T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate-ai-news.py:166- Finding
Untrusted RSS Content Is Embedded in Markdown Without Escaping or URL Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
AI情报飞书文档
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward RSS-to-Markdown AI news digest generator, with some disclosure and hardening gaps but no evidence of hidden, destructive, or credential-seeking behavior.
Install only if you are comfortable with the skill contacting the configured RSS providers and creating local Markdown files. Treat generated reports as untrusted content from the internet, disable or review remote images in Markdown viewers, and only add the cron schedule if you want unattended daily runs. Prefer installing PyYAML in an isolated environment with a pinned version.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:91- Finding
PyYAML Installation Is Unpinned and Lacks Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The metadata says '飞书AI情报', which suggests a Feishu/Lark integration or intelligence workflow, but the documented behavior is actually external RSS fetching and local report generation with no Feishu interaction. Misleading descriptions are dangerous because they undermine informed consent, can bypass review expectations, and hide that the skill reaches out to third-party sources and processes remote content.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documentation describes behavior that reads configuration, fetches external RSS feeds over the network, and writes Markdown output, but it does not declare any explicit tool scope or permissions. This creates a transparency and containment problem: users or platforms may authorize or run the skill without realizing it needs network and filesystem access, increasing the risk of overbroad execution and unsafe deployment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description and operational instructions are presented in Chinese, and the file does not indicate that language selection is optional or user-configurable. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script defaults article language to 'zh' and generates the overall output, headings, status messages, date format, and summary framing in Chinese. This is a natural-language locale constraint embedded in the skill without any visible user choice or opt-in, which can violate language/locale policy requirements.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The quick-start section shows commands that generate an output file, but it does not clearly warn that running the skill performs local writes and may be scheduled for recurring execution. This can lead to unexpected file creation, storage growth, or unattended operation in environments where users assumed a read-only or one-shot action.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The configuration section lists RSS sources and filtering options but does not warn that the skill automatically contacts external servers and ingests remote content. Without a network/privacy warning, users may not realize that using the skill leaks access metadata to third-party feeds and exposes the workflow to untrusted content from the internet.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This manifest encodes feed sources and language buckets only for zh and en, and the comments/output imply the skill is designed around those locales. Because there is no documented user choice, opt-in, or justification for restricting supported languages, this is a natural-language locale policy concern.
- Content
Static analysis
No suspicious patterns detected.