Security audit

local-model-router

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but its documentation overstates capabilities and requests trust for services and credentials that the shipped code does not actually implement.

Review this before installing. Use it only with public RSS feeds unless translation is disabled or clearly understood, do not provide API tokens unless the implementation is updated to use them safely, and treat generated Markdown as untrusted content when opening it in rich renderers. The package should be corrected to match its documentation, disclose third-party translation, sanitize feed content, and pin dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch-news.py:35
Finding: Untrusted RSS Content Is Written to Markdown Without Sanitization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependency Set Is Unpinned, Unhashed, and Missing a Runtime Dependency
Content: View full analysis
=6.0.0 requests>=2.31.0 python-dateutil>=2.8.0 ``` ```python try: from deep_translator import GoogleTranslator translator = GoogleTranslator(source='auto', target='zh-CN') ``` The same undeclared import pattern is present in `scripts/daily-digest.py`. ### Technical Analysis The dependency declarations use open-ended lower bounds and provide no package hashes. Consequently, two installations performed at different times can resolve to different package versions. Installation therefore depends on mutable package-index state rather than a reviewed, reproducible dependency set. Python packages and their build systems may execute code during installation. If a permitted future release or a transitive dependency is compromised, users following the documented installation procedure could install attacker-controlled code. In addition, the scripts import `deep_translator`, but `deep-translator` is absent from `requirements.txt`. Broad exception handling hides this deployment defect and silently returns untranslated input. Users may respond by manually installing an arbitrary version outside the project's reviewed dependency process. This finding does not establish that any currently declared package is malicious. It identifies a supply-chain hardening weakness and an incomplete dependency manifest. ### Attack Path 1. A user follows the documented instruction to install packages from `requirements.txt`. 2. The package installer resolves the latest versions satisfying the open-ended constraints. 3. A compromised or unexpectedly incompatible future direct or transitive release is selected. 4. Package installation or import executes code supplied by that re ...[truncated 895 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims broad multi-source collection and summarization, but the reported code behavior only handles RSS while also performing translation and local file writes that are not disclosed in the description. Hidden or overstated capabilities are dangerous because users may authorize the skill under false assumptions about what data is collected, transmitted, or stored.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims broad multi-source collection and summarization, but the reported code behavior only handles RSS while also performing translation and local file writes that are not disclosed in the description. Hidden or overstated capabilities are dangerous because users may authorize the skill under false assumptions about what data is collected, transmitted, or stored.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documentation declares file-read and file-write capable behavior but does not define any tool scope or permission boundary. In an agent setting, missing explicit scoping increases the chance of over-broad filesystem access, unexpected reads/writes, or unsafe execution assumptions by users and orchestrators.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown omits a clear warning that the skill sends requests to multiple external services and may transmit query content, fetched data, or credentials off-system. In a news-digest workflow this increases privacy and token-handling risk because users may provide API keys or input topics without realizing that third parties will process the data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and all user-facing documentation are written only in Chinese, with no indication that language can be selected or changed. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language description and implementation indicate mandatory Chinese translation and output, including target='zh-CN' and Chinese-only digest fields. This enforces a specific language/locale without any user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends feed titles and summaries to GoogleTranslator, which discloses third-party content to an external service without any explicit notice, consent, or configuration control. In this skill context, news feeds are usually public, so the risk is reduced, but private/internal feeds or sensitive source URLs could still leak content externally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script hard-codes translation target 'zh-CN' and the surrounding strings/docstrings indicate the output is intended to be Chinese. This enforces a specific language/locale behavior without offering the user any choice or opt-in, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a skill that collects tech news from RSS, Twitter, GitHub, and Web Search, then generates a combined summary. In this file, the main loop explicitly processes only sources whose type is "rss", with no code handling Twitter, GitHub, or web search inputs, creating a clear mismatch between the stated capability and actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This text digest is primarily presented in Chinese, but several headlines and summaries remain in English, with no indication that the user opted into mixed-language output or that the digest is region-specific. That creates a natural-language policy concern under the language/locale rule because the file effectively forces a mixed presentation without documented choice or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The instructions show writing output to /tmp/td-merged.json but do not explicitly warn users that the pipeline persists fetched and summarized content to disk. Undisclosed persistence can expose potentially sensitive queries, article selections, or generated summaries to other local users, backup systems, or later processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This JSON manifest defines multiple enabled external RSS URLs, which implies the skill will make outbound network requests and transmit system metadata such as IP address and request headers to third-party services. Because this is a manifest file, there is no visible user warning, comment, or disclosure here describing that behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JSON config contains user-facing text in Chinese alongside English, such as the label and description for the LLM topic. Because the file does not indicate that users can choose their language or that the locale is intentionally region-specific, it may impose a language/locale experience without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The AI Agent topic description is presented in Chinese while the surrounding configuration is mixed-language. Without any accompanying note that this configuration is for a Chinese-speaking audience or that language choice is configurable, this can conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The coding topic label and description are user-facing strings in Chinese, but the file provides no indication that users selected this locale or that the skill is region-specific. This may constitute a language/locale policy issue where the experience is constrained without documented choice.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a lower-bound constraint only, which makes builds non-reproducible and allows installation of different versions over time. In a skill that aggregates untrusted external content from RSS, Twitter, GitHub, and web search, supply-chain exposure matters because an unexpected or vulnerable upstream release could be pulled in during deployment.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
feedparser>=6.0.0 requests>=2.31.0 python-dateutil>=2.8.0

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The manifest references feedparser without pinning a version, and the package has multiple historical advisories. That does not prove the deployed version is vulnerable, but it does mean the project cannot demonstrate it is using a safe release; in a news-ingestion skill that parses untrusted feeds, this uncertainty is more relevant because malformed external content may directly exercise parser bugs.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: requests>=2.31.0 permits any newer version, so the installed package may vary across environments and time. Because this skill fetches data from external network sources, using an unpinned HTTP client increases supply-chain and patch-verification uncertainty, including the possibility of pulling a release later found to be flawed.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
feedparser>=6.0.0 requests>=2.31.0 python-dateutil>=2.8.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The manifest does not pin requests, so despite known advisories affecting some releases, there is no reliable way to verify whether the installed version is safe. This is meaningful in context because the skill performs outbound HTTP requests to multiple external sources, making the security properties of the HTTP client materially important.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: python-dateutil>=2.8.0 is also unpinned, creating the same reproducibility and supply-chain uncertainty as the other entries. While this package is less obviously exposed than the network-facing libraries, permitting arbitrary newer versions still weakens build integrity and complicates vulnerability management.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
feedparser>=6.0.0 requests>=2.31.0 python-dateutil>=2.8.0

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description says the skill fetches tech news from RSS, Twitter, GitHub, and Web Search, then generates a summary. In this file, the source loop explicitly filters to sources where type == "rss", so the implemented behavior is narrower than the claimed multi-source capability.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The description suggests integrated summarization across multiple fetched sources. Here, the code formats up to 10 RSS items and writes each item's translated/truncated summary into a text file, which is more of a compiled digest than a synthesized summary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The code saves both a JSON file and a text digest to disk, but there is no prior warning in comments, docstrings, or user-facing output that files will be created or overwritten. For a code-file review, file writes should have some visible disclosure unless clearly documented as part of the skill behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all article titles and summaries in Chinese, including translated headings and descriptions, with no indication that the language was user-selected or that the skill is intended for a Chinese-only audience. The policy specifically flags language or locale constraints when a specific language is imposed without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This JSON data includes bilingual fields such as "title" and "title_cn", but several summary fields remain in English while most localized content is Chinese. Because SQP-3 applies to all file types, this presents a language/locale policy concern if the skill implicitly serves mixed-language content without explicit user opt-in or a documented locale scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.