Security audit

Tmtpost News

Security checks for vulnerabilities and agentic risk

Overview

This news skill is broadly coherent, but it needs review because it can install, update, and run an external CLI and touch API-key state on the user’s machine.

Install only if you trust TMTPost’s CLI distribution and are comfortable with the skill downloading/running a local executable and managing an API key. Treat the API key as a secret, avoid showing apikey-get output in logs or screenshots, and review the installer/update behavior before allowing the agent to run it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell scripts and a network-capable external CLI, but no permissions are declared to reflect those capabilities. This creates hidden execution and connectivity behavior that users and policy systems cannot accurately evaluate, increasing the risk of unexpected code execution, binary installation, and data flow on the host.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is simple news retrieval, but the skill also installs and updates binaries, detects and uses host-global executables, executes subprocesses, and manages API key state. That mismatch is dangerous because it hides privileged operational behavior behind an innocuous description, making users more likely to approve execution without realizing it can modify the environment and run downloaded code.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The code downloads an executable from a remote URL and then executes it locally after verifying a checksum fetched from another remote URL under the same trust domain. This creates a supply-chain risk: if the hosting origin or update channel is compromised, an attacker can deliver a malicious binary plus matching checksum and gain code execution on the host running the skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code invokes a CLI command to inspect whether an API key is configured and parses command output that may contain the credential value. Even though it returns only status, this creates unnecessary access to sensitive secrets for a news-reading skill, increasing the blast radius if the CLI output, logs, or future code paths expose the actual key.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script invokes an external CLI and explicitly probes API key status by running `apikey-get`, which can touch sensitive credential-handling paths without any notice, consent, or minimization. In an agent-skill context, this creates an unnecessary secret-discovery primitive and may expose whether credentials are configured, or even parse secret material from command output, increasing privacy and credential-handling risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide instructs users to set and then retrieve an API key, but it does not warn that the key is a sensitive credential or advise against exposing it in shared terminals, recordings, logs, or screenshots. The `apikey-get` verification step especially increases exposure risk because it encourages plaintext display of the secret, which could enable unauthorized use of the service if observed or captured.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The API-key retrieval path executes `apikey-get`, captures combined stdout/stderr, and parses an `API Key:` line, meaning the process intentionally accesses the raw credential even if it later reduces it to a boolean status. Accessing secrets without clear necessity or disclosure is risky because command output can be logged, mishandled, or later reused in ways that expose the credential.

Static analysis

No suspicious patterns detected.