full analysis
` (required) - `headers=` (optional) - `max_redirects=` (optional) - `timeout_seconds=` (optional) ``` ### Technical Analysis The Skill makes an external URIBurner service the default route for fetching user-selected pages. This discloses the complete target URL to that service even though direct HTTP retrieval is sufficient for the declared feed-generation functionality. URLs may contain sensitive query parameters, signed download tokens, private document identifiers, embedded credentials, or other confidential data. The optional unrestricted `headers` parameter creates an additional risk that authentication or session headers could be forwarded to the third party. The separate instruction not to request credentials does not technically prevent an Agent from forwarding headers already supplied by a user or environment. This routing exceeds minimum privilege because the external intermediary is not required to extract public web-page content. ### Attack Path 1. A user supplies a URL containing a signed token, private path, document identifier, or sensitive query parameter. 2. Alternatively, the request includes headers such as `Authorization` or `Cookie`. 3. The Agent follows the documented default route and sends the URL and optional headers to the URIBurner endpoint. 4. The third-party service receives and can process or log the sensitive values. 5. Anyone with access to the service's request telemetry or logs may obtain the disclosed information. ### Impact Assessment Th ...[truncated 340 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:45
Finding: Unrestricted URL Fetching Permits Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/protocol-routing.md:59
Finding: Shell Command Injection Through Direct curl Fallback
Content: View full analysis
" -A "Mozilla/5.0" ``` ``` ### Technical Analysis The documentation instructs the Agent to substitute a user-controlled target URL directly into a shell command. Enclosing the placeholder in double quotes does not make arbitrary input safe. A crafted value containing a quote can terminate the quoted argument and introduce shell operators, command substitutions, redirections, or additional commands. Because this route explicitly uses `bash`, malicious input is interpreted by a command shell rather than passed directly as a single argument to an HTTP client. The worked example also encourages shell-based fetching, reinforcing this unsafe execution pattern. ### Attack Path 1. An attacker supplies a target value containing shell syntax crafted to escape the quoted URL argument. 2. The preferred fetch routes are unavailable, explicitly bypassed, or the user requests direct curl execution. 3. The Agent replaces `` in the documented command with the attacker-controlled text. 4. Bash parses the injected syntax as commands rather than as part of the URL. 5. The injected commands execute with the operating-system privileges of the Agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution in the Agent runtime. The attacker may read files accessible to the process, modify generated outputs, access environment variables, contact external systems, or execute other installed tools. If the runtime has access to user files, credentials, mounted storage, or privileged network resources, those capabilities may also be exposed. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/html-wrapper-template.md:105
Finding: Unescaped Scraped Content Can Produce Stored HTML Injection
Content: View full analysis
{{channel_title}}
Source: {{channel_url}}

{{channel_description}}
Subscribe (RSS) Visit site ``` ### Technical Analysis The HTML template inserts values extracted from an untrusted source page into HTML text and attribute contexts without mandatory context-aware encoding. A hostile page can provide a malicious title, description, or URL that closes the intended context and introduces new HTML elements, event handlers, scripts, or dangerous URI schemes. The XML templates have a related boundary-handling risk: scraped content is inserted into CDATA sections without a documented requirement to split or reject the CDATA terminator sequence. Full-text mode also embeds source HTML, making an explicit sanitizer necessary if the result will be rendered by a browser or permissive feed reader. General XML escaping rules elsewhere in the Skill do not adequately define HTML attribute encoding or sanitization for this wrapper. ### Attack Path 1. An attacker controls or compromises a page used as the feed source. 2. The attacker places crafted markup in the page title, description, post summary, or link value. 3. The Skill extracts the malicious value and substitutes it into the HTML wrapper without context-aware encoding. 4. The generated wrapper is saved and then opened locally or hosted by the user. 5. The injected markup executes in the wrapper's origin when a victim views the page. ### Impact Assessment The injected content may execute JavaScript in the origin where the generated wra ...[truncated 321 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
|----------------------------|-------------------------------------------| | `<time datetime="…">` | Use ISO value directly | | Human-readable date text | Parse with locale awareness; emit RFC 822 | | No date found | Use today's date (UTC) with a `` comment | | Relative ("3 days ago") | Calculate from scrape time | ### URL normalisation

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/vivianvoss-net.md (reported line 33)May include surrounding context.
Inspect https://vivianvoss.net/blog HTML. Typical Hugo/Gatsby static blog pattern:

html
 <article class="post-card"> <h2 class="post-card-title"> <a href="/blog/the-graphql-tax">The GraphQL Tax</a>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/feed-templates.md (reported line 24)May include surrounding context.
md
<generator>RSS Feed Generator Skill v1.0 (synthetic feed)</generator> <atom:link href="{{feed_self_url}}" rel="self" type="application/rss+xml"/>  <item> <title><![CDATA[{{item_title}}]]></title> <link>{{item_url}}</link>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/feed-templates.md (reported line 29)May include surrounding context.
md
<title><![CDATA[{{item_title}}]]></title> <link>{{item_url}}</link> <guid isPermaLink="true">{{item_url}}</guid> <pubDate>{{item_date_rfc822}}</pubDate> <description><![CDATA[{{item_summary_html_or_text}}]]></description>  <dc:creator><![CDATA[{{item_author}}]]></dc:creator>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/feed-templates.md (reported line 79)May include surrounding context.
md
<entry> <title type="html"><![CDATA[{{item_title}}]]></title> <id>{{item_url}}</id> <updated>{{item_date_iso8601}}</updated> <published>{{item_date_iso8601}}</published> <link href="{{item_url}}" rel="alternate"/> <summary type="html"><![CDATA[{{item_summary_html}}]]></summary>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/html-wrapper-template.md (reported line 21)May include surrounding context.
md
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>{{channel_title}} — Feed</title>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/validation-checklist.md (reported line 22)May include surrounding context.
md
- [ ] Every `<item>` has `<guid>` equal to the post URL - [ ] `<guid isPermaLink="true">` set when GUID is a URL - [ ] `<pubDate>` is valid RFC 822 format (`Mon, 01 Jan 2024 00:00:00 +0000`) - [ ] Items with estimated dates have `` comment ### Content - [ ] All `&` in text nodes escaped as `&` (or in CDATA)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The routing guidance instructs the skill to send user-supplied target URLs and request metadata to external services without clearly warning the user or requiring consent. In this skill context, users may expect a local or first-party fetch, so undisclosed transmission of browsing targets, headers, and content to third-party endpoints creates avoidable privacy and security exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill expands a simple page-fetching task into authenticated LLM-mediated execution, which is not necessary to retrieve a web page and increases the attack surface. This can cause target URLs, page contents, prompts, and possibly credentials or execution context to be sent to an external model endpoint, creating unnecessary data exposure and tool-routing risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Allowing direct bash execution with curl or wget is broader and more dangerous than the skill's stated purpose requires. Even with a fixed example command, normalizing shell-based network access encourages execution in a more privileged environment, increasing the risk of SSRF-style access, unsafe URL handling, and environment-dependent abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The checklist explicitly instructs the agent to 'apply silently before output,' which means generated feed content may be altered without disclosing those changes to the user. In a content-transformation skill, silent normalization can misrepresent source data provenance, hide estimation or correction logic, and reduce user ability to audit whether links, dates, or deduplication changed the original extracted content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to save generated XML files into persistent storage under /mnt/user-data/outputs/ and present them, but it does not require an explicit user warning or confirmation before writing. This can lead to unexpected retention of user-requested artifacts, which is a privacy and transparency issue even if the content is not inherently sensitive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The placeholder {{language|en}} sets a default language of en, which can force an English locale when the source page does not specify one. This is a natural-language policy concern because the file does not indicate user choice or justify the fallback locale.
Content: No source excerpt is available for this finding.