RSS Monitor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:32 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward RSS monitor with disclosed local storage, optional scheduling, and optional Feishu/Lark notifications, but users should avoid adding sensitive internal feeds unless they intend them to be fetched and possibly notified externally.

Install only if you are comfortable with the skill storing your feed list and article history in ~/.rss_monitor, fetching every configured feed from the machine where it runs, and sending update text to Feishu/Lark when FEISHU_WEBHOOK is set. Prefer a virtual environment, trusted package index, and non-sensitive feed URLs, especially when enabling cron.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rss_monitor.py:59

Finding

Unrestricted RSS Feed URLs Enable Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/rss_monitor.py, lines 59-81
Vulnerability Type: Server-Side Request Forgery through unrestricted feed retrieval
Risk Level: Medium

python

def parse_feed(url):
    """Parse RSS/Atom feed and return entries"""
    if not HAS_DEPS:
        print("错误: 缺少依赖")
        print("请安装: pip install requests feedparser")
        return None
    
    try:
        feed = feedparser.parse(url)
        if feed.bozo:
            print(f"警告: 解析 feed 时出现问题: {feed.bozo_exception}")
        
        entries = []
        for entry in feed.entries[:10]:  # Get last 10 entries
            entry_data = {
                "title": entry.get("title", "无标题"),
                "link": entry.get("link", ""),
                "published": entry.get("published", entry.get("updated", "未知时间")),
                "summary": entry.get("summary", entry.get("description", ""))[:200],
                "feed_title": feed.feed.get("title", "未知源")
            }

Technical Analysis

User-supplied feed URLs are passed directly to feedparser.parse() without validating the URL scheme, destination hostname, resolved IP address, or redirect chain. Although urlparse is imported elsewhere in the script, it is not used to enforce any restrictions.

Consequently, a caller can configure a feed URL that targets loopback, private, link-local, or otherwise sensitive network resources accessible from the machine running the Skill. The URL is persisted in ~/.rss_monitor/feeds.json, so an optional scheduled check-all invocation can repeat the request indefinitely.

The exploitable capability is bounded by the network permissions of the process and by the content that feedparser can parse. Nevertheless, internal services returning RSS-, Atom-, or XML-like content could have their data processed, stored in history, and partially included in Feishu notifications.

Attack Path

1. A ...[truncated 1116 chars]

Remediation

View remediation

Remediation Suggestions

• Accept only explicitly supported schemes, preferably https and, only when required, http.
• Reject URLs containing embedded credentials.
• Resolve the destination hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
• Validate every redirect destination rather than checking only the initial URL.
• Consider requiring an explicit trusted-host allowlist for scheduled feeds.
• Apply connection and response-size limits to reduce denial-of-service exposure.
• Revalidate saved URLs during every scheduled check because DNS resolution can change after initial registration.
• Clearly notify users that configured feeds will be contacted repeatedly when cron scheduling is enabled.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:82

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-88
Vulnerability Type: Unconstrained third-party dependency resolution
Risk Level: Low

markdown

## Dependencies

- Python 3.6+
- requests
- feedparser

Install: `pip install requests feedparser`

Technical Analysis

The documented installation command installs requests and feedparser without version constraints or package hashes. As a result, installation behavior depends on whichever package versions and Python package index are available at installation time.

This makes deployments non-reproducible and may introduce future incompatible or compromised releases without an additional review. The risk increases if the environment is configured to use an untrusted package mirror or additional package indexes.

No evidence was found that the documented package names are typosquatted or intentionally malicious. The finding concerns the absence of dependency pinning and integrity verification.

Attack Path

1. A user follows the documented pip install requests feedparser command.
2. pip resolves mutable package versions from the environment's configured indexes.
3. A compromised future release, compromised index, or maliciously configured mirror supplies dependency content.
4. The dependency's installation or imported runtime code executes with the permissions of the user installing or running the Skill.

Impact Assessment

A compromised dependency could execute code with the privileges of the account performing installation or running the RSS monitor. This could affect local files, environment variables, webhook credentials, and network resources accessible to that account.

The current project does not request elevated installation privileges, and no direct evidence of a presently compromised dependency was identified. Therefore, the practical risk is rated Low.

Remediation

View remediation

Remediation Suggestions

• Define reviewed, compatible dependency versions in a requirements or lock file.
• Generate and verify cryptographic package hashes, such as through pip install --require-hashes.
• Document installation from a trusted package index.
• Review and update pinned versions regularly to incorporate security patches.
• Install dependencies inside an isolated virtual environment under a non-privileged user account.
• Add automated dependency vulnerability scanning to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tainted flow: 'webhook' from os.environ.get (line 93, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/rss_monitor.py (reported line 116)May include surrounding context.

python

}
    
    try:
        response = requests.post(webhook, json=payload, timeout=10)
        result = response.json()
        if result.get('code') == 0:
            print("[OK] Feishu 通知已发送")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation describes capabilities that require network access, local file reads/writes, and environment variable use, but it does not declare any explicit tool scope or permissions. This creates an authorization transparency gap: operators may enable the skill without understanding its effective access, increasing the chance of unintended data exposure or misuse of local files and webhooks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Feishu message payload is constructed only for the zh_cn locale, which forces a specific language/locale in the skill's behavior. The file does not provide a user option or documented justification for restricting notifications to Chinese locale output.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/rss_monitor.py (reported line 116)May include surrounding context.

python

}
    
    try:
        response = requests.post(webhook, json=payload, timeout=10)
        result = response.json()
        if result.get('code') == 0:
            print("[OK] Feishu 通知已发送")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill states where feed and history data are stored, but it does not clearly warn users in the description or setup flow that feed URLs and article history will be persisted locally. This can lead to accidental storage of sensitive subscription URLs, internal feed endpoints, or reading history on shared machines, creating a privacy and operational security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code sends article titles and summaries derived from monitored feeds to an external Feishu webhook, which is a network transmission of user-configured monitoring data. While the function logs success or failure, there is no clear user-facing disclosure at the call site or command interface that checking feeds may forward content to a third-party webhook when FEISHU_WEBHOOK is set.

Content

No source excerpt is available for this finding.