Dajiala Article Fetcher

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it uses a Dajiala API key to fetch WeChat public-account article data and save it into a local Excel report.

Install only if you intend to use Dajiala for WeChat public-account article retrieval and are comfortable providing DAJIALA_KEY and creating reports under the documented local path. Treat generated spreadsheets as containing untrusted remote data, especially before opening them in spreadsheet software that may evaluate formulas or external content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: fetch_articles.py:59

Finding

Spreadsheet Formula Injection in Exported Article Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tainted flow: 'payload' from os.environ.get (line 48, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · fetch_articles.py (reported line 57)May include surrounding context.

python

}
    
    try:
        response = requests.post(API_URL, json=payload, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares access to environment variables and networked API behavior, but it does not specify any tool scope or permission boundaries. This can lead to overbroad execution privileges, making it easier for the skill to access secrets such as API keys or perform unintended outbound requests without clear user or platform constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough that the skill may activate for generic article-retrieval requests, even when the user did not intend to use this specific API-backed workflow. That creates a security and privacy risk because the skill may unnecessarily access configured credentials, contact external services, or write local files in response to ambiguous prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description omits key safety-relevant disclosures: it requires an API credential and writes retrieved data to a local Excel file. Without this warning, users may invoke the skill without understanding that secrets will be used and local filesystem changes will occur, increasing the chance of unintended credential exposure or unauthorized data persistence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring is entirely in Chinese and presents the skill as operating in that language, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fetch_articles.py (reported line 57)May include surrounding context.

python

}
    
    try:
        response = requests.post(API_URL, json=payload, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language description and trigger conditions are written solely in Chinese and imply activation only for Chinese phrasing, with no indication that other languages are supported or that the locale restriction is intentional. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.