News Summary Voice

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:35 AM UTC
• Version: 1.0.1

Overview

This news-and-voice skill mostly matches its purpose, but it should go to Review because some listed feeds are misidentified or insecure and one optional audio command handles remote media unsafely.

Before installing, replace questionable or HTTP RSS feeds with verified HTTPS first-party sources, treat all feed content as untrusted text, require confirmation for broad news or voice requests, and avoid the /tmp audio download pattern unless it is hardened. Run sudo package installs only manually after reviewing what will be installed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29
• Finding: Unverified, Misidentified, and Insecure RSS Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29-35 **Vulnerability Type**: Untrusted third-party content sources and plaintext RSS transport **Risk Level**: Medium ### Complete Code Snippet ```markdown | AP News | https://rsshub.app/apnews/topics/apf-topnews | EN | ### 国内新闻（中文） | 来源 | RSS URL | 语言 | |------|---------|------| | 新华网 | https://www.rss臆.com/xml/Rss臆news.xml | ZH | | 人民网 | http://www.people.com.cn/rss/news.xml | ZH | ``` ### Technical Analysis The skill presents these endpoints as authoritative publisher feeds, but their trust properties are inadequate: - The AP News entry uses `rsshub.app`, a third-party aggregation service, rather than an AP-controlled domain. Compromise or manipulation of that intermediary could alter content attributed to AP. - The purported Xinhua endpoint uses the anomalous Unicode domain `www.rss臆.com`, which is not an official Xinhua domain. This resembles a misidentified or potentially deceptive source. - The People's Daily endpoint uses plaintext HTTP. A network-positioned attacker could intercept or modify the response because transport authenticity and integrity are not protected. RSS data is external, attacker-influenceable input. If an agent treats feed titles or descriptions as trusted instructions rather than inert news content, malicious feed data could also attempt indirect prompt injection. Even without instruction execution, manipulated content can be incorporated into generated briefings and falsely attributed to trusted publishers. ### Attack Path 1. An attacker controls or compromises a listed third-party endpoint, controls the anomalous domain, or obtains a network position capable of intercepting the plaintext HTTP feed. 2. The attacker returns fabricated titles, links, descriptions, or instruction-like text in a syntactically valid RSS document. 3. The skill retrieves the content while treating the endpoint as a trusted news source. 4. The agent summarizes or republishes t ...[truncated 878 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every feed with a verified, publisher-controlled HTTPS endpoint. 2. Remove the anomalous `www.rss臆.com` endpoint unless ownership and authenticity can be independently established. 3. Clearly identify third-party aggregators as intermediaries rather than presenting them as first-party feeds. 4. Replace the plaintext People's Daily URL with a verified HTTPS endpoint. Remove it if HTTPS is unavailable. 5. Maintain an allowlist of expected schemes and hostnames, and validate the final connection hostname before processing content. 6. Reject non-HTTPS feeds and unexpected cross-domain redirects. 7. Parse RSS with a hardened XML parser that disables external entities and applies response-size and processing limits. 8. Treat every feed field as untrusted data. Do not interpret titles, descriptions, or linked content as agent instructions. 9. Preserve source provenance in generated reports so users can distinguish first-party feeds from aggregators. 10. Periodically verify endpoint ownership, certificate validity, availability, and content consistency. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57
• Finding: Unsafe Audio Download and Playback Through a Predictable Temporary File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Unsafe temporary-file handling and unvalidated remote media processing **Risk Level**: Medium ### Complete Code Snippet ```bash curl -s "音频URL" -o /tmp/news.mp3 && afplay /tmp/news.mp3 ``` ### Technical Analysis The documented command downloads an unspecified remote resource to the fixed path `/tmp/news.mp3` and immediately processes it with `afplay`. The implementation lacks the following safeguards: - Enforcement of HTTPS. - An allowlist of trusted audio hosts. - Download-size and timeout constraints. - MIME type, file signature, or audio-format validation. - Secure creation of a private, unpredictable temporary file. - Symbolic-link and existing-file checks. - Cleanup after playback. A fixed filename in a shared temporary directory creates a time-of-check/time-of-use and symbolic-link risk. Another local user may pre-create `/tmp/news.mp3` as a symbolic link. When `curl` opens the destination, it may truncate or overwrite a file reachable with the invoking user's permissions. The downloaded resource is also passed directly to a media parser. A malicious or malformed file could cause excessive resource consumption or exploit a vulnerability in the installed media framework. Quoting the URL prevents straightforward shell metacharacter injection, so command injection is not established by this line. ### Attack Path #### Remote media path 1. An attacker supplies or controls the audio URL used in place of the placeholder. 2. The command downloads attacker-controlled bytes without validating the host, protocol, size, MIME type, or file signature. 3. The download is saved with an `.mp3` extension regardless of its actual format. 4. `afplay` immediately parses the untrusted file. 5. The result may be denial of service or exploitation of a media-parser vulnerability present on the host. #### Local symbolic-link path 1. A local attacker predicts the fixed path ...[truncated 1189 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit downloads only from explicitly approved HTTPS hosts. 2. Reject plaintext HTTP, unsupported URL schemes, embedded credentials, and unexpected cross-domain redirects. 3. Configure connection and total-operation timeouts and enforce a conservative maximum download size. 4. Create a private temporary directory and unpredictable file using `mktemp`, with restrictive permissions. 5. Ensure the generated path is a newly created regular file and is not a symbolic link. 6. Validate both the declared content type and the downloaded file signature before playback. 7. Allow only a narrowly defined set of supported audio formats. 8. Run media processing with the minimum necessary privileges and, where practical, inside a sandbox. 9. Remove the temporary file with a cleanup trap whether playback succeeds or fails. 10. Use a hardened pattern similar to: ```bash set -eu tmpdir="$(mktemp -d)" trap 'rm -rf -- "$tmpdir"' EXIT audio="$tmpdir/news.mp3" curl --fail --silent --show-error \ --proto '=https' \ --connect-timeout 5 \ --max-time 30 \ --max-filesize 10485760 \ --output "$audio" \ "https://approved.example/news.mp3" # Verify the file signature and expected media type before playback. afplay "$audio" ``` The approved hostname and validation logic should be enforced programmatically rather than accepted directly from arbitrary user or feed content. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are overly broad and include common conversational terms like “新闻” and “今天发生了什么”, which can cause the skill to activate during ordinary dialogue without clear user intent. In a skill that fetches remote content and may generate speech output, accidental activation can lead to unintended network access, noisy responses, or disclosure of browsing/interest patterns.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

grep -E '<title>|<link>' | sed 's/<[^>]*>//g' | head -20

# 语音播报（需要安装）
# Ubuntu/Debian: sudo apt install espeak-ng ffmpeg
# CentOS/RHEL: sudo yum install espeak-ng ffmpeg

# TTS 播报（espeak-ng）

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

grep -E '<title>|<link>' | sed 's/<[^>]*>//g' | head -20

# 语音播报（需要安装）
# Ubuntu/Debian: sudo apt install espeak-ng ffmpeg
# CentOS/RHEL: sudo yum install espeak-ng ffmpeg

# TTS 播报（espeak-ng）

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.