WitPulse-redditnews

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:25 PM UTC
• Version: 1.0.7

Overview

This skill fetches public Reddit RSS headlines and stores them inside its own skill data folder, with no evidence of credential access, exfiltration, destructive behavior, or persistence beyond local cache/config files.

Before installing, understand that running the skill will execute local Python/shell scripts, contact Reddit RSS feeds for the configured subreddit list, and refresh a local headline cache in the skill folder. Review config.json if you want a narrower subreddit set or a different language default.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This mismatch specifically notes undeclared local file write behavior while the skill presents itself as a commentary generator. Hidden write capability increases risk because users may invoke the skill expecting passive analysis, not filesystem modification, which can affect local state or overwrite data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This mismatch specifically notes undeclared local file write behavior while the skill presents itself as a commentary generator. Hidden write capability increases risk because users may invoke the skill expecting passive analysis, not filesystem modification, which can affect local state or overwrite data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch specifically notes undeclared local file write behavior while the skill presents itself as a commentary generator. Hidden write capability increases risk because users may invoke the skill expecting passive analysis, not filesystem modification, which can affect local state or overwrite data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This mismatch specifically notes undeclared local file write behavior while the skill presents itself as a commentary generator. Hidden write capability increases risk because users may invoke the skill expecting passive analysis, not filesystem modification, which can affect local state or overwrite data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises executable scripts that perform network access and likely file operations, but the manifest does not declare any tool scope or permissions. This weakens least-privilege controls and makes it harder for users or agents to assess what the skill is allowed to do before execution.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: SQP-3 covers natural-language policy violations such as forcing a specific language without user opt-in. The description says the skill generates commentary in a specific Chinese style, and the sample configuration at L23 fixes the language to zh-CN, but the document does not present this as optional or justify a region-specific constraint.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to run a Python fetcher and a shell pipeline without warning about external network access or shell execution. Hidden execution and connectivity assumptions increase the chance of unsafe use, especially in agent environments where shell commands and outbound requests carry meaningful risk.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest says the skill proactively senses Reddit technology hot topics, but the configured sources include several clearly non-tech communities such as fitness, health, movies, photography, running, gym, and weightlifting. This broadens the actual content domain beyond the stated tech-news purpose, creating a semantic mismatch between the claimed scope and the configured behavior.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The config sets "language": "zh-CN", which imposes a specific language/locale by default. Under the policy, fixed language behavior is a violation unless the skill offers user choice or clearly documents a justified region-specific constraint.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The installation script writes a default config with "language": "zh-CN", which imposes a specific language setting by default. This is a natural-language policy concern because the file does not present a user choice or explain a justified region-specific constraint.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The fallback configuration hard-codes the language to "zh-CN", which imposes a specific language/locale choice on users by default. This is a natural-language policy concern because the file does not offer language selection or document a justified region-specific constraint.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a proactive Reddit tech-hotspot sensing skill that combines current conversation context and produces sarcastic/humorous commentary. In this file, the implemented behavior is limited to retrieving RSS entries from configured subreddits and storing raw title-link pairs in prepared_quotes.md, with no use of conversation context and no commentary generation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code fetches data from external Reddit RSS endpoints via HTTP and writes processed results to a local file, but there is no confirmation prompt, print/log disclosure, or inline warning to inform the user that network access and file modification will occur. These are safety-relevant side effects for a code file under the missing user warnings rule.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: A fixed locale in user-facing documentation can amount to a language policy violation when no opt-in or alternatives are presented. Here the example config sets `language` to `zh-CN`, and the surrounding text does not clarify that other languages are supported or that this is merely an example.

Static analysis

No suspicious patterns detected.