Security audit

Simple news feed reader (RSS)

Security checks for vulnerabilities and agentic risk

Overview

The news skill largely does what it claims, but its bundled permission settings allow broader local commands than needed for fetching RSS headlines.

Review the bundled .claude/settings.local.json before installing. The news script itself is a straightforward RSS fetcher, but the packaged permissions should be narrowed to the specific news.py command and normal approval should remain required for arbitrary Python, git changes, directory enumeration, and unrelated web searches.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: .claude/settings.local.json:3
Finding: Local permission policy exceeds the Skill's functional requirements
Content: View full analysis
'`, `tree`, `git add`, or `git commit`. 4. Because the broad command pattern is preauthorized, the command may execute without the approval that would otherwise protect the ...[truncated 571 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/news.py:70
Finding: Untrusted RSS fields are rendered directly into Agent-visible output
Content: View full analysis
]+>", "", desc).strip() if len(desc) > 300: desc = desc[:297] + "..." l = item.find("link") if l is not None and l.text: link = l.text.strip() ``` The extracted values are then inserted directly into Markdown output: ```python for source, items in grouped.items(): lines.append(f"## {source}\n") for it in items: cat = f" [{it['category']}]" if it["category"] != "top" else "" time = f" — {it['time']}" if it["time"] else "" lines.append(f"- **{it['title']}**{cat}{time}") if it["description"]: lines.append(f" {it['description']}") if it["link"]: lines.append(f" {it['link']}") lines.append("") ``` ### Technical Analysis RSS providers control the title, description, and link fields processed by the script. Removing HTML tags from descriptions does not neutralize Markdown syntax, deceptive URLs, Unicode control characters, or instruction-like natural language. Titles and links receive no comparable sanitization. Consequently, a compromised feed, malicious upstream publisher, or compromised feed intermediary can place crafted content directly into output consumed by a user or AI Agent. The AP source uses the third-party `rsshub.app` service, adding another external trust dependency. Thi ...[truncated 1402 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes Python code that performs outbound HTTP requests to multiple external RSS feeds, but the manifest does not declare any explicit tool scope or network permission boundary. This creates a transparency and policy-enforcement gap: a host system or reviewer cannot easily distinguish expected network access from unexpected future expansion, increasing the risk of silent data exfiltration or unauthorized outbound requests if the script changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The 'When to Use' section includes generic phrases such as 'latest news', 'current events', 'what's happening in the world', and 'morning briefing' without boundaries or exclusion conditions. These broad triggers could match ordinary conversation and cause unintended invocation of the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code performs HTTP requests to multiple third-party news sources via urlopen, which transmits the user's system IP/network metadata externally. While the module docstring says it fetches RSS feeds, there is no explicit user-facing warning, confirmation, or privacy notice near the operation or CLI help indicating that external network access will occur.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.