Security audit

舆情监测智能体V2

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a Chinese tech-news report skill, but it needs review because it can automatically send reports to Feishu and its HTML report generator handles untrusted news content unsafely.

Before installing, confirm that you want this skill to search public web sources, create local HTML reports, and send them to Feishu. Use a fixed or approved Feishu destination, preview reports before sending, treat the financial recommendations as draft analysis, and fix HTML escaping plus filename validation before using it with untrusted news data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: generate_html.py:199
Finding: Stored HTML and JavaScript Injection in Generated News Reports
Content: View full analysis

{ann_type}: {title}

{ann_date}
''' ``` ```python html += f'''

{i}{title}
{score}分

📮 {source} 🕐 {time_ago}

{news.get("summary", "")}

{url}

''' ``` ```python if analysis.get("ai"): html += f'''

🤖 AI行业分析

{analysis["ai"]}

''' if analysis.get("hongmeng"): html += f'''

📱 鸿蒙行业分析

{analysis["hongmeng"]}

''' caixun = analysis.get("caixun", {}) if caixun: html += '''

🏢 彩讯股份(300634)分析研判
''' if caixun.get("opportunities"): html += '
🎯 机遇
' for item in caixun.get("opportunities", []): html += f'
{item}
' html += '
' if caixun.get("risks"): html += '
⚠️ 风险
' for item in caixun.get("risks", []): html += f'
{item}
' html += '
' if caixun.get("recommendations"): html += '
💼 投资建议
' for item in caixun.get("recommendations", []): html += f'
{item}
' html += '
' ``` ...[truncated 2377 chars]
Remediation: View remediation
``` 6. Add tests containing hostile values such as closing tags, quoted attribute payloads, event handlers, and dangerous URL schemes. Verify that all payloads are rendered as inert text or rejected. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: generate_html.py:278
Finding: Path Traversal and Arbitrary File Overwrite Through Report Filename
Content: View full analysis
str: filepath = f"/workspace/news-agent/{filename}" with open(filepath, 'w', encoding='utf-8') as f: f.write(html) return filepath ``` ### Technical Analysis The `filename` argument is appended directly to the intended output directory. The function does not require a basename, normalize the resulting path, reject parent-directory components, or verify that the resolved destination remains under `/workspace/news-agent`. A caller able to influence `filename` can use values containing `../` to escape the report directory. The file is opened in write mode, so an existing destination is truncated and replaced with attacker-supplied `html` content. Exploitability and the set of writable targets depend on the operating-system permissions of the agent process. ### Attack Path 1. An attacker gains influence over the value passed as `filename` to `save_html()`. 2. The attacker supplies a traversal value such as `../../tmp/attacker-report.html` or a path targeting another writable application file. 3. The string is concatenated to `/workspace/news-agent/` without containment validation. 4. The operating system resolves the parent-directory components outside the intended report directory. 5. `open(..., "w")` creates or truncates the resolved target and writes attacker-controlled report content. The current standalone example uses the default filename, so exploitation requires another caller or future integration to expose control over this argument. The vulnerable function itself nevertheless accepts unrestricted input. ### Impact Assessment An attacker can create or overwrite files accessible to the process outside the intended report directory. Potential effects include c ...[truncated 349 chars]
Remediation: View remediation
str: if Path(filename).name != filename: raise ValueError("The report name must be a basename") if not filename.lower().endswith(".html"): raise ValueError("The report name must use the .html extension") OUTPUT_DIR.mkdir(parents=True, exist_ok=True) destination = (OUTPUT_DIR / filename).resolve() if destination.parent != OUTPUT_DIR: raise ValueError("The report path is outside the output directory") destination.write_text(html, encoding="utf-8") return str(destination) ``` 3. If callers do not need to select the output name, remove the `filename` parameter and use a fixed server-controlled filename. 4. Run the generator under a dedicated least-privileged account with write permission only to the report directory. 5. Consider atomic writes through a temporary file created inside the validated output directory, followed by an atomic rename. Use exclusive creation when overwriting existing reports is not intended. 6. Add tests for `../`, nested paths, absolute paths, symbolic-link edge cases, alternate separators, and encoded traversal representations. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 代码与描述部分一致之处包括：五类分类（AI/算力/协同办公/鸿蒙/彩讯股份）、四维评分框架、生成带评分与分析内容的H5页面。但从实际代码看，核心行为是对传入的 news_data 进行评分、过滤、HTML渲染并保存文件。它没有任何网络请求、搜索/爬虫逻辑，因此并未完成“每日科技新闻爬取”；也没有任何飞书 API、Webhook 或消息发送逻辑，因此未实现“推送至飞书”；同时没有处理“/news”或“新闻爬取”触发词的代码。由于声明把爬取和推送描述为主要功能，而代码仅覆盖其中的页面生成与评分子集，因此描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares file-writing behavior via H5 generation but does not define any explicit tool scope such as allowed-tools or permissions. Missing least-privilege constraints makes it easier for a runtime or future implementation to grant broader filesystem access than intended, increasing the risk of unauthorized file creation or overwrite.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs sending content to Feishu users but provides no user-facing notice, confirmation, or disclosure about outbound transmission. In a news-monitoring context, generated summaries and links could include sensitive internal analysis or recipient mistakes, causing unintended data sharing to external messaging channels.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file's description and generated UI text are entirely fixed in Chinese, including the HTML lang attribute set to zh-CN and all user-facing labels. There is no indication that the user can choose language or that the locale restriction is explicitly documented as a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 技能清单将用途限定为科技新闻爬取、四维评分、生成带评分和分析的 H5 页面，以及推送到飞书；虽然提到“分析研判板块”，但这里明确输出“投资建议”列表，已从舆情/新闻分析扩展到投资决策建议。该能力具有不同的业务含义和风险边界，不能从普通新闻监测目的中直接推出。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document title and all output requirements are written as mandatory Chinese-language rules for the skill, with no indication that users may choose another language or locale. This creates a natural-language policy issue because it appears to enforce a specific language without opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file uses Chinese-only headings and instructions throughout, which can amount to a language/locale constraint in the skill's natural-language configuration. The policy allows fixed locale behavior only when it is explicitly documented and justified or when the user is given a choice; neither is present here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Manifest 描述聚焦于五类新闻搜索、评分、H5 页面和飞书推送，没有提到股票价格、涨跌幅或创业板指数展示。该文件在“彩讯股份”栏目中加入了股价与指数信息，属于对输出内容范围的额外扩展，而非新闻评分所必需的实现细节。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code writes generated HTML to /workspace/news-agent/{filename}, which affects local user/system data, but there is no confirmation prompt and no docstring or comment warning about this side effect on the save_html function. The final print only reports completion after the write, so it does not disclose the action before it occurs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown instructions and scoring rules are presented only in Chinese, and the file does not offer an alternative language option or note that the skill is intended exclusively for Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

{ann_type}: {title}

🤖 AI行业分析

📱 鸿蒙行业分析

🏢 彩讯股份(300634)分析研判

🎯 机遇

⚠️ 风险

💼 投资建议

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Undeclared Tool Scope

Missing User Warnings

Natural-Language Policy Violations

Description-Behavior Mismatch

Natural-Language Policy Violations

Natural-Language Policy Violations

Description-Behavior Mismatch

Missing User Warnings

Natural-Language Policy Violations

Static analysis