AI News Simple

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:56 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward AI-news briefing helper, with disclosed web fetching and no evidence of persistence, credential access, destructive behavior, or hidden control.

Install only if you are comfortable with the skill making outbound requests to public AI news sites and producing simple Chinese briefings from raw page matches. Treat fetched page text as untrusted, and prefer a pinned install command if available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:42

Finding

Unpinned npx Package Execution Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md, line 42
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

bash

npx clawhub install ai-news-simple

Technical Analysis

The documented installation command invokes clawhub through npx without specifying an exact version or integrity hash. If the package is not already available locally, npx can retrieve the current package release from the configured npm registry and execute its CLI code.

The code executed by this command is therefore mutable and is not part of the audited project. A compromised publisher account, malicious package replacement, registry configuration attack, or newly published malicious version could change installation behavior after this Skill has been reviewed.

This is not evidence that the current clawhub package is malicious. The vulnerability is the absence of version and integrity controls around externally retrieved executable code.

Attack Path

1. An attacker compromises the package publisher, registry account, distribution channel, or registry configuration used for clawhub.
2. The attacker publishes or redirects resolution to a malicious package version.
3. A user follows the installation command from README.md.
4. npx downloads the mutable package release.
5. Package lifecycle logic or CLI entry-point code executes with the permissions of the user running the command.

Impact Assessment

Successful exploitation could execute arbitrary commands with the installing user's privileges. Depending on that user's access, this could expose local files, environment variables, tokens, SSH credentials, and project data or allow modification of user-owned files and development tooling.

The command does not request elevated privileges directly, so administrative or root access is not inherently obtained. The affected scope is primarily the account and environment from which the in ...[truncated 31 chars]

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to an exact reviewed version instead of allowing npx to resolve a mutable latest release.
• Document the expected registry and verified package publisher.
• Where supported, publish and verify package integrity hashes or signed provenance.
• Use a lockfile or an equivalent immutable dependency record for installation tooling.
• Recommend reviewing the resolved package version before permitting execution.
• Disable or avoid lifecycle scripts during installation where operationally possible.
• Replace the command with a version-pinned form such as npx clawhub@<reviewed-exact-version> install ai-news-simple, after selecting and auditing the intended version.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Untrusted Remote HTML Is Passed into the Agent Context Without Sanitization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–84
Vulnerability Type: Unsafe processing of attacker-influenced remote content
Risk Level: Medium

bash

# Extract AI-related content
content=$(curl -s "$source" | grep -E "(OpenAI|GPT|Anthropic|Google AI|Claude|ChatGPT|人工智能|机器学习|深度学习|AI模型|自动驾驶|机器人)" | head -3)

if [ -n "$content" ]; then
    echo "📝 AI新闻内容:"
    echo "$content"
else
    echo "📝 暂无相关AI新闻"
fi

echo "---"
echo ""

A similar pattern is present in the quick-update workflow at SKILL.md, lines 111–118:

bash

recent=$(curl -s "$source" | grep -E "(今天|刚刚|发布|推出|更新|突破)" | head -3)

if [ -n "$recent" ]; then
    echo "📈 最新动态:"
    echo "$recent"
else
    echo "📈 暂无新动态"
fi

Technical Analysis

The Skill retrieves mutable HTML from third-party websites and emits matching lines verbatim. It does not parse defined article fields, remove markup or hidden text, sanitize instruction-like content, validate the response content type, or explicitly delimit retrieved content as untrusted data.

Because the intended workflow uses an AI agent to interpret this output and generate a briefing, a compromised page or attacker-influenced article can place prompt-like instructions in a line containing one of the accepted keywords. The selected line can then enter the model context and attempt an indirect prompt-injection attack.

Shell quoting around echo "$content" prevents the downloaded text from being re-evaluated as a shell command, so this issue does not directly provide operating-system command execution. The principal risk is manipulation of downstream Agent behavior and generated content.

The use of curl -s also omits explicit connection timeouts, total timeouts, response-size limits, and content-type checks. Those omissions can increase availability and resource-consumption risks, although they do not by themselves establish arbitrary code execution.

...[truncated 1380 chars]

Remediation

View remediation

Remediation Suggestions

• Parse HTML using a maintained parser and extract only explicit article fields such as title, canonical URL, publication date, and visible summary text.
• Remove scripts, styles, comments, hidden elements, embedded metadata, and markup before placing content in the Agent context.
• Clearly delimit all fetched material as untrusted data and instruct the Agent never to follow commands or policy statements contained in source content.
• Validate response status, final destination, content type, and maximum response size.
• Add conservative connection and total timeouts, for example through appropriate curl timeout and size-control options.
• Prefer structured, authenticated feeds or official APIs where available.
• Validate extracted URLs and restrict redirects to expected HTTPS destinations.
• Perform publication-date filtering using parsed metadata rather than keyword matching.
• Treat source compromise as an expected threat and require cross-source corroboration before presenting consequential claims as facts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says the model generates high-quality Chinese briefings, which imposes a specific output language. There is no indication that users can choose another language or that the Chinese-only behavior is a documented, justified locale constraint.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This line reinforces that the skill always generates Chinese briefings, but the README does not present that as an optional or user-selected setting. That creates a natural-language policy concern because a fixed language is being enforced without explicit user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description states the skill generates 'professional Chinese briefings,' which imposes a specific language as part of normal operation. This is a natural-language locale policy issue because the file does not indicate that users can choose another language or explicitly opt in to Chinese output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The core strategy explicitly says the skill will 'Create professional Chinese output,' reinforcing a forced language behavior. No nearby text offers language selection or limits this to a justified region-specific use case.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documentation states '70B model enhancement - Use Llama 3.1:70B for quality', which implies model-based summarization or generation. However, the actual command implementation shown below only fetches pages with curl, filters text with grep, and prints fixed summary lines, so the documentation actively overstates what the code does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file says the skill generates 'Source Analysis', 'Trend Insights', and 'Actionable Intelligence', suggesting substantive analysis. In practice, the commands only grep source pages for keywords and then emit hard-coded summary bullets, so the documented intent materially exceeds the implemented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This section says the skill 'Generates professional Chinese news briefings,' which is another explicit language constraint. Because the file does not provide a language preference mechanism, this appears to violate the language/locale policy described in the audit criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document repeatedly states that a '70B model' generates high-quality Chinese content and lists it as a dependency. Yet the manifest requires only curl and the example code never calls any model runtime or API, directly contradicting the stated implementation details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file states that the skill monitors 10 AI news sources and uses curl for direct web access, which implies outbound HTTP requests to external sites. The description does not include any warning about network activity, privacy implications, or that external content will be fetched during use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.