T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_weekly_report.sh:26- Finding
Arbitrary Python Code Execution Through the Output Directory Argument
- Content
View full analysis
- Remediation
View remediation
Security audit
weekly-ai-news
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but a script accepts an output path in a way that can execute arbitrary Python code if the path is attacker-controlled.
Review this skill before installing. Use only trusted, simple output paths, do not pass paths supplied by others, and avoid enabling cron or Feishu sending until the output-path code injection bug is fixed. Treat generated report links as untrusted external links from RSS feeds.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_newspaper.py:447- Finding
Unsafe URL Schemes Accepted in Links Generated from Remote RSS Data
- Content
View full analysis
{escape_html(headline["title"])} ``` ```python {escape_html(news["title"])} ``` The latter pattern occurs at lines 470, 485, and 500. The helper used for these values performs HTML escaping only: ```python def escape_html(text): """Escape HTML special characters to prevent XSS""" if not text: return "" return html_mod.escape(str(text), quote=True) ``` ### Technical Analysis HTML attribute escaping prevents an RSS link from terminating the `href` attribute and injecting additional markup. It does not, however, make the URL itself safe. The `link` value originates in externally retrieved RSS or Atom documents and is preserved in `fetch_rss.py` without protocol validation. A compromised or malicious feed can provide a URL using an active or otherwise unsafe scheme, such as `javascript:` or a crafted `data:` URL. The generator escapes the string and places it directly into an `href`. The resulting behavior depends on browser security policy and the context in which the generated report is opened. Some browsers restrict active URLs in local files, but this is not a reliable security boundary. The report can also be hosted or opened in a context where such links are active. The links use `target="_blank"` without `rel="noopener noreferrer"`. In browser environments that do not implicitly apply `noopener`, the opened page may receive access to `window.opener` and attempt reverse-tabnabbing. ### Attack Path 1. An attacker compromises one of the configured RSS sources, ...[truncated 1303 chars]- Remediation
View remediation
' f'{escape_html(news["title"])}' ) else: rendered_link = escape_html(news["title"]) ``` Apply the same validation to every headline, main-column, center-column, and sidebar link. Additional hardening should include: 1. Allow `http` only if compatibility requires it and the associated integrity risks are accepted. 2. Reject `javascript`, `data`, `file`, `vbscript`, and unknown schemes. 3. Require a nonempty hostname. 4. Add `rel="noopener noreferrer"` to every link using `target="_blank"`. 5. Test mixed-case schemes, leading whitespace, encoded control characters, protocol-relative URLs, credentials in authorities, and malformed URLs. 6. Treat RSS content as untrusted even when feeds are configured statically, because publishers and delivery infrastructure can be compromised. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
这段代码与描述存在明显不完整对应。描述中的前半部分“自动抓取 RSS 订阅源的 AI 新闻，筛选应用向内容（剔除技术性太高的内容）”基本符合代码行为：代码会抓取多个 RSS/Atom 源，基于关键词筛选 AI 相关新闻，并过滤技术性较强的内容，还支持时间范围筛选和去重。但描述中的关键产出与集成功能——生成旧报纸风格的 HTML 简报、支持发送到飞书、用于每周自动/手动推送周报——在该代码块中完全没有体现。代码的实际职责更像是一个上游数据采集与过滤脚本，而不是完整的“周报生成与推送工具”。因此，若将该代码块视为对整个技能描述的实现，则描述高于实际能力，存在实质性不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents capabilities that read and write local files and access external RSS feeds, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can lead to over-broad execution context, making it harder for users or the platform to understand and constrain what the skill is allowed to access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documentation encourages sending generated content to Feishu and shows a direct send command, but it does not prominently warn that this causes outbound transmission of locally generated data. In an automation context, users may unintentionally exfiltrate sensitive or internal information included in feeds, prompts, or generated summaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The scheduled examples configure unattended weekly execution that performs network fetches, creates files, and may send messages externally, yet the documentation lacks a clear warning about recurring background activity. Unattended runs increase the risk of unnoticed data transmission, persistent file accumulation, and execution in environments where network actions require review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language strings throughout the script indicate the tool is fixed to Chinese output, including the title, usage description, and HTML locale. Under the policy, forcing a specific language/locale without user opt-in is a reportable natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's comments and all user-facing status/output strings are in Chinese, including usage-adjacent messaging and completion instructions. This imposes a specific language on users without any visible opt-in or alternative locale handling, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest description specifies the skill in Chinese and presents the generated weekly report workflow as Chinese-language oriented, but does not indicate that users can choose another language or that the locale is intentionally restricted for a specific region. Under SQP-3, forcing a specific language without opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring presents the skill entirely in Chinese ("RSS 抓取脚本 - 获取 AI 新闻" and usage text) with no indication that other languages are supported or that Chinese is a deliberate, documented locale constraint. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.