T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned and Unnecessary Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
BBC Vietnamese Trendy News
Security checks for vulnerabilities and agentic risk
Overview
This news skill appears non-destructive, but it overstates its news coverage and runs local code plus unpinned package installs for broad news requests.
Review before installing. This skill does not show exfiltration or destructive behavior, but users should expect it to run a local Python script, fetch BBC Vietnamese RSS content, and install mutable Python dependencies. It should be tightened by accurately describing its source and locale, pinning and reducing dependencies, and treating fetched RSS entries as untrusted external reports rather than verified data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:15- Finding
Remote RSS Content Is Incorrectly Treated as Verified Agent Input
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims to provide latest global or breaking news, but the instructions indicate it uses a specific BBC Vietnamese source and undisclosed network behavior. This mismatch can mislead users and reviewers about both the breadth of content and the external access being performed, increasing the risk of unauthorized or unexpected data retrieval.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes a Python script that fetches external news content, which implies network access, but it declares no permissions or allowed-tools scope. This weakens policy enforcement and transparency, making it easier for the skill to perform external data access without explicit review or user expectation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill hardcodes BBC News Tiếng Việt as the source without asking the user to opt into that locale or language preference. While not inherently malicious, this can produce misleading or inappropriate results for users expecting general global news in another language, and it obscures the actual source constraints.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation condition covers generic requests for latest or trending news, which are common and can cause the skill to run in many normal conversations without clear user intent for external fetching. Broad triggering increases the chance of unnecessary subprocess and network execution, expanding exposure and making misuse or surprise activation more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to execute a subprocess through conda/python without any user-facing notice that code will run and external content will be fetched. Hidden execution reduces informed consent and auditability, and if the runtime or script is modified, the agent may execute unintended behavior under the guise of a routine news request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file hard-codes Vietnamese content sources and emits mixed Vietnamese/English user-facing text, including Vietnamese error/log strings and a Vietnam-specific BBC RSS feed URL. There is no option for the user to choose language or locale, which creates a natural-language policy concern under the language/locale rule.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency is declared without a version pin, which makes builds non-reproducible and can cause the environment to resolve to vulnerable or incompatible releases over time. In a news-fetching skill that relies on external parsing libraries, this increases supply-chain risk even if no specific exploit is proven from this file alone.
- Content
text beautifulsoup4 bs4 requests feedparser
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The bs4 requirement is unpinned, so installations may pull different versions at different times, reducing reproducibility and making it harder to verify whether known security fixes are present. This is a supply-chain hygiene issue rather than direct malicious behavior.
- Content
text beautifulsoup4 bs4 requests feedparser
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Requests is unpinned, which means deployments may resolve to a release containing known vulnerabilities or behavioral regressions. Because this skill fetches remote content from the internet, leaving the HTTP client version unconstrained increases exposure to request-handling flaws and credential-leak bugs.
- Content
text beautifulsoup4 bs4 requests feedparser
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The file declares requests without a version, and that package has multiple known advisories across releases. Because the version is unverifiable, it is impossible to determine from this manifest whether a safe or vulnerable release will be installed, which is especially relevant for a skill that makes outbound network requests.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Feedparser is unpinned, so the installed version may vary and could include releases affected by known parsing-related vulnerabilities. Since this skill processes external news feeds, an outdated or vulnerable parser could increase risk from maliciously crafted feed content.
- Content
text beautifulsoup4 bs4 requests feedparser
Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Feedparser has known historical advisories, but this manifest does not pin a version, so a vulnerable release could be installed without visibility. In a news skill that ingests untrusted external feeds, parser vulnerabilities are more concerning because attackers may control feed content.
- Content