Security audit

Ruiping

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese news-commentary skill with some quality and scoping issues, but I found no hidden exfiltration, persistence, destructive behavior, or purpose-incompatible code.

Install only if you want a Chinese-language news commentary prompt/template. Treat its financial and industry recommendations as opinionated commentary, verify facts and sources yourself, and consider removing or pinning the unused requests dependency before packaging for stricter environments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents the skill as a substantive news-analysis/commentary system that identifies hot topics, analyzes them deeply, and provides pointed decision recommendations. The supplied code does not implement that core behavior. Instead, it is explicitly a 'formatting framework' that constructs a fixed output template, derives a basic title and one-sentence conclusion from extracted keywords, and leaves the actual analysis sections as placeholders for AI to fill. It also reads from files and writes output files, which are concrete capabilities not reflected in the declared permissions. While file I/O can be supportive, the larger issue is that the primary purpose materially differs: the code is a CLI scaffold/template generator, not an implemented deep news commentary engine.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description claims a substantive news-analysis/commentary skill that screens topics, analyzes developments, and outputs attitude-driven decision advice. The code does not implement news filtering, hotspot analysis, source retrieval, or genuine deep commentary. Instead, it is a command-line formatter that builds a prewritten review template with placeholders and lightweight keyword extraction from user input. It also reads from and writes to local files, which are undeclared capabilities. While the output structure aligns with the declared theme of '锐评', the actual implemented behavior is materially narrower and different in primary purpose: template generation rather than real news deep analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: All user-facing instructions and examples in the README are presented only in Chinese, and the document does not indicate that the user may choose another language. This can violate language/locale policy when a skill effectively forces a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README describes activation and use in very broad terms such as 'directly throw news to me' and 'help me find major events,' without clear boundaries on when the skill should engage or what inputs it should refuse. Overly broad triggers can cause unintended invocation, prompt hijacking via unrelated content, or unreliable behavior when the skill autonomously searches, filters, and comments on topics beyond the user's precise request.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger keywords include broad everyday phrases such as '怎么看' and '有什么看法', which can cause the skill to activate in many unrelated conversations. Overbroad activation can unexpectedly route user content into this skill, increasing the chance of unintended processing, confusion, or interference with other skills and safeguards.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation examples include very broad prompts like '最近有什么值得评的大事？', which do not clearly constrain domain or user intent. In a multi-skill environment, ambiguous activation guidance can lead to accidental invocation, misrouting, and overcollection or processing of user input beyond what the user intended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill content is written exclusively in Chinese and provides no indication that language selection is optional or user-configurable. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 模块文档在 L006 表示深度分析会由 SKILL.md 指导 AI 完成，容易让人理解为该工具实际会触发 AI 分析流程。但代码中既没有模型调用、也没有外部代理交互，只有静态模板和简单关键词拼接，因此文档对实际行为形成了积极误导。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and subsequent templates describe the tool entirely as a Chinese-language '锐评生成器', and the generated content structure is hard-coded in Chinese. There is no indication that users can opt into another language or that the locale constraint is required for a region-specific purpose, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Manifest 描述该技能会执行“筛选→分析→评论”并输出带态度的决策建议，但本文件的核心 generate 流程只是拼接固定模板，多个段落明确返回“由AI根据输入填充”之类占位内容。代码没有实现新闻检索、事实筛选、深度分析或真实评论生成，因此与技能描述存在明显语义落差。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into that language. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language content forces a specific language for all users, and there is no indication that the skill is intended only for Chinese-speaking users or that language selection is optional. Under the policy, imposing a language/locale without user opt-in is a reportable violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language descriptions and usage text entirely in Chinese, and the skill behavior is explicitly framed as a Chinese '锐评生成器'. There is no indication that users may choose another language or that the Chinese-only constraint is required for a region-specific compliance purpose, which matches the locale policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a three-step pipeline of screening, analysis, and commentary that outputs substantive viewpoint-driven recommendations. In code, the generator mostly returns canned sections such as '【由AI根据输入填充】' and only performs trivial keyword extraction/title assembly, so the implemented behavior does not actually carry out the claimed analysis or commentary generation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline documentation and returned placeholder text claim that AI will '搜索新闻原文' and populate sources from search results. However, these functions simply return static placeholder strings and there is no network access, search integration, or retrieval logic anywhere in the file, creating a direct contradiction between documentation and actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill content is written only in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: generate_original_news 与 generate_source 的文档字符串表述为生成新闻摘要和来源信息，但实现只是返回“由AI根据输入填充”“由AI根据搜索结果填充”等占位字符串。这里不是单纯实现不完整，而是注释直接宣称了代码并未执行的行为。
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified as requests>=2.28.0 without an upper bound or exact pin, so builds may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce a vulnerable or incompatible release, especially given the known security history of requests.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: The manifest references requests without pinning to a specific reviewed release, and requests has multiple historical advisories. Because the resolved version is not fixed, it is impossible to verify from this file alone whether installation will select a version affected by issues such as credential leakage or other request-handling flaws.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest frames the skill as a news analysis/commentary capability, not as a general local file processing tool. This script includes explicit file read and write behavior for arbitrary paths, which is ancillary CLI functionality rather than part of the declared user-facing purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.