Podcast Feed Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent podcast-feed API manager, but it needs review because it handles an API token unsafely and exposes delete operations without built-in confirmation.

Install only if you are comfortable giving the skill a huisheng.fm Agent token that can read and modify your podcast feeds. Use it in an isolated sandbox where other local processes cannot inspect command lines, and require explicit confirmation before update or delete actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_huisheng.sh:174

Finding

Bearer Token Exposed Through Process Command-Line Arguments

Content

View full analysis

/cmdline`. The risk is especially relevant in shared execution environments where multiple workloads run under the same operating-system account. TLS protects the token while it is transmitted to the API, but it does not prevent local disclosure through process metadata. ### Attack Path 1. A user invokes an authenticated command such as `list-feeds`, `create-feed`, or `delete-episode`. 2. The script launches curl with `Authorization: Bearer ` in its argument vector. 3. While curl is running, a concurrent local process with sufficient process-inspection privileges reads its command-line arguments. 4. The process extracts the bearer token from the authorization header. 5. The attacker reuses the token to send requests to `https://huisheng.fm/api`. ### Impact Assessment Successful exploitation exposes the user's personal huisheng.fm API bearer token. The att ...[truncated 420 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/run_huisheng.sh:171

Finding

API Response Temporary File Is Not Reliably Removed on Failure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 21)May include surrounding context.

Authorization: Bearer <HUISHENG_API_TOKEN>

text

The token is the personal Agent access token from the user's dashboard.

## Endpoints

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 29)May include surrounding context.

md

- `POST /feeds`
- `GET /feeds/{feedKey}`
- `PATCH /feeds/{feedKey}`
- `DELETE /feeds/{feedKey}`
- `GET /feeds/{feedKey}/config`
- `GET /feeds/{feedKey}/episodes`
- `POST /feeds/{feedKey}/episodes`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 35)May include surrounding context.

md

- `POST /feeds/{feedKey}/episodes`
- `GET /feeds/{feedKey}/episodes/{episodeId}`
- `PATCH /feeds/{feedKey}/episodes/{episodeId}`
- `DELETE /feeds/{feedKey}/episodes/{episodeId}`

All endpoints are user-scoped. A token can only access Podcast Feeds owned by the authenticated dashboard user.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/run_huisheng.sh (reported line 257)May include surrounding context.

sh

delete-feed)
    require_arg "${1:-}" "feed key"
    feed_key="$(urlencode "${1:-}")"
    request DELETE "/feeds/$feed_key"
    ;;
  get-feed-config)
    require_arg "${1:-}" "feed key"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/run_huisheng.sh (reported line 300)May include surrounding context.

sh

require_arg "${2:-}" "episode id"
    feed_key="$(urlencode "${1:-}")"
    episode_id="$(urlencode "${2:-}")"
    request DELETE "/feeds/$feed_key/episodes/$episode_id"
    ;;
  *)
    json_error "Unknown command: $command_name"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes shell and network capabilities but does not declare any explicit tool scope or permission boundaries in the skill manifest. That omission increases the chance an agent runtime grants broader execution than intended, making it easier for the skill to perform outbound API calls or shell actions without transparent policy review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

## Operating Rules

- Require `HUISHENG_API_TOKEN`; do not invent fallback token names.
- Do not ask the user for an API URL; use `https://huisheng.fm/api`.
- Treat all operations as user-scoped. A token can only access Podcast Feeds owned by the authenticated dashboard user.
- Keep JSON arguments as structured JSON. Use `--json-file` for long episode payloads.
- If a feed is not found, list feeds first instead of assuming the feed is global.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file lists DELETE operations for feeds and episodes, which can affect user data, but it does not include any warning about destructive or irreversible behavior. Under the markdown-specific warning criteria, descriptions that omit warnings about behaviors affecting user data or system integrity should be flagged.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_huisheng.sh (reported line 192)May include surrounding context.

sh

require_token

  if ! command_exists curl; then
    json_error "curl is required when bundled scripts are unavailable."
    exit 1
  fi

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The default prompt tells an agent to use the skill to inspect the user's podcast feeds, but it does not define when invocation is appropriate, what user confirmation is required, or any boundaries on read/write actions. In a tool-using agent environment, vague trigger scope can cause unintended invocation against user-scoped API credentials, increasing the chance of unnecessary data access or accidental feed modifications if the skill supports state-changing operations.

Content

No source excerpt is available for this finding.