Security audit

自媒体选题日报系统

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed automation for collecting public trend topics, using an LLM to draft content, and sending reports to Feishu, with some operational privacy and reliability caveats.

Install only if you are comfortable with scheduled jobs that fetch public trend data, send selected topic metadata to your configured LLM provider, and post or log report text for Feishu fallback. Verify the webhook token, API token storage, external send_alert.py helper, and the archive adoption marker behavior before relying on it in production.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script's documented adoption criterion ('[x] 勾选采用') does not match the implemented logic, which only treats a hidden HTML comment as adopted. In practice, legitimately selected topics may be misclassified as unused and archived or later purged, creating integrity and retention issues in an automated content workflow.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The header comment claims failures only log errors, but the actual implementation prints the full prepared report between FALLBACK_MESSAGE_START/END markers when webhook delivery fails. That can expose the selected topics, hooks, and data points to logs or any downstream cron/agent process that consumes stdout, creating an unadvertised secondary disclosure channel.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script sends externally fetched topic text, hotness labels, matched keywords, and category metadata to a third-party LLM endpoint without explicit notice, consent gating, or data-minimization controls in the code path. While the content is mostly public trend data rather than secrets, this still creates an undisclosed external data transfer and could expose user-specific curation logic or sensitive future topic interests if the data sources or keywords are customized.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: A second LLM call transmits topic metadata to an external provider for data-point generation, again without an explicit disclosure or consent mechanism. Repeated external enrichment increases the volume of transferred data and expands privacy/compliance risk, especially if operators later include non-public keywords, internal editorial priorities, or proprietary source material.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: On webhook failure, the script writes the entire message body to stdout specifically for alternate delivery by another agent. That creates a silent cross-channel propagation path for content that may not be intended for logs, terminals, process supervisors, or other automation layers, increasing the chance of unintended disclosure or misuse.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/generate_topics.js:24