mar-daily-news

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:18 AM UTC
• Version: 1.0.0

Overview

This news skill matches its stated purpose, but users should know it sends requests to SkillBoss and installs an unpinned Python dependency.

Install only if you are comfortable giving the skill a SkillBoss API key and sending news queries/page content to SkillBoss. For stronger hygiene, pin requests to a reviewed version and treat returned headlines as untrusted external content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Allows Uncontrolled Supply-Chain Changes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: daily_news.py:32

Finding

Untrusted Remote Content Is Processed and Returned Without Output Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tainted flow: 'SKILLBOSS_API_KEY' from os.environ (line 13, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · daily_news.py (reported line 18)May include surrounding context.

python

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill can execute Python, access environment variables, and make network-backed requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability, making it easier for the skill to use broader capabilities than a caller may expect, especially since it also depends on an API key and external data retrieval.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · daily_news.py (reported line 14)May include surrounding context.

python

sys.stdout.reconfigure(encoding='utf-8')

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"


def pilot(body: dict) -> dict:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · daily_news.py (reported line 18)May include surrounding context.

python

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code posts data to an external service via requests.post, including scraped page content and search/chat inputs, but the file provides no print, prompt, docstring, or comment warning the user that external network transmission occurs. For a code file, outbound HTTP calls that transmit data should have some visible disclosure unless clearly surfaced elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt sent to the chat API is written entirely in Chinese, forcing Chinese-language processing/output behavior. The policy requires avoiding fixed language constraints unless the user is given a choice or the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The returned greeting and formatting are fixed to Chinese and explicitly reference Beijing time, imposing a specific language/locale on all users. There is no indication that users can select a language or that the locale restriction is intentionally limited to a region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest metadata requires PYTHONIOENCODING=utf-8, which imposes a specific encoding setting. While UTF-8 is common, this is still a locale/encoding constraint and the file provides no user opt-in or justification for why this setting must be enforced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to fetch news through an external API hub and return the output directly, but it does not warn the user that prompts or request context may be transmitted to a third-party service. While expected for a news-fetching skill, the lack of disclosure can cause unintended data exposure if user-specific context is included in the request path or query.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill reads SKILLBOSS_API_KEY from environment variables, which is credential access, but there is no nearby disclosure, docstring, or user-facing message explaining this dependency. Under the code-file criteria, sensitive environment-variable access should not be silent when no other warning is present in the file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as just requests without an exact version or constrained range, making builds non-reproducible and allowing installation of different releases over time. This can silently introduce vulnerable or breaking versions into the skill, especially since the skill performs network access to external news sources.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Because requests is unpinned, there is no way to verify whether the installed version includes fixes for known advisories affecting older releases. In a skill that fetches remote content from external sources, an outdated HTTP client can increase risk of credential leakage, TLS/verification issues, or other request-handling flaws depending on deployment behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.