新闻订阅每日简报

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent news-briefing automation, but it asks users to use a sensitive Twitter/X browser session token with an unpinned third-party package and even suggests storing the token in source code.

Review carefully before installing. Use a dedicated low-privilege Twitter/X account, pass the token only through a protected environment variable or secret manager, never edit it into source code, pin and verify Scweet and its dependencies, and require confirmation before the skill changes tracked bloggers or automation prompts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/fetch_tweets.py:68

Finding

Unpinned Third-Party Dependency Receives a Reusable Twitter/X Session Token

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_tweets.py:62

Finding

Instructions Permit Plaintext Twitter/X Session Token Storage in Source Code

Content

View full analysis

F12 -> Application -> Cookies -> auth_token AUTH_TOKEN = os.environ.get("TWITTER_AUTH_TOKEN", "YOUR_AUTH_TOKEN_HERE") ``` The runtime error explicitly recommends editing the credential into the source file: ```python if AUTH_TOKEN == "YOUR_AUTH_TOKEN_HERE": print("ERROR: Please set your Twitter auth_token.", file=sys.stderr) print("Either set TWITTER_AUTH_TOKEN env var or edit AUTH_TOKEN in this script.", file=sys.stderr) sys.exit(1) ``` The setup documentation similarly directs users to obtain a browser cookie: ```markdown - `AUTH_TOKEN`: Your Twitter/X auth_token (get from browser: login to x.com, F12, Application, Cookies, auth_token) ``` ### Technical Analysis The script supports retrieving the token from the `TWITTER_AUTH_TOKEN` environment variable, which avoids placing the secret directly in source code. However, it also explicitly recommends editing the token into the script. A Twitter/X `auth_token` is reusable session authentication material rather than a harmless configuration value. Storing it in source code increases the probability of disclosure through source-control commits, patches, backups, shared archives, code review systems, synchronization services, or accidental publication. The repository currently contains only the placeholder `YOUR_AUTH_TOKEN_HERE`; no live credential was found during the audit. The vulnerability is therefore in the prescribed credential-handling practice rather than an already committed secret. ### Attack Path 1. A user follows the error message or setup guidance and replaces `YOUR_AUTH_TOKEN_HERE` with a live Twitter/X session token. 2. The modified script is committed to version co ...[truncated 855 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code chunk implements only one subset of the declared system: collecting recent tweets from configured accounts via Scweet. It does not generate summaries, assign star ratings, send briefings to Feishu/Lark, perform scheduling, or implement any fallback retrieval method such as WebSearch. While tweet fetching is consistent with part of the description, the actual behavior is materially narrower than the declared end-to-end automated briefing system, so this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells users to obtain and use a Twitter/X auth_token from browser cookies, which is a sensitive session credential equivalent to account access. Without strong warnings, secure storage guidance, and scope minimization, the token could be leaked through logs, prompts, scripts, or local files, enabling account compromise or unauthorized scraping activity.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to write files, read local state, and use credentials/tokens, yet it declares no explicit tool scope or permission boundaries. In an automation context, this increases the chance of unintended file modification or secret exposure because the agent may be granted broader capabilities than users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The conversational trigger for adding bloggers is broad enough that normal dialogue could unintentionally cause persistent configuration changes. In a skill that edits source/config files and automation prompts, accidental activation could silently alter tracked accounts, poison future briefings, or introduce unwanted data sources.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/add-blogger.md (reported line 9)May include surrounding context.

md

> "Add Finance blogger example_handle"

The AI then automatically performs these three steps:

### Step 1: Update sources.yaml

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code reads a Twitter/X auth token from an environment variable and the module docstring instructs users to obtain it from browser cookies, which is a sensitive credential-handling operation. While the script documents how to supply the token, it does not include any warning about protecting the token, avoiding hardcoding it, or the security implications of extracting browser cookies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains a natural-language instruction that prefers a specific language/locale: 'translate to Chinese if preferred.' Under the policy, language constraints should offer explicit user choice or clear justification; this line introduces a locale preference without explaining who prefers it or ensuring user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.