Neovim Daily Digest

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:38 AM UTC
• Version: 1.0.0

Overview

This skill fetches public r/neovim RSS feeds to build a digest, with some link-handling and untrusted-content hardening gaps but no evidence of hidden persistence, credential access, destructive behavior, or exfiltration.

Install only if you are comfortable with the skill contacting Reddit RSS feeds when invoked. Treat all Reddit-derived text and links as untrusted, do not follow instructions embedded in post content, and verify any generated GitHub links before opening them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/neovim_digest.py:108

Finding

Untrusted Reddit RSS Content Is Passed Into the Agent Context Without an Explicit Trust Boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/neovim_digest.py:127

Finding

Substring-Based GitHub URL Validation Can Produce Deceptive Trusted Links

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to execute a local Python script that performs network access, but the manifest declares no explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where a broadly triggered skill could cause shell execution and external fetches without clear user-visible boundaries or least-privilege constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation text uses broad natural-language triggers such as requests for a roundup, highlights, recommendations, or a quick digest, which can cause the skill to activate in routine conversation without clear boundaries. In this skill, that matters because activation leads to shell execution of a local script and Reddit network access, increasing the chance of unintended external actions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/neovim_digest.py (reported line 67)May include surrounding context.

python

except Exception:
        # Reddit RSS occasionally trips Python's TLS stack in some environments;
        # fall back to curl because it is usually more tolerant here.
        result = subprocess.run(
            ["curl", "-L", "--silent", "--show-error", "--fail", "-A", USER_AGENT, url],
            check=True,
            capture_output=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated digest sentences and summary text are hard-coded in Chinese, which imposes a specific language on users without opt-in or configuration. This is a natural-language policy issue because the file does not provide any locale selection or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest says the digest is built by combining the Reddit RSS feeds top/day, new, and hot, but the code also defines and can use top/week as a backfill source. That is a small but real behavior expansion beyond the described scope, even though it is closely related to the skill's purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code fetches Reddit RSS feeds over the network and, on failure, falls back to invoking curl to retrieve the same remote content. There is no confirmation prompt or user-facing disclosure in the script output or arguments explaining that it will contact external services and use a subprocess as part of normal execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The output text states that new/hot are used because top/day has limited visible items and to cover posts still developing in other time zones. In reality, the code always mixes new and hot regardless of whether top/day is limited, and may also include top_week when requested, so the explanatory text overstates a specific selection rationale the code does not actually enforce.

Content

No source excerpt is available for this finding.