Generate News Article

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:17 PM UTC
• Version: 1.0.0

Overview

The skill is understandable as a news-article generator, but its bundled script has unsafe and under-disclosed credential, path, and input-handling behavior that needs review before installation.

Review before installing. Do not run this skill as-is with privileged workspace access. The embedded SerpAPI key should be removed and rotated, the script should use a user-supplied secret only, output paths should be configurable and workspace-local, inputs should be passed to Python as data rather than generated code, and image downloads should be restricted and size-limited.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.sh:38

Finding

Hardcoded SerpAPI Credential Embedded in Source Code

Content

View full analysis

" python3 "$SERPAPI_SCRIPT" google "$KEYWORD" --num "$NUM_RESULTS" > "$TEMP_JSON" 2>&1 ``` The source contains a complete SerpAPI API key in place of the redacted value above. ### Technical Analysis A live-looking SerpAPI credential is embedded directly in a distributed shell script. Anyone who can read the skill package, a source repository containing it, a backup, or an installed copy can recover the credential without needing access to the intended secret-management system. The inline assignment also overrides any `SERPAPI_API_KEY` value configured by the user for that command. This conflicts with the documented configuration model and prevents operators from controlling which credential is used. Removing the credential from the current version is insufficient if it has already been published or committed, because it may remain available in package archives, caches, logs, or version-control history. ### Attack Path 1. An attacker downloads or otherwise obtains a copy of the skill package. 2. The attacker opens `scripts/generate.sh`. 3. The attacker extracts the hardcoded value assigned to `SERPAPI_API_KEY`. 4. The attacker submits requests to SerpAPI using the exposed credential. 5. Requests consume the associated account's quota and may cause financial or operational impact until the credential is revoked. ### Impact Assessment The attacker gains the ability to authenticate to SerpAPI with the exposed account credential. The scope is limited to the permissions and quota assigned to that key, but may include: - Unauthorized consumption of paid API quota. - Exhaustion of quota needed by legitimate workflows. - Charges against the credential owner's account. - Access to any SerpAPI capabilities authorized for the ...[truncated 184 chars]

Remediation

View remediation

&2 exit 1 fi SERPAPI_API_KEY="$SERPAPI_API_KEY" \ python3 "$SERPAPI_SCRIPT" google "$KEYWORD" --num "$NUM_RESULTS" \ > "$TEMP_JSON" 2>&1 ``` 3. Prefer a platform secret store or credential manager over plaintext configuration files. 4. Purge the exposed value from version-control history, release archives, package registries, build artifacts, and logs where feasible. 5. Add automated secret scanning to commits and release pipelines. 6. Restrict the replacement key's permissions and quota to the minimum required by this skill. 7. Monitor the affected account for unauthorized historical usage. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.sh:62

Finding

Arbitrary Python Code Execution Through Heredoc Argument Interpolation

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi KEYWORD="$KEYWORD" \ NUM_RESULTS="$NUM_RESULTS" \ OUTPUT_DIR="$OUTPUT_DIR" \ ASSETS_DIR="$ASSETS_DIR" \ TEMP_JSON="$TEMP_JSON" \ python3 <<'PYTHON_SCRIPT' import json import os keyword = os.environ["KEYWORD"] output_dir = os.environ["OUTPUT_DIR"] assets_dir = os.environ["ASSETS_DIR"] num_articles = int(os.environ["NUM_RESULTS"]) temp_json = os.environ["TEMP_JSON"] with open(temp_json, "r", encoding="utf-8") as f: data = json.load(f) PYTHON_SCRIPT ``` Key hardening measures are: 1. Quote the heredoc delimiter so that shell expansion is disabled. 2. Transfer values through environment variables, command-line arguments, or standard input. 3. Validate `NUM_RESULTS` as a bounded positive integer before invoking Python. 4. Continue treating `KEYWORD` as arbitrary text; do not attempt to secure source interpolation with incomplete character blacklists. 5. Add regression tests using quotation marks, backslashes, command substitutions, newlines, and Unicode in the keyword. 6. Run the skill with least privilege to reduce the consequences of future injection flaws. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.sh:91

Finding

Unrestricted Retrieval of Search-Result-Controlled Image URLs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose is simple article generation, but the behavior described by the finding includes use of undeclared credentials, access to fixed absolute paths outside the skill directory, and invocation of an external helper from another location. Those hidden behaviors create supply-chain and data exposure risk because the skill can depend on uncontrolled code and touch filesystem locations beyond the expected workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script silently uses an embedded credential without any disclosure to the user, so operators may unknowingly run code that consumes someone else's API account or exfiltrates privileged access material through source sharing and execution. The article-generation purpose does not justify undisclosed bundled credentials; in fact, distributing a working secret inside an automation skill makes misuse easier because users are encouraged to execute it as-is.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README is written as if the skill operates in Chinese and examples use Chinese output/input terms, but there is no indication that users may choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a skill implicitly forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises behavior that requires file reads/writes and network access, but it does not declare any tool scope or permissions. This weakens reviewability and containment because an operator cannot clearly see or restrict the capabilities the skill expects before execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The primary descriptive instruction text is presented in Chinese, which can impose a language requirement on users without consent or alternative locale support. The policy requires avoiding forced language or locale constraints unless the user is offered a choice or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script hardcodes a live SerpAPI credential directly in source and uses it at runtime, which exposes the secret to anyone with file access, version control history, logs, backups, or downstream redistribution of the skill. In this context the secret is not merely configuration metadata: it enables third-party API consumption under the owner's account, leading to quota theft, billing abuse, and possible broader account compromise if reused elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown states that thumbnails are automatically downloaded into an assets/ directory, and elsewhere the README explains that article files are generated under an output directory. While these behaviors are part of the skill's function, the documentation does not clearly warn users up front that running the skill will create multiple files and perform network downloads into the local workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes that the skill generates independent Markdown files and automatically downloads thumbnails, which affects user data and workspace contents. Although the behavior is described functionally, there is no clear caution or warning to the user about filesystem changes or downloaded external content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.