Security audit

网页新闻关键信息提取器

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it visits a user-provided news webpage, extracts dates and short event summaries, and helps turn them into CSV or Excel output.

Install only if you are comfortable with the agent fetching the webpage URL you provide. Use public, non-sensitive pages unless you have approval to process the content, and treat the included Excel helper as optional because the packaged .py file appears malformed and may need cleanup before use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The instructions tell the agent to automatically access a user-supplied webpage without disclosing that this triggers network access and may transmit the URL or retrieve remote content. This can create privacy and safety issues, especially if users provide internal, sensitive, or authenticated links without realizing the agent will fetch them.

Static analysis

No suspicious patterns detected.