RSS Daily Digest

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches an RSS digest purpose, but it needs review because it processes untrusted feed text without clear safeguards, writes to an unsafe temporary path, and may install an unpinned package at runtime.

Install only if you are comfortable with the skill fetching the bundled RSS feeds, writing digest files in your home directory, and creating a temporary JSON file. Prefer running it in an isolated environment, pin feedparser before use, and treat article titles/descriptions as untrusted text that should not be allowed to issue instructions or trigger tools.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:45

Finding

Untrusted RSS Content Can Hijack Agent Instructions During Summarization

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/format_digest.py:49

Finding

Unescaped Feed Metadata Allows Markdown Content and Link Injection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_feeds.py:136

Finding

Predictable Shared Temporary File Allows Symlink-Based File Overwrite

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76

Finding

Runtime Installation Uses an Unpinned Third-Party Dependency

Content

View full analysis

10s), skip it and note in output - If `feedparser` is not installed, run: `pip3 install feedparser` - If zero articles found in 24h window, inform user and suggest expanding timeframe ``` ### Technical Analysis The skill instructs the agent to install `feedparser` from the package index at runtime without specifying a reviewed version, integrity hash, lock file, or isolated environment. Consequently, the effective package and transitive dependency versions can change after the skill itself has been audited. A future compromise of the package, its distribution account, the package index, or a dependency could introduce malicious installation or import-time behavior. Runtime installation may also modify the user's global Python environment if `pip3` is not associated with an isolated virtual environment. The package name shown is not a demonstrated typosquat, and no currently malicious package was identified. The confirmed issue is the unsafe and non-reproducible dependency acquisition process. ### Attack Path 1. The skill runs on a system where `feedparser` is absent. 2. Following `SKILL.md`, the agent executes `pip3 install feedparser`. 3. `pip` resolves and downloads the current package and dependency set from its configured index. 4. If the package source, release account, index, or dependency chain has been compromised, malicious code is installed. 5. The installed code executes during installation or when `fetch_feeds.py` imports `feedparser`. ### Impact Assessment Malicious dependency code would generally execute with the same privileges as the user running `pip3` or the skill. It could access that user's files, environment variables, network connectivity, and writable Python environment. If installation i ...[truncated 229 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code clearly implements only the feed-ingestion portion of the declared skill: it parses a feed-sources.md file, fetches RSS/Atom entries with feedparser, filters by publication time, and emits a JSON object containing articles and errors. This partially aligns with 'Fetch RSS feeds, parse articles.' However, the declared description also claims the skill will generate AI summaries and compile a daily digest report in Markdown, and no such behavior appears in the code. Instead, the output is raw/truncated article metadata in JSON, written both to stdout and to /tmp/openclaw-rss-articles.json. Additionally, the code reads a local feeds file and writes a temporary output file, while the declared permissions list is empty. That file access is an undeclared resource usage, though it is supportive of the feed-fetching purpose rather than a separate malicious capability. Overall, the description materially overstates what the code does and omits its file I/O behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to read from local files and write a digest report to the user's home directory, but it does not declare any tool scope or permissions for those file operations. This creates an authorization and transparency gap: a host system or reviewer cannot reliably constrain or audit the skill's filesystem access, increasing the risk of unintended data exposure or misuse if the skill is invoked broadly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and map to common user intents such as 'news digest,' 'daily briefing,' and 'tech news roundup,' which can cause the skill to activate in many ordinary conversations. In combination with file access and network-fetch behavior, overly broad invocation increases the chance of the agent performing external retrieval and local writes when the user did not clearly request this specific skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and other user-facing text are written only in Chinese, which imposes a specific language/locale choice without offering an alternative or opt-in. Under the stated policy, forcing a specific language is a natural-language policy violation unless the skill offers user choice or clearly documents a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes aggregated feed contents to a predictable fixed path in /tmp, which can expose fetched data to other local processes or users depending on system permissions and execution environment. A fixed temporary filename also creates risks around symlink attacks, file clobbering, or unintended cross-run data leakage when multiple invocations share the same host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code contains natural-language strings in Chinese describing the skill's purpose and behavior, which imposes a specific language/locale without any opt-in or alternative. Under the policy, language-specific behavior should either be user-selectable or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/fetch_feeds.py (reported line 69)May include surrounding context.

python

for entry in feed.entries[:20]:  # 每个源最多 20 篇
            published = None
            for time_field in ['published_parsed', 'updated_parsed']:
                t = getattr(entry, time_field, None)
                if t:
                    from calendar import timegm
                    published = datetime.fromtimestamp(

Static analysis

No suspicious patterns detected.