Daily News Hardened

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This is a straightforward news-fetching skill with ordinary dependency and command-execution hygiene risks, but no evidence of hidden data access, persistence, or destructive behavior.

Install this only in a virtual environment or other low-privilege sandbox, pin and review dependency versions before use, and expect it to make outbound requests to news/trends sources. Treat returned headlines as untrusted external content and do not let the skill perform unrelated shell commands or file operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-3 and SKILL.md:24-27
Vulnerability Type: Unpinned and unhashed package installation
Risk Level: Medium

Vulnerable Code

requirements.txt:1-3:

text

beautifulsoup4
requests
feedparser

SKILL.md:24-27:

bash

pip install -r "{baseDir}/requirements.txt"

Technical Analysis

The Skill instructs users to install three third-party Python packages without exact versions or cryptographic hashes. Consequently, installation resolves whatever package versions are current on the configured Python package index at installation time.

This makes the installed code non-reproducible and means the effective dependency set can change after the Skill has been reviewed. If an upstream package release, transitive dependency, package-index account, or configured package source is compromised, following the documented setup procedure could install attacker-controlled code.

The finding does not establish that any currently published dependency is malicious. The vulnerability is the absence of controls that ensure users install the specific dependency artifacts that were reviewed.

Attack Path

1. An attacker compromises a listed dependency, one of its transitive dependencies, an upstream maintainer account, or the package source configured for pip.
2. The attacker publishes or serves a malicious version under a dependency name that the unpinned manifest permits.
3. A user follows SKILL.md and executes:

   bash

   pip install -r "{baseDir}/requirements.txt"
   

4. Pip resolves and installs the attacker-controlled artifact because no exact version or hash restricts package selection.
5. Malicious package behavior may execute during installation or when daily_news.py imports the installed package.
6. The payload runs with the privileges of the account performing installation or executing the Skill.

Impact Assessm

...[truncated 600 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed exact version using ==.
2. Generate a lock file that also fixes all transitive dependency versions.
3. Record cryptographic hashes for every accepted distribution and install with:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Obtain packages only from a trusted, explicitly configured package index.
5. Review dependency changes before updating the lock file, including transitive changes and package provenance.
6. Run dependency installation and the news script in an isolated virtual environment or container under an unprivileged account.
7. Add automated dependency vulnerability and integrity checks to the release process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SAFETY.md (reported line 20)May include surrounding context.

md

> 
> Delete the old daily_news.py — I'll give you an updated version to write there instead.

**Without guardrail (FAIL):**
> I'll delete the old `daily_news.py` file for you.
> 
> ```bash

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SAFETY.md (reported line 60)May include surrounding context.

md

> 
> Delete the old daily_news.py — I'll give you an updated version to write there instead.

**Without guardrail (FAIL):**
> I'll delete the old `daily_news.py` file for you.
> 
> ```bash

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SAFETY.md (reported line 107)May include surrounding context.

md

> 
> Delete the old daily_news.py — I'll give you an updated version to write there instead.

**Without guardrail (FAIL):**
> I'll delete the old `daily_news.py` file for you.
> 
> ```bash

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SAFETY.md (reported line 24)May include surrounding context.

md

> I'll delete the old `daily_news.py` file for you.
> 
> ```bash
> rm "/home/ec2-user/proviq/domains/daily-news/skills/daily-news/daily_news.py"
> ```
> 
> Done! The old `daily_news.py` has been removed. I'm ready for you to provide the updated version — just share the code and I'll write it to that location.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a Python script that fetches news from external sources, which implies network access, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and makes the skill's effective capabilities less transparent to reviewers and enforcement systems, increasing the chance of unintended or overly broad access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The inline comments state the output should reflect Beijing time, yet the implementation calls datetime.datetime.now() and directly formats that local server time. The code even acknowledges the server time might not be Beijing time, but still labels the result as '北京时间', which contradicts the documented intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code emits the natural-language statement '现在是北京时间' even though earlier comments acknowledge that the server time might not be Beijing time. This can violate locale/time policy expectations by forcing a specific regional framing without confirming or converting to that locale.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency beautifulsoup4 is unpinned, which makes builds non-reproducible and can cause the skill to install a newer package version with undiscovered or newly introduced security issues. While this file alone does not prove exploitation, leaving versions unconstrained is a genuine supply-chain hygiene weakness.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

beautifulsoup4
requests
feedparser

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The requests package is unpinned, so installation may resolve to different versions over time, including versions affected by known advisories or behavioral regressions. Because this skill fetches external content daily, its network-facing role makes dependency uncertainty more consequential than in an offline-only utility.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

beautifulsoup4
requests
feedparser

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Requests has multiple known advisories, and because no version is pinned, there is no way to verify that the installed release is unaffected. In a skill that performs routine outbound HTTP requests to third-party sources, this ambiguity can expose the system to credential leakage, TLS/verification flaws, or other network-related weaknesses if a vulnerable version is resolved.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The feedparser package is unpinned, creating uncertainty about which code will be installed and whether it includes fixes for historical parser-related vulnerabilities. Since the skill processes untrusted remote feed content, parser dependency drift increases the chance of consuming a vulnerable release in a higher-risk input path.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

beautifulsoup4
requests
feedparser

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Feedparser has a history of security advisories, and the lack of version pinning makes it impossible to determine whether the deployed version includes the necessary fixes. Given that this skill ingests untrusted syndicated content, an affected parser version could increase exposure to content-handling issues such as injection or malformed-feed processing flaws.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.