T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init_config.py:71- Finding
Arbitrary Python Code Execution Through Generated Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
daily-news-push
Security checks for vulnerabilities and agentic risk
Overview
This daily news push skill is mostly purpose-aligned, but its setup can turn user-entered configuration into executable Python and its webhook delivery is too unrestricted.
Install only if you trust the publisher and can review or patch the setup scripts. Do not paste webhook headers, URLs, cron strings, or other configuration values from untrusted sources. Prefer manually creating a safe config, restrict webhook destinations to trusted HTTPS endpoints, avoid sensitive report content, and be cautious before enabling the documented cron job.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/channels/webhook.py:59- Finding
Unrestricted Webhook Destination Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a full automatic daily briefing and distribution service: searching recent domain news, organizing it, and pushing it to multiple external channels. However, the supplied code chunk is limited to local report-generation logic. It models news items, checks age, filters items, formats sections, and assembles a report string. There is no implementation for external news search, API access, crawling, channel delivery, webhook calls, or scheduling/trigger handling. While the formatting portion is consistent with the description, the major advertised capabilities—automatic search and push delivery—are absent from this code, so the description overstates what this chunk actually does.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises automated search, configuration generation, and outbound delivery to external channels, but the manifest shown in SKILL.md declares no explicit tool scope or permissions boundary. That creates a least-privilege gap: a user or platform reviewer cannot easily tell that network access and file-writing behavior are required, increasing the chance of overbroad execution or unreviewed data egress.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are very broad and overlap with ordinary requests like '每日早报' or '新闻推送', so the skill may activate in situations where the user only wants summarization rather than external delivery automation. In this skill's context that matters because invocation can lead to searching, formatting, and potentially sending content to preconfigured recipients or webhooks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill promotes multi-channel push support but does not clearly warn users that generated content and recipient identifiers may be transmitted to external services, including generic webhooks. This increases the risk of unintended data disclosure, especially if the report contains sensitive queries, organization-specific topics, or misconfigured webhook destinations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The documented crontab setup establishes persistent scheduled execution, which can repeatedly perform network searches and push outbound messages without per-run user review. Persistence is not inherently malicious here, but in an automation skill that can send to external channels it increases the blast radius of misconfiguration, abuse, or later code changes.
- Content
bash # 编辑 crontab crontab -e # 添加一行（修改路径和时间为你配置的） 30 8 * * * cd /path/to/daily-news-push/scripts && python generate_and_send.py
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file documents a webhook channel that sends the full report content, date, and timestamp to a user-specified URL. Under the markdown-file criteria for SQP-2, the description should warn that content will be transmitted to an external endpoint and may have privacy or data-handling implications.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title and the entire formatting specification are written as a Chinese-only template, indicating the skill expects output in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstrings and user-facing strings are entirely in Chinese, including the channel name and error output, with no indication that the skill is region-specific or that users can choose their language. This creates a natural-language locale policy concern because the skill effectively enforces a specific language without opt-in.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
This code transmits content and metadata to an arbitrary webhook URL supplied at runtime, which creates a real exfiltration/SSRF risk if the URL or content source is attacker-controlled or insufficiently validated. In this skill's context, external delivery is expected behavior, but that same design makes the finding more dangerous because sensitive generated content could be pushed to untrusted endpoints or internal network addresses.
- Content
python "timestamp": int(datetime.now().timestamp()) } response = requests.post( self.webhook_url, headers=self.headers, json=payload,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code constructs and outputs a send_message action that transmits the provided content and receiver identifier to an external messaging channel. While the docstring says it uses wecom_mcp to send messages, there is no confirmation prompt or explicit user-facing warning in the code about the outbound transmission of potentially sensitive content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring and all configuration guidance are written exclusively in Chinese, indicating a fixed language/locale expectation. Under the policy, language constraints should either offer user choice or be clearly documented as region-specific and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language strings that force a specific language/locale for status messages and setup instructions. Under the policy, a skill should not impose a language choice without user opt-in unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script’s natural-language interface and instructions are entirely in Chinese, beginning with the module description and continuing through all prompts. Because the file does not offer a user language choice or explain that the skill is intentionally China/Chinese-only, it violates the locale-choice policy for natural-language behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script writes a generated config.py file containing user-provided identifiers and possibly webhook details, but it does not explicitly warn the user that these values will be stored on disk. Although the flow is interactive and prints completion status, there is no prior disclosure about local persistence of potentially sensitive configuration data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code is written around a Chinese-language experience, including the file description and all generated report labels/messages, but it does not provide any opt-in, fallback, or documented restriction to a Chinese-only audience. That creates a natural-language locale policy issue because the skill implicitly forces one language regardless of user preference.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generator docstring says it produces a complete 'morning report' and the manifest describes automatically searching and organizing news from the past 24 hours, but the output header at L159 explicitly says '过去24小时' while filter_by_age only removes items older than 48 hours for list categories and the formatter can still include '[昨日资讯]' or '[过期]' labels. This is an active intent mismatch because the produced report presents itself as a past-24-hours digest while the code is designed to include older content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The file presents all instructions and examples exclusively in Chinese, which may amount to a language-policy restriction if users are not given an opt-in or alternative locale. SQP-3 applies to natural-language policy violations across all file types, including markdown documentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstrings and method documentation are written entirely in Chinese, which imposes a specific language choice in the skill's natural-language interface. The file does not offer a language choice or document a region-specific reason for requiring Chinese, so this appears to violate the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file’s docstrings and operational messages are entirely in Chinese, with no indication that users can choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern even when it appears in code comments, docstrings, or string literals.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The docstrings and user-visible error message are written only in Chinese, and the skill does not indicate that it is limited to a Chinese-speaking or region-specific context. This can violate language/locale policy when a skill implicitly forces one language without user opt-in or justification.
- Content