Security audit

AI news generator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its news-to-Discord purpose, but its run instructions create avoidable risks around unintended Discord posting and unsafe handling of news text in shell commands.

Review before installing. Use it only with an explicit Discord destination, require confirmation before any post or recurring schedule, store the webhook as a secret rather than a command-line argument, restrict the destination to real Discord webhook URLs, and rewrite the send step so story JSON is written safely to a file or passed through a non-shell argument API.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:58
Finding: Shell Command Injection Through Untrusted News Content
Content: View full analysis
/tmp/stories.json python3 scripts/send_to_discord.py --webhook "..." --date "..." --topics "..." --stories-file /tmp/stories.json ``` ### Technical Analysis The skill instructs the agent to place web-derived headlines, summaries, and URLs directly inside single-quoted shell strings. These values are not guaranteed to be trusted because they originate from external news pages and search results. A single quote in any story value terminates the surrounding shell string. Shell metacharacters following that quote can consequently be interpreted as commands rather than data. The documented fallback is also unsafe: although it is recommended specifically when JSON contains single quotes, it still embeds the JSON inside a single-quoted `echo` command. This vulnerability occurs before `send_to_discord.py` parses the JSON, so JSON decoding and payload construction provide no protection against it. ### Attack Path 1. An attacker publishes or manipulates a searchable news article containing shell syntax in its headline or summary. 2. The agent selects that article while following the skill’s news-search instructions. 3. The malicious text is inserted into `STORIES_JSON_HERE`. 4. The agent executes the documented command through a shell. 5. An embedded single quote closes the intended argument, and the shell interprets the remaining attacker-controlled syntax. 6. The injected command executes with the same operating-system privileges as the agent process. For example, a story value shaped like the following could escape the quoted JSON context: ```t ...[truncated 556 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: send_to_discord.py:68
Finding: Unrestricted Webhook URL Allows Server-Side Request Forgery
Content: View full analysis
int: """POST the payload to the Discord webhook, retrying on 429 (rate limit).""" data = json.dumps(payload).encode("utf-8") req = urllib.request.Request( webhook_url, data=data, headers={"Content-Type": "application/json"}, method="POST", ) ``` ```python parser.add_argument("--webhook", required=True, help="Discord webhook URL") ``` ```python payload = build_payload(stories, args.date, args.topics) post_to_discord(args.webhook, payload) ``` ### Technical Analysis The script describes the destination as a Discord webhook but accepts any URL supplied through `--webhook`. It does not validate the URL scheme, hostname, port, path, resolved IP address, or redirect destination. Consequently, a caller can direct the script to send an HTTP request to localhost, private-network services, link-local addresses, or other destinations accessible from the agent’s network environment. The request body contains attacker-influenced story, date, and topic data. The lack of redirect validation also means that validating only the initial destination outside this function would be insufficient unless redirects are disabled or every redirect target is independently checked. ### Attack Path 1. An attacker influences the webhook value supplied to the skill or convinces a user to configure an attacker-selected URL. 2. The attacker supplies a target such as a localhost endpoint, private address, or internal hostname. 3. The script constructs an HTTP POST request without checking whether the destination is a legitimate Discord host. 4. The request originates from the trusted agent environment and reaches a servi ...[truncated 796 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:58
Finding: Discord Webhook Secret Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs network access and reads local bundled files/scripts, but it declares no explicit tool scope or permissions boundary. In an agent environment, this weakens least-privilege controls and can allow unintended tool use or make review/deployment decisions less informed, especially since the skill also sends data to an external webhook.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough that the skill may activate on vague requests like 'daily briefing' or 'news bot' without clear user intent to post externally to Discord. Because the skill can send content out of the environment and also supports scheduled delivery, accidental invocation could cause unwanted external posts or automation setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says the skill delivers news to Discord, but it does not prominently warn that it will transmit content to an external Discord webhook endpoint. In agent workflows, insufficient disclosure around external network exfiltration can lead users to trigger the skill without understanding that data leaves the local/system boundary.
Content: No source excerpt is available for this finding.