T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:42- Finding
Unscoped Persistent Storage of User Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily News Vnexpress
Security checks for vulnerabilities and agentic risk
Overview
The skill fetches VNExpress RSS news as described, but it also tells the agent to persist undefined user behavior in a local USERS.md file, which is broader than a news-fetching skill needs.
Review before installing. The news-fetching script itself is narrowly aimed at VNExpress RSS feeds, but the skill should remove or strictly gate the USERS.md behavior logging instruction, ask for explicit consent before storing preferences, and pin dependencies before routine use.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unpinned and Redundant Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The markdown explicitly instructs the agent to write user behavior to USERS.md without warning, consent, or disclosure. Silent persistence of user-related data is a significant privacy issue because users requesting news would not reasonably expect local profiling or logging as part of that interaction.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes a Python script that performs network access, but the manifest does not declare any tool scope, permissions, or allowed-tools boundaries. This creates an authorization and transparency gap: an agent may execute network-capable code without explicit least-privilege controls or user-visible disclosure of that capability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The description hard-codes VNExpress as the news source, and the instructions later restrict classification to a fixed Vietnamese topic list, which can impose a locale-specific source/taxonomy without user opt-in. The file does not explain this as a justified region-specific constraint or offer the user an alternative language/locale choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger 'latest news or trending global events' is broad and ambiguous relative to a single-source VNExpress RSS skill with a fixed topic taxonomy. Overbroad activation can cause the skill to run in contexts the user did not intend, leading to unnecessary network access and potentially invoking the unrelated logging instruction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to 'remember user behaviour and write to USERS.md' exceeds the stated purpose of fetching news and introduces unnecessary persistence of user data. This is dangerous because it enables silent collection of behavioral information unrelated to the user’s request, increasing privacy and data-retention risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill contains an unrelated file-writing and user-tracking instruction that is not necessary for retrieving RSS headlines. Because it is embedded in operational steps, an agent may carry out covert data logging as part of a routine news task, violating user expectations and purpose limitation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Retaining and recording user behavior in a file creates a natural-language data logging risk, especially in a skill whose purpose is only to fetch RSS headlines. The danger is amplified because the storage is framed as routine behavior, which can normalize unnecessary retention of potentially sensitive preference or interaction data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code explicitly reconfigures standard output to UTF-8, imposing a specific encoding behavior. This is a natural-language policy concern because the file contains a human-readable instruction comment and implementation that force a locale/encoding choice without offering the user an option or documenting a justified regional constraint.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The argparse description says 'Fetch latest news from BBC', while the implemented RSS template at L071 and overall logic clearly target https://vnexpress.net/rss/{topic}.rss. This is an active documentation contradiction about the source and intent of the skill.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency beautifulsoup4 is unpinned, which makes builds non-reproducible and can cause the environment to install a newer release containing breaking changes or a compromised version. While this file alone does not prove exploitation, leaving dependency versions unconstrained is a real supply-chain weakness.
- Content
text beautifulsoup4 bs4 requests feedparser
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The bs4 package entry is unpinned, so installations may resolve to different versions over time, reducing reproducibility and increasing supply-chain risk. This is especially relevant for agent skills that may be deployed automatically across environments.
- Content
text beautifulsoup4 bs4 requests feedparser
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The requests dependency is unpinned, and this package has multiple historical advisories; without a version pin, the deployment may install a vulnerable release. Because this skill fetches remote content over HTTP(S), a vulnerable HTTP client library increases the risk of credential leakage, TLS/verification issues, or other network-facing flaws.
- Content
text beautifulsoup4 bs4 requests feedparser
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Requests has known advisories, and because no version is pinned, there is no way to verify whether the installed package is affected. In this skill's context, that uncertainty is more dangerous because requests is used for fetching external news content, so any client-side network weakness directly touches untrusted remote endpoints.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The feedparser dependency is unpinned, and the package has a history of advisories; this creates uncertainty about whether deployments will receive a safe release. Since the skill consumes remote RSS data, parsing libraries are part of the attack surface, making version control more important than in a purely local utility.
- Content
text beautifulsoup4 bs4 requests feedparser
Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
Feedparser has multiple known advisories, and the lack of version pinning prevents verification that a safe version will be installed. Because the skill parses external RSS feeds, parser vulnerabilities are particularly relevant and can expose the system to maliciously crafted feed content.
- Content