Security audit

Ai News Hub

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a normal AI news aggregation skill, but one helper can forward user-provided URLs to Jina Reader without clear notice or strong URL limits.

Review before installing. Use it only if you are comfortable with broad outbound web requests, local caching of fetched RSS content, and the possibility that article URLs may be sent to Jina Reader. Avoid using the URL summarizer with private, internal, authenticated, signed, or sensitive links unless that fallback is removed or made explicitly opt-in.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises executable scripts that perform network access, caching, and likely local file writes, yet no permissions are declared in the skill metadata. This creates a transparency and policy-enforcement gap: a host may invoke the skill without understanding that it can reach external services and persist data locally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is news aggregation, but the behavior reportedly includes fetching arbitrary URLs and sending content extraction requests to a third-party service (r.jina.ai) that is not disclosed in the description. Hidden outbound data flows and arbitrary URL retrieval materially expand the trust boundary, enabling SSRF-like abuse, unexpected exfiltration of fetched content, or privacy/compliance issues if sensitive URLs are processed.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The Jina Reader fallback sends user-supplied article URLs to a third-party service, which changes the trust boundary and can disclose browsing targets, internal URLs, or authenticated intranet endpoints if this script is run on sensitive hosts. In a news-reading skill this is not inherently malicious, but it is a real privacy and SSRF-style risk because external requests are made to an additional service without strong restriction or explicit warning.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger list contains broad, common phrases such as general requests for news or trends, which can cause the skill to activate in contexts where the user did not specifically intend external aggregation. Overbroad invocation increases the chance of unnecessary network access, unexpected data retrieval, and accidental use in conversations only loosely related to the skill.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The activation guidance says the skill should be used whenever users want AI/tech news, papers, trends, GitHub projects, or company updates, but it does not define boundaries for when it should not run. In a skill that performs broad network collection, missing guardrails can lead to unintended activation and unnecessary external requests, making the operational risk higher than a purely local helper.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list contains generic phrases such as '今天新闻', 'AI资讯', and '行业动态' that are broad enough to match ordinary user requests, increasing the chance of unintended or overly aggressive activation. In a news aggregation skill with many external data sources, accidental invocation can expand data fetching and content exposure beyond what the user explicitly intended.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script transmits requested article URLs to Jina Reader without a clear user-facing warning at the point of use, which can leak what content the user is accessing and may expose sensitive internal addresses if arbitrary URLs are allowed. In this skill context, external article retrieval is expected, but silent delegation to an unrelated third party increases privacy and security risk beyond normal first-party fetching.

Static analysis

No suspicious patterns detected.