Security audit

Ai News Hub

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AI news skill, but it needs Review because one helper can fetch arbitrary URLs and automatically disclose URLs to a third-party parser without clear scoping.

Install only if you are comfortable with a Chinese-language news skill that contacts many external sources. Avoid giving it private, signed, localhost, internal-network, or file URLs, because the URL summarizer is not safely restricted and may forward URLs to Jina Reader. Prefer running it in a network-restricted environment and review the RSS source list before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/summarize_url.py:63
Finding: Arbitrary URL fetching permits SSRF and local resource access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/summarize_url.py:103
Finding: Automatic Jina Reader fallback discloses user-supplied URLs to a third party
Content: View full analysis
len(result.get("content", "")): result["content"] = jina_content result["method"] = "jina" ``` ### Technical Analysis The full user-supplied URL is embedded in a request to `https://r.jina.ai/`. This includes the original hostname, path, and query string. The disclosure is not limited to use of the explicit `--jina` option. When direct extraction returns less than 100 characters, the fallback happens automatically. The user may therefore reasonably expect a direct request while the implementation additionally forwards the URL to an external service. URLs can contain sensitive information, including: - Signed download parameters - Authentication tokens in query strings - Private document identifiers ...[truncated 1131 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/arxiv_papers.py:36
Finding: arXiv search terms and results are transmitted over plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/rss_aggregator.py:102
Finding: Unbounded network response reads permit memory and disk exhaustion
Content: View full analysis
Remediation: View remediation
limit: raise ValueError("Response exceeds size limit") chunks.append(chunk) return b"".join(chunks) ``` 4. Apply limits before decoding text. 5. Limit the total number and size of cache entries. 6. Write cache updates atomically and enforce a maximum cache file size. 7. Reduce aggregate exposure by applying a global download budget across concurrent workers. 8. Add tests for oversized `Content-Length`, chunked oversized responses, and multiple concurrent oversized feeds. ]]>

T08 · Insecure Dependencies

Note

Location: INSTALL.md:23
Finding: Installation instructions recommend an unused and unpinned third-party dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code substantially matches part of the description: it is indeed an RSS aggregation tool with concurrent fetching, category filtering, and local caching/prefetch-like behavior. However, the declared description promises several higher-level assistant features that are not present in this code chunk, including interest scoring, deduplication across days, report generation, keyword filtering, and subscription features. The script is a feed fetch/parse aggregator only, not a full AI news reading assistant with the described intelligence and workflow features. There is no obvious undeclared harmful behavior, but there is a clear description-to-behavior overstatement, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The supplied code chunk does not implement the described AI news aggregation assistant. Its behavior is narrowly scoped to fetching and extracting content from one provided URL, with optional use of Jina Reader as a parsing fallback. While article prefetch/extraction could be a supporting component within a larger news assistant, this chunk by itself lacks the core declared functionality: RSS ingestion, aggregation across many sources, ranking/scoring, deduplication, report generation, and subscription/filtering features. Additionally, it contacts an external parsing endpoint (r.jina.ai), which is not reflected in the declared description. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The description presents a feature-rich AI news assistant, but the provided code chunk only contains unit tests around low-level RSS aggregator behaviors: source loading, caching, fetching, conditional HTTP requests, proxy handling, and XML parsing. Those behaviors partially align with the RSS fetching portion of the description, but the primary declared value proposition includes many higher-level product features that are absent from the code shown. There is no evidence here of recommendation/interest scoring, deduplication across days, report generation, source breadth (100+), or specialized aggregation from arXiv/GitHub/company feeds. This is therefore a material description-behavior mismatch, though there is no sign of hidden malicious or unrelated sensitive capability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file consistently presents the skill's output format, headings, examples, and command context in Chinese, beginning with the title '输出示例' and continuing throughout all sample outputs. Under the policy rule for natural-language violations, this appears to enforce a specific language/locale without documenting user opt-in or offering a language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises broad aggregation from 100+ RSS and other external sources, plus tracking-oriented features like interest scoring and subscriptions, but does not warn users that the skill performs extensive network access or explain resulting privacy and metadata exposure. In an agent setting, this can cause users to unknowingly trigger outbound requests that reveal IP, timing, queried topics, or subscription interests to many third parties.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises network fetching, caching, and script execution but does not declare any explicit tool scope such as allowed network or file capabilities. Missing permission boundaries increases the risk of over-broad runtime access and makes it harder for a host system or user to understand what the skill may do when invoked.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description forces Chinese output/instructions without indicating that users may choose another language. Under the language/locale policy, a skill should not impose a specific language unless it offers opt-in or clearly documents a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Overly broad trigger phrases can cause unintended invocation of a skill that performs large-scale external fetching. That can lead to unexpected network activity, privacy issues, or unnecessary resource consumption when ordinary conversation text accidentally matches activation terms.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Generic trigger terms like broad AI or ML topics can activate the skill outside the user's intent, especially because the skill then performs network requests across many sources. In context, unintended activation is more concerning because it can initiate external data access and produce outputs the user did not request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest trigger list contains generic phrases such as "今天新闻", "技术新闻", and "行业动态" that are broad enough to match ordinary user speech outside the intended skill scope. The manifest does not provide narrowing context, exclusion conditions, or negative examples to clarify when the skill should and should not activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings such as the module docstring and command descriptions entirely in Chinese, and the CLI output later follows the same pattern. Because the skill forces a specific language for interaction without any user opt-in or justification that it is region-specific, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: When Jina Reader is used, the target URL and potentially the full article retrieval request are sent to a third-party service (r.jina.ai) without any explicit user-facing warning or consent in the script output/interface. In a news aggregation context, this can leak users’ reading targets, internal links, or non-public URLs to an external provider, creating a privacy and data-handling risk even if no code execution occurs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file uses Chinese throughout, including headings and feature descriptions, with no indication that the skill is region-specific or that users can choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file documents commands for RSS aggregation, arXiv search, and GitHub Trending retrieval, all of which inherently make outbound network requests. The guide describes usage and performance but does not warn users that running these commands contacts external services and may expose IP address, user agent, or access patterns.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The markdown encourages users to add custom RSS URLs in scripts/rss_sources.json, which changes external data sources the skill will contact. There is no accompanying warning about trusting feed URLs, network access implications, or verifying the safety and ownership of added endpoints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The primary skill description is presented in Chinese and the README consistently uses Chinese user-facing examples, but it does not offer an opt-in language choice or explain that the skill is intentionally region- or locale-specific. This can violate language/locale policy where user-facing skills should not force a language without user choice or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill description does not clearly warn users that invoking it may trigger extensive outbound requests to many third-party sources. Lack of disclosure weakens informed consent and can surprise users in environments where network access, privacy, or rate limits matter.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest declares a single language value of "zh-CN", which can be interpreted as forcing a specific language/locale for the skill. There is no accompanying note that the skill is region-specific or that users may opt into another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script's docstrings, CLI help text, progress messages, and normal output are written in Chinese throughout, which imposes a specific language on users. The file does not provide an option to select another language or explain that the skill is intentionally limited to a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The script reads HTTP_PROXY/http_proxy from the environment and uses that proxy for outbound requests, which can route request metadata through infrastructure the user may not expect. Although the file has general docstrings and error output, it does not disclose this proxy behavior to the user at the point of execution or in user-facing output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The request header forces an English locale preference via Accept-Language: en-US,en;q=0.9. This is a natural-language/locale policy concern because the script imposes a specific language setting without offering the user a choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This JSON manifest mixes English and Chinese content sources, including entries such as 机器之心, 36氪快讯, 少数派, InfoQ 中文, and 量子位, but provides no natural-language indication that users can choose or opt into a non-English locale. Under the language/locale policy, forcing or silently including a specific language without user opt-in can be a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The request header sets Accept-Language to zh-CN,zh;q=0.9,en;q=0.8, which imposes a language/locale preference regardless of user choice. This is a natural-language policy concern because the skill biases fetched content toward Chinese without exposing a language option or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code file contains natural-language documentation exclusively in Chinese, including the module docstring and test descriptions. Under the language/locale policy, forcing a single language without user opt-in or a documented regional justification is a policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.