RSS & Atom Feed Generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent RSS generator, but its page-fetching instructions use overbroad third-party, authenticated, and shell-based routes without enough safety limits.

Review before installing. Use it only for public pages, do not provide private or signed URLs, cookies, Authorization headers, API keys, or intranet targets, and avoid the shell and authenticated LLM routes unless you have a controlled environment. Generated HTML should be escaped or sanitized before hosting.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: references/protocol-routing.md:15
• Finding: Default Third-Party Fetch Routing May Disclose Sensitive URLs and Headers<![CDATA[ ## Vulnerability Details **File Location**: `references/protocol-routing.md:15-28` **Vulnerability Type**: Sensitive information exposure through an external fetch proxy **Risk Level**: High ### Vulnerable Code ```markdown ## WEB_FETCH via URIBurner REST Use when: - fetching the source page to generate a feed from - no protocol preference is stated Endpoint: - `https://linkeddata.uriburner.com/chat/functions/WEB_FETCH` Parameters: - `url=<TARGET_URL>` (required) - `headers=<JSON_HEADERS>` (optional) - `max_redirects=<n>` (optional) - `timeout_seconds=<n>` (optional) ``` ### Technical Analysis The Skill makes an external URIBurner service the default route for fetching user-selected pages. This discloses the complete target URL to that service even though direct HTTP retrieval is sufficient for the declared feed-generation functionality. URLs may contain sensitive query parameters, signed download tokens, private document identifiers, embedded credentials, or other confidential data. The optional unrestricted `headers` parameter creates an additional risk that authentication or session headers could be forwarded to the third party. The separate instruction not to request credentials does not technically prevent an Agent from forwarding headers already supplied by a user or environment. This routing exceeds minimum privilege because the external intermediary is not required to extract public web-page content. ### Attack Path 1. A user supplies a URL containing a signed token, private path, document identifier, or sensitive query parameter. 2. Alternatively, the request includes headers such as `Authorization` or `Cookie`. 3. The Agent follows the documented default route and sends the URL and optional headers to the URIBurner endpoint. 4. The third-party service receives and can process or log the sensitive values. 5. Anyone with access to the service's request telemetry or logs may obtain the disclosed information. ### Impact Assessment Th ...[truncated 340 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make a structured direct HTTP client the default fetch route. 2. Require explicit, informed user consent before sending requests through any third-party proxy. 3. Never forward `Authorization`, `Cookie`, `Proxy-Authorization`, API-key, or other credential-bearing headers. 4. Replace unrestricted `headers` input with a narrow allowlist, such as `Accept`, `Accept-Language`, and a controlled `User-Agent`. 5. Detect and redact common secret-bearing query parameters before proxying requests. 6. Clearly document the third party, the information transmitted, and applicable retention implications. 7. Prefer local processing whenever the target is publicly reachable without an intermediary. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:45
• Finding: Unrestricted URL Fetching Permits Server-Side Request Forgery< for exact invocation patterns per protocol. ``` ### Technical Analysis The Skill accepts an arbitrary target URL and directs the Agent or external fetch service to retrieve it. No enforceable validation rejects loopback addresses, RFC 1918 private networks, link-local addresses, cloud metadata endpoints, non-HTTP schemes, or reserved address ranges. Redirect following is also supported. Consequently, validation of only the initial hostname would be insufficient because a public URL could redirect to an internal address. DNS rebinding could similarly cause a previously public hostname to resolve to a private address when the request is made. The operational statement limiting scraping to publicly accessible pages is advisory and is not accompanied by concrete validation requirements. ### Attack Path 1. An attacker requests feed generation for an internal target such as a loopback service, private network host, or cloud metadata endpoint. 2. Alternatively, the attacker supplies a public URL that redirects to an internal target. 3. The Agent invokes `WEB_FETCH`, MCP, OPAL, or curl from a network context that can reach the target. 4. The fetch mechanism retrieves the otherwise inaccessible response. 5. The Skill processes the response a ...[truncated 599 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only `http` and `https` URLs. 2. Reject URLs containing embedded credentials. 3. Resolve the destination hostname and block loopback, private, link-local, multicast, unspecified, and reserved addresses for both IPv4 and IPv6. 4. Explicitly block common cloud metadata endpoints and hostnames. 5. Revalidate the resolved address after every redirect and impose a small redirect limit. 6. Defend against DNS rebinding by connecting only to the validated address while preserving the expected HTTP host and TLS identity. 7. Apply outbound network allowlisting where practical. 8. Limit response size, request duration, and concurrent requests. 9. Do not return raw internal responses or detailed connection diagnostics to users. 10. Enforce the public-resource restriction technically rather than relying on advisory text. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/protocol-routing.md:59
• Finding: Shell Command Injection Through Direct curl Fallback<![CDATA[ ## Vulnerability Details **File Location**: `references/protocol-routing.md:59-64` **Vulnerability Type**: OS command injection **Risk Level**: Critical ### Vulnerable Code ```markdown ## Direct bash (curl/wget) Use as a last resort when none of the above are available. ```bash curl -s -L "<TARGET_URL>" -A "Mozilla/5.0" ``` ``` ### Technical Analysis The documentation instructs the Agent to substitute a user-controlled target URL directly into a shell command. Enclosing the placeholder in double quotes does not make arbitrary input safe. A crafted value containing a quote can terminate the quoted argument and introduce shell operators, command substitutions, redirections, or additional commands. Because this route explicitly uses `bash`, malicious input is interpreted by a command shell rather than passed directly as a single argument to an HTTP client. The worked example also encourages shell-based fetching, reinforcing this unsafe execution pattern. ### Attack Path 1. An attacker supplies a target value containing shell syntax crafted to escape the quoted URL argument. 2. The preferred fetch routes are unavailable, explicitly bypassed, or the user requests direct curl execution. 3. The Agent replaces `<TARGET_URL>` in the documented command with the attacker-controlled text. 4. Bash parses the injected syntax as commands rather than as part of the URL. 5. The injected commands execute with the operating-system privileges of the Agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution in the Agent runtime. The attacker may read files accessible to the process, modify generated outputs, access environment variables, contact external systems, or execute other installed tools. If the runtime has access to user files, credentials, mounted storage, or privileged network resources, those capabilities may also be exposed. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the shell-based fallback and use a structured HTTP API or library. 2. If curl is unavoidable, invoke it through an argument-array process API without a shell. 3. Pass the URL as one validated argument; do not build a command string through interpolation. 4. Apply strict HTTP/HTTPS URL validation and the SSRF protections described separately. 5. Use curl's `--` option before positional URL input where supported to prevent option injection. 6. Reject control characters, line breaks, and malformed URL syntax. 7. Update the worked example so it does not encourage interpolation of untrusted values into shell commands. 8. Run any necessary fetch subprocess in a sandbox with minimal filesystem and network permissions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/html-wrapper-template.md:105
• Finding: Unescaped Scraped Content Can Produce Stored HTML Injection<![CDATA[ ## Vulnerability Details **File Location**: `references/html-wrapper-template.md:105-114` **Vulnerability Type**: Stored cross-site scripting and generated-markup injection **Risk Level**: High ### Vulnerable Code ```html <h1>{{channel_title}}</h1> <p class="source-url">Source: <a href="{{channel_url}}">{{channel_url}}</a></p> <p style="font-size:.95rem; line-height:1.6; margin-bottom:1.5rem;"> {{channel_description}} </p> <a class="btn btn-primary" href="{{feed_xml_url}}">Subscribe (RSS)</a> <a class="btn btn-secondary" href="{{channel_url}}">Visit site</a> ``` ### Technical Analysis The HTML template inserts values extracted from an untrusted source page into HTML text and attribute contexts without mandatory context-aware encoding. A hostile page can provide a malicious title, description, or URL that closes the intended context and introduces new HTML elements, event handlers, scripts, or dangerous URI schemes. The XML templates have a related boundary-handling risk: scraped content is inserted into CDATA sections without a documented requirement to split or reject the CDATA terminator sequence. Full-text mode also embeds source HTML, making an explicit sanitizer necessary if the result will be rendered by a browser or permissive feed reader. General XML escaping rules elsewhere in the Skill do not adequately define HTML attribute encoding or sanitization for this wrapper. ### Attack Path 1. An attacker controls or compromises a page used as the feed source. 2. The attacker places crafted markup in the page title, description, post summary, or link value. 3. The Skill extracts the malicious value and substitutes it into the HTML wrapper without context-aware encoding. 4. The generated wrapper is saved and then opened locally or hosted by the user. 5. The injected markup executes in the wrapper's origin when a victim views the page. ### Impact Assessment The injected content may execute JavaScript in the origin where the generated wra ...[truncated 321 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. HTML-escape all values inserted into text nodes. 2. Apply HTML attribute encoding to every value inserted into an attribute. 3. Parse and validate URL fields, permitting only expected schemes such as `https` and, where necessary, `http`. 4. Reject dangerous schemes including `javascript`, `data`, and `vbscript`. 5. Sanitize embedded full-text HTML with a conservative element-and-attribute allowlist. 6. Strip event-handler attributes, active embedded content, unsafe CSS, and script-capable URLs. 7. Safely split or reject CDATA terminator sequences before placing untrusted content in CDATA. 8. Add automated tests using malicious titles, descriptions, URLs, quotes, angle brackets, entity references, and CDATA boundary strings. 9. Add a restrictive Content Security Policy to generated HTML as defense in depth. 10. Update the validation checklist to verify context-aware HTML encoding and URL-scheme safety, not only XML well-formedness. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Hidden Instructions

High

• Category: Prompt Injection

Content

|----------------------------|-------------------------------------------|
| `<time datetime="…">`      | Use ISO value directly                    |
| Human-readable date text   | Parse with locale awareness; emit RFC 822 |
| No date found              | Use today's date (UTC) with a `<!-- estimated -->` comment |
| Relative ("3 days ago")    | Calculate from scrape time                |

### URL normalisation

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

Inspect `https://vivianvoss.net/blog` HTML. Typical Hugo/Gatsby static blog pattern:

```html
<!-- Likely repeating structure (illustrative): -->
<article class="post-card">
  <h2 class="post-card-title">
    <a href="/blog/the-graphql-tax">The GraphQL Tax</a>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<generator>RSS Feed Generator Skill v1.0 (synthetic feed)</generator>
    <atom:link href="{{feed_self_url}}" rel="self" type="application/rss+xml"/>

    <!-- REPEAT FOR EACH POST -->
    <item>
      <title><![CDATA[{{item_title}}]]></title>
      <link>{{item_url}}</link>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<title><![CDATA[{{item_title}}]]></title>
      <link>{{item_url}}</link>
      <guid isPermaLink="true">{{item_url}}</guid>
      <pubDate>{{item_date_rfc822}}</pubDate><!-- date-estimated if no date found -->
      <description><![CDATA[{{item_summary_html_or_text}}]]></description>
      <!-- Optional fields below — include only when data is available -->
      <dc:creator><![CDATA[{{item_author}}]]></dc:creator>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<entry>
    <title type="html"><![CDATA[{{item_title}}]]></title>
    <id>{{item_url}}</id>
    <updated>{{item_date_iso8601}}</updated><!-- date-estimated if no date found -->
    <published>{{item_date_iso8601}}</published>
    <link href="{{item_url}}" rel="alternate"/>
    <summary type="html"><![CDATA[{{item_summary_html}}]]></summary>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>{{channel_title}} — Feed</title>

  <!--
    Feed readers and browsers look for this tag to auto-discover the feed.
    Update href to wherever you host the .xml file.
  -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

- [ ] Every `<item>` has `<guid>` equal to the post URL
- [ ] `<guid isPermaLink="true">` set when GUID is a URL
- [ ] `<pubDate>` is valid RFC 822 format (`Mon, 01 Jan 2024 00:00:00 +0000`)
- [ ] Items with estimated dates have `<!-- date-estimated -->` comment

### Content
- [ ] All `&` in text nodes escaped as `&amp;` (or in CDATA)

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The routing guidance instructs the skill to send user-supplied target URLs and request metadata to external services without clearly warning the user or requiring consent. In this skill context, users may expect a local or first-party fetch, so undisclosed transmission of browsing targets, headers, and content to third-party endpoints creates avoidable privacy and security exposure.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill expands a simple page-fetching task into authenticated LLM-mediated execution, which is not necessary to retrieve a web page and increases the attack surface. This can cause target URLs, page contents, prompts, and possibly credentials or execution context to be sent to an external model endpoint, creating unnecessary data exposure and tool-routing risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Allowing direct `bash` execution with `curl` or `wget` is broader and more dangerous than the skill's stated purpose requires. Even with a fixed example command, normalizing shell-based network access encourages execution in a more privileged environment, increasing the risk of SSRF-style access, unsafe URL handling, and environment-dependent abuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The checklist explicitly instructs the agent to 'apply silently before output,' which means generated feed content may be altered without disclosing those changes to the user. In a content-transformation skill, silent normalization can misrepresent source data provenance, hide estimation or correction logic, and reduce user ability to audit whether links, dates, or deduplication changed the original extracted content.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The skill instructs the agent to save generated XML files into persistent storage under /mnt/user-data/outputs/ and present them, but it does not require an explicit user warning or confirmation before writing. This can lead to unexpected retention of user-requested artifacts, which is a privacy and transparency issue even if the content is not inherently sensitive.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The placeholder `{{language|en}}` sets a default language of `en`, which can force an English locale when the source page does not specify one. This is a natural-language policy concern because the file does not indicate user choice or justify the fallback locale.

Static analysis

No suspicious patterns detected.