Security audit

FreshRSS Reader

Security checks for vulnerabilities and agentic risk

Overview

This FreshRSS skill is purpose-aligned, but it handles API credentials in a way that can expose them if used with HTTP or logged URLs.

Review before installing. Use only with an HTTPS FreshRSS URL, avoid shared machines where process arguments may be observable, and prefer a version that authenticates without putting the API password in the URL. Rotate the FreshRSS API password if it may already have been used over HTTP or captured in logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/freshrss.sh:27
Finding: FreshRSS API credentials exposed through an unencrypted and unencoded authentication URL
Content: View full analysis
Remediation: View remediation
&2 exit 1 ;; esac ``` 2. Use the authentication endpoint's POST capability, if supported by the deployed FreshRSS version, instead of placing credentials in the query string. 3. Apply proper form encoding to both the username and password. Use `curl` facilities such as `--data-urlencode` rather than manually concatenating values. 4. Avoid exposing secrets in process arguments. Supply sensitive request data through standard input, a protected file descriptor, or another mechanism that does not place the expanded password in the command line. If a temporary credential file is unavoidable, create it with restrictive permissions, ensure reliable cleanup with `trap`, and never place it in a shared predictable path. 5. Add transport and HTTP error handling, for example `--fail-with-body --show-error --silent`, and configure reasonable connection and request timeouts. 6. Ensure reverse proxies and FreshRSS access logs do not record authentication request bodies or sensitive query parameters. Rotate the API password if URLs containing it may already have been logged. 7. Consider validating `FRESHRSS_URL` to reject embedded credentials, fragments, control characters, and unexpected URL forms before constructing `API_BASE`. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell scripts but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent or runtime may permit broader shell execution than intended, increasing the risk of command misuse, environment-variable exposure, or unsafe invocation patterns when the skill is called.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest describes a news-browsing/query skill, but the code requires and reads three environment variables including a username and API password. While authentication to FreshRSS is expected, direct environment-variable credential handling is an implementation capability beyond the manifest's stated purpose and is not disclosed there.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.