Hot Topics Daily

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:49 AM UTC
• Version: 2.2.0

Overview

This skill mostly does the described hot-topic roundup, but it includes under-disclosed extra news-fetching code that uses API keys and an unsafe fixed temporary-file write.

Install only if you are comfortable with scheduled outbound news retrieval and Discord-oriented posting. Before enabling automation, confirm the Discord destination, run it as an unprivileged account, remove or fix the /tmp backup write, and either document/remove the Currents/GNews backup module or provide only limited API keys you are willing to use for that purpose.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/global_news_fetcher.py:33

Finding

API Credentials Exposed Through URL Query Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/push.cjs:149

Finding

Predictable Temporary File Permits Symlink-Based File Overwrite

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A description-behavior mismatch is security-relevant because users may approve the skill expecting domestic hot-topic collection, while the package appears to fetch different news sources and may not actually perform the claimed Discord delivery. This undermines informed consent and can conceal unreviewed network behavior or undeclared data handling, which is especially risky for scheduled automation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares executable behavior that requires network access and likely environment/config access, but it does not declare any explicit tool scope or permissions. This weakens reviewability and can lead users or orchestrators to grant broader capabilities than expected, increasing the chance of unintended outbound access or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

A scheduled skill that transmits fetched content to Discord should prominently warn users about the automatic outbound posting behavior. Without explicit disclosure, users may enable the skill without realizing it will periodically send externally sourced content to a third-party service, creating privacy, compliance, and operational risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This manifest description says the skill will 'automatically fetch' trending topics from multiple platforms and send them to Discord, but it does not specify the trigger conditions, schedule, scope, or constraints for when this happens. In a manifest file, that lack of specificity can make invocation behavior ambiguous and increase the chance of unintended activation or user misunderstanding.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill that aggregates daily hot-search rankings from specific Chinese platforms (Weibo, Zhihu, Baidu, Bilibili, Douyin, Toutiao) and pushes them to Discord. This module explicitly adds international news sources via Currents API and GNews, which is a different content domain from the declared platform hot-search roundup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language strings and documentation entirely in Chinese, including the module description and runtime output, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code loads CURRENTS_API_KEY and GNEWS_API_KEY to access external international news APIs. Given the manifest’s stated purpose of fetching hot-search lists from named platforms and sending them to Discord, introducing separate global news providers and their credentials is not clearly justified by the declared scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/global_news_fetcher.py (reported line 20)May include surrounding context.

python

self.currents_key = os.getenv('CURRENTS_API_KEY')
        self.gnews_key = os.getenv('GNEWS_API_KEY')

        self.CURRENTS_URL = "https://api.currentsapi.services/v1"
        self.GNEWS_URL = "https://gnews.io/api/v4"

    def get_world_news_currents(self, limit: int = 10) -> Optional[List[Dict]]:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script formats the date with the fixed locale 'zh-CN' and builds the main message text entirely in Chinese. This is a natural-language policy concern because it forces a specific language/locale on all users without any opt-in or configuration mechanism in the file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes an automation that grabs hot-topic feeds and sends them to Discord, which implies network retrieval and message generation. This script additionally persists the full generated message to /tmp/hot-topics-message.md, a local side effect not mentioned in the stated purpose and not required by the description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language description and instructions are presented entirely in Chinese, which can constitute a language/locale policy issue when no user opt-in or justification is provided. The file does not state that the skill is intentionally region-specific or offer an alternative language option.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest and README consistently describe this skill as fetching and pushing hot topics from six specified Chinese platforms to Discord. However, the documented file structure includes global_news_fetcher.py labeled as '国际新闻（备用）', which is a distinct content scope not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The platform display names are all specified in Chinese string literals, which imposes a specific language/locale in the skill configuration. There is no indication in this file of user opt-in, language selection, or documentation that the skill is intentionally limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file header claims the script fetches Weibo, Zhihu, Baidu, B站, and Douyin hot topics. However, the implementation includes formatToutiao and registers 'toutiao' in the formatter map, so the documentation understates actual behavior and contradicts the code's supported platform set.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.potential_exfiltration

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/push.cjs:17