Security audit

科技新闻每日推送

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its news-summary purpose, but it ships a hardcoded Enterprise WeChat webhook and several unsafe network-facing behaviors that need review before installation.

Review and edit this skill before installing. Rotate/remove the shipped WeCom webhook key, configure your own webhook via a secret or environment variable, run it first in dry-run/manual mode, restrict cron automation, and avoid running the optional email webhook unless it is bound to localhost or protected by authentication and request limits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: push_combined.py:18
Finding: Hardcoded WeCom Webhook Credential Exposes Message-Sending Capability
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: push_combined.py:350
Finding: Unvalidated RSS Article URLs Permit Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: push_wechat.py:27
Finding: Disabled TLS Certificate and Hostname Verification in RSS Fallback
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: email_webhook.py:25
Finding: Unauthenticated Network-Bound Email Webhook Allows Resource Exhaustion and Malicious HTML Storage
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Unpinned Third-Party Dependency Creates Supply-Chain Exposure
Content: View full analysis
=1.2.71 ``` The documentation also recommends an unconstrained installation: ```bash pip install cloudscraper ``` ### Technical Analysis The lower-bound-only constraint allows installation of any current or future `cloudscraper` release. The documentation is even less restrictive and resolves the latest available package. No lockfile, package hash, or trusted-index restriction is provided. Because the package is imported and executed by the primary scripts, a compromised future package version or compromised package-distribution account would run with the same operating-system privileges as the skill process. This finding identifies supply-chain exposure from nonreproducible dependency resolution. The audit did not establish that the current `cloudscraper` package is malicious. ### Attack Path 1. A future dependency release or its distribution account is compromised. 2. An administrator installs the project using `pip install cloudscraper` or `cloudscraper>=1.2.71`. 3. The resolver selects the compromised version. 4. The package executes during import or when `create_scraper()` is called. 5. Malicious package code receives the filesystem, network, and process privileges of the skill runtime. ### Impact Assessment A compromised dependency can potentially read or modify files accessible to the process, access configured secrets such as the WeCom webhook, make arbitrary network requests, alter fetched content, and execute Python code under the runtime account. The attainable privilege level is limited to the account and environment used to install or run the project. Running installation or execution with administrative privileges would substantially increase the impact. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script embeds a live WeCom webhook URL with its key directly in source code, which exposes a privileged outbound messaging capability to anyone who can read, copy, or reuse the file. Hard-coded secrets are easily leaked through repositories, logs, backups, or downstream redistribution, enabling unauthorized message sending, spam, social-engineering, or abuse of the organization's notification channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly describes automatically pushing AI-generated summaries to an Enterprise WeChat webhook, but it does not clearly warn users that generated content will be transmitted to an external service endpoint. That creates a real data-handling risk because scraped article text, summaries, or accidentally included sensitive content could be sent outside the local environment without informed consent or review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 该技能文档明确描述了自动抓取外部网站内容、经 AI 处理后再推送到企业微信，但没有清晰告知用户：抓取内容、摘要结果和推送消息都会通过网络发送到外部服务。缺少这一数据流透明度会让使用者低估隐私、合规和第三方数据处理风险，尤其当 AI 处理并非完全本地时更明显。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 文档多处表述该技能会将内容翻译并仅以中文推送，例如“AI 翻译生成中文摘要”和“只推送中文翻译版，不推送英文原文”。这构成了语言/locale 强制策略，但文档没有说明用户可选择语言，也没有将其限定为必须中文的合规或区域场景。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 文档要求用户直接在脚本中配置企业微信 Webhook，但没有强调该 URL 属于敏感凭据；一旦泄露到代码仓库、日志或共享环境，攻击者即可伪造机器人消息进行未授权推送。虽然这更偏向安全配置缺陷而非直接代码漏洞，但在自动化推送场景下具有实际滥用风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module description states that it translates content into Chinese, and the runtime instructions also direct the AI to translate the text into Chinese. This imposes a specific language choice without offering the user a language/locale option or explaining why Chinese is required for a region-specific or compliance reason.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The GET endpoint is documented as a health check, but it also discloses the server's local save directory path and enumerates stored email filenames. This exposes internal filesystem structure and potentially sensitive metadata about received emails to any caller, which can aid reconnaissance and leak operational details.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file contains its docstrings and user-facing console messages entirely in Chinese, including the main skill description and runtime status output. Because the file does not offer a language choice or explain that it is intentionally limited to a Chinese-speaking context, it violates the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level documentation says this is an "AI translation mode" script, which implies the script translates content using AI before sending it. In reality, the code only loads pre-generated content from today_cn.txt and posts it to WeCom; the translation step is explicitly external to this script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file description states this is a Chinese-version push script and that AI-translated Chinese content will be sent. This imposes a specific language/locale behavior, but the file does not indicate user opt-in, language selection, or a documented policy reason for restricting output to Chinese.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script contains a hardcoded enterprise WeChat webhook and automatically transmits file contents to an external network endpoint. Embedding the secret in source code risks credential leakage and unauthorized message sending, and the script provides no explicit consent gate before exfiltrating local content. In this skill context, the danger is higher because arbitrary text from today_cn.txt is pushed externally with a single run.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The top-level documentation describes a 'technology news merge push script' focused on combining LightReading and TechCrunch RSS and avoiding duplicate pushes. In practice, the script goes well beyond RSS merging/pushing: it downloads article pages, scrapes full text and authors, writes multiple local English files for later AI translation, and conditionally waits for a translated Chinese file before pushing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module description and message-generation flow are written to produce Chinese output and Chinese translation artifacts by default, with no indication that the user can choose another language. This is a natural-language locale policy issue because the skill imposes a specific language without opt-in or a stated region-specific requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script automatically transmits assembled content to a hard-coded external webhook without any runtime disclosure, approval step, or clear user-facing indication of the exact destination. In a skill/agent context, undisclosed exfiltration paths are risky because users or operators may assume the tool only processes local or RSS data, while it actually publishes content outside the environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script deletes local files automatically based on date checks without confirmation or backup, which can destroy staged translation artifacts or other operational data unexpectedly. In automation environments, silent file deletion can cause data loss, workflow disruption, or make incident review harder if evidence is removed before inspection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module description states an AI translation mode and the code later generates Chinese-language output strings by default, indicating a fixed language/locale behavior. There is no indication that the user can choose output language or opt in to this locale preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hardcoded WeCom webhook key is a real secret embedded in source code, enabling outbound transmission to a fixed external endpoint. Anyone with access to the code can reuse the webhook, send unauthorized messages, or abuse the integration, and the script silently exfiltrates article-derived content to that endpoint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring and function name indicate this routine performs translation, but the body explicitly says 'return original English text for AI assistant translation' and simply returns text unchanged. This is an active contradiction between documented intent and actual behavior that affects what content is produced and pushed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The inline comment and filename indicate English output is being saved, but main() calls create_message() rather than create_message_english(), and create_message() builds a Chinese message with Chinese labels and headings. This creates a clear documentation-to-code mismatch about what is stored for downstream use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This file’s natural-language strings describe the skill entirely in Chinese and the runtime status messages are also emitted only in Chinese. Under the stated policy, a fixed language without user opt-in can be a locale/language policy violation when no choice or justification is provided.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module-level documentation says '仅推送已翻译内容' ('only push translated content'), which implies a stronger guarantee than the implementation provides. In practice, the code merely rejects messages containing specific placeholder markers, so partially untranslated or otherwise unsuitable content can still be sent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file uses Chinese-only natural-language strings in its docstring and console output, such as the title and status messages, with no indication that the user can opt into another language. Under the policy rule, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script writes push history to pushed_history.json, and later also writes generated content to today_en.txt. While these writes support the script's workflow, there is no prior warning in comments or user-facing notice that local files will be created or modified during execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script saves generated message content to today_en.txt, which is a local data write operation containing fetched article summaries. Although a log is printed after the write, there is no advance disclosure before execution that this file will be created.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The dependency is version-ranged rather than pinned to an exact, reviewed release, which makes builds non-reproducible and allows future installs to silently pull different package versions. In this context, the risk is slightly elevated because the package is explicitly intended for Cloudflare bypass, so an unexpected upstream change or compromised release could affect network behavior or introduce supply-chain risk.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
# 科技新闻每日推送技能 v5.4 依赖 # Cloudflare 绕过（必需） cloudscraper>=1.2.71 # 可选：邮件解析 # beautifulsoup4>=4.12.0

Static analysis

No suspicious patterns detected.