Security audit

科技日报

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed tech-news automation tool, but it needs Review because its scheduled execution, outbound Feishu delivery, weak file-write scoping, and misleading source claims are not tightly controlled.

Install only if you intentionally want a Chinese-language daily tech-news workflow that may run on a schedule and optionally send reports to Feishu. Configure the webhook yourself, review or remove the hard-coded push target, require confirmation before pushes, and fix TODAY/REPORT_FILE path handling before running it in an environment with valuable local JSON files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: tech-news-daily.py:12
Finding: Path Traversal Through the TODAY Environment Variable in the Python Report Generator
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: tech-news-daily.js:23
Finding: Path Traversal Through the TODAY Environment Variable in the Node.js Report Generator
Content: View full analysis
/data/daily/../../config.json ``` This resolves to the project-level `config.json`. `fs.writeFileSync` then truncates and replaces that file. Using `__dirname` makes the starting directory predictable, but it does not mitigate traversal. The forced `.json` extension reduces the set of target filenames but still permits overwriting configuration and state files. ### Attack Path 1. An attacker controls the environment supplied to the Node.js report process. 2. The attacker sets `TODAY` to a traversal sequence such as `../../config`. 3. `path.join` normalizes the traversal and resolves the output outside `data/daily`. 4. `fs.writeFileSync` overwrites the selected JSON file. 5. Dependent application behavior may fail or change when the corrupted configuration or state is later loaded. A representative invocation is: ```bash TODAY='../../config' node tech-news-daily.js ``` ### Impact Assessment The attacker can create or overwrite `.json` files wherever the report process has write permission. Likely project-level targets include configuration and persistent ...[truncated 341 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (61)

Tainted flow: 'FEISHU_WEBHOOK' from os.getenv (line 13, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · send_feishu.py (reported line 122)May include surrounding context.
python
return False try: resp = requests.post( FEISHU_WEBHOOK, json=payload, timeout=10

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill reportedly produces only an empty template, uses different data sources than declared, and pulls undeclared RSS feeds. This creates a trust and supply-chain transparency problem: operators may believe they are approving a narrow, curated tech-news workflow while the actual source set and output behavior differ, making monitoring and policy enforcement harder.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill reportedly produces only an empty template, uses different data sources than declared, and pulls undeclared RSS feeds. This creates a trust and supply-chain transparency problem: operators may believe they are approving a narrow, curated tech-news workflow while the actual source set and output behavior differ, making monitoring and policy enforcement harder.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill reportedly produces only an empty template, uses different data sources than declared, and pulls undeclared RSS feeds. This creates a trust and supply-chain transparency problem: operators may believe they are approving a narrow, curated tech-news workflow while the actual source set and output behavior differ, making monitoring and policy enforcement harder.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill reportedly produces only an empty template, uses different data sources than declared, and pulls undeclared RSS feeds. This creates a trust and supply-chain transparency problem: operators may believe they are approving a narrow, curated tech-news workflow while the actual source set and output behavior differ, making monitoring and policy enforcement harder.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill reportedly produces only an empty template, uses different data sources than declared, and pulls undeclared RSS feeds. This creates a trust and supply-chain transparency problem: operators may believe they are approving a narrow, curated tech-news workflow while the actual source set and output behavior differ, making monitoring and policy enforcement harder.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · USAGE.md (reported line 7)May include surrounding context.

复制环境变量文件

bash
cp skills/tech-news-daily/.env.example skills/tech-news-daily/.env

填入飞书 Webhook

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The generated report states that all sources were verified even though the script performs no verification and only queries GitHub. This is dangerous because it falsely elevates trust in the content, making users more likely to rely on unvalidated summaries for operational, editorial, or investment decisions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states the skill will push aggregated content to Feishu, while the stated scope is only aggregation and brief generation. This kind of scope drift matters because outbound delivery adds an external transmission capability that may surprise users or operators and can result in unintended data sharing or unauthorized automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manual trigger phrase "生成日报" is broad and likely to overlap with ordinary user requests, increasing the chance of accidental activation. Unintended execution can cause network requests, content generation, and possible outbound delivery without the user realizing they invoked the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README lists sources that materially differ from the manifest, which weakens trust in the skill’s declared behavior and makes review of data flows incomplete. Mismatched source documentation can conceal unreviewed network access, licensing issues, or unexpected collection from additional third-party sites.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises broad automation behavior and references code/files that imply environment access, local file read/write, and network access, but it declares no explicit tool scope or permission boundaries. In an agent environment, this increases the chance of unintended data access, silent outbound requests, or persistence without user awareness, especially because the workflow includes web fetching, webhook delivery, and local state files.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Broad trigger phrases like 'tech news' or '每日资讯' can cause accidental invocation during normal conversation, which is riskier here because the skill may perform network requests, file writes, and possibly webhook pushes. Overbroad activation expands the chance of unintended actions without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Manual execution phrases such as '生成日报' or '推送科技资讯' are everyday language and may be interpreted as ordinary requests rather than explicit authorization to run an automated workflow. In context, this is more dangerous because the workflow can fetch remote content, update counters/records, and potentially send data to Feishu.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guide tells users to configure a Feishu webhook and send generated reports externally, but it does not clearly warn that all pushed content leaves the local environment and is transmitted to a third-party service. In a news aggregation skill this may seem routine, but if prompts, internal links, logs, or other unexpected content are included in the generated report, this can cause unintended data disclosure.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · USAGE.md (reported line 32)May include surrounding context.
方案 B: 系统 crontab

bash
# 编辑 crontab crontab -e # 添加条目 0 8 * * * cd /home/node/.openclaw/workspace && /usr/bin/python3 skills/tech-news-daily/tech-news-daily.py >> logs/cron.log 2>&1

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill manifest claims aggregation from GitHub Trending, 51CTO, and Baidu hot-search technology rankings with AI/Cloud/ML filtering, but this briefing only shows GitHub links and broad project picks without evidence of the promised source coverage or topic scoping. This is dangerous because users may rely on the report as a complete, validated multi-source briefing when it is actually incomplete or misleading, which can distort decision-making and trust in downstream automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The generated briefing materially diverges from the skill’s stated scope of AI/Cloud/ML-focused aggregation by highlighting unrelated or questionable repositories, including censorship-circumvention content. This is dangerous because users may trust the skill’s advertised filtering and verification claims, leading to misleading summaries, policy violations, or accidental promotion of risky content under a seemingly curated technical-news workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The statement that 'all sources were verified' is contradicted by obviously off-scope and questionable entries, making the verification claim unreliable. False assurance is dangerous because it can lower operator skepticism and cause users to trust unsafe, irrelevant, or policy-sensitive content that was not actually vetted.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The briefing materially deviates from the skill’s stated purpose of filtering for AI/Cloud/ML content by prominently featuring items like proxy lists and DNS-tunneling VPNs. In a news-aggregation skill, this misclassification can surface risky or irrelevant content to users under a trusted thematic label, increasing the chance of exposure to dual-use or abuse-enabling resources.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The statement that 'all sources were verified' is misleading because the selected content appears inconsistent with the promised filtering and includes questionable picks. This creates false trust in the curation process, which can cause users to rely on unvetted or inappropriate links as if they had passed meaningful safety and relevance checks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill aggregates GitHub Trending, 51CTO, and Baidu hot-search technology items, then filters for AI/Cloud/ML content. However, the briefing claims sources including many additional outlets such as 机器之心、量子位、36氪、钛媒体、雷锋网等, and the content is heavily focused on AI video industry news rather than clearly reflecting the declared source set or the stated AI/Cloud/ML filtering process.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This config includes multiple Chinese-only source names and URLs alongside Chinese keyword filters, which implies the skill is tailored to a specific language/locale. Because there is no visible opt-in, locale selection, or documented regional justification in this file, it may violate the policy against forcing a language or locale without user choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says the skill automatically fetches from GitHub Trending, 51CTO, and Baidu tech hot search, but this configuration enables many additional sources such as 机器之心、量子位、智东西、36氪、InfoQ、钛媒体、雷锋网 and DeepTech. This expands the aggregation behavior beyond the sources the skill claims to cover.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The config defines a push target with a specific user_id, implying automated delivery of collected content to a fixed recipient that is not disclosed in the skill description. In an agent context, undisclosed outbound delivery can enable unauthorized data sharing, privacy violations, or misuse of user-triggered actions to send content to an unintended account.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.