Cinema Insider Top-10

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:36 PM UTC
• Version: 1.0.0

Overview

This skill is a simple public entertainment-news digest with proportionate web browsing behavior and no install scripts, persistence, credential use, or hidden local access.

Installing this skill is reasonable if you want automated cinema-industry news briefings. Prefer HTTPS sources where possible, and treat fetched article text and links as untrusted source material rather than instructions to the agent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

Unencrypted RSS Feed Permits Content Manipulation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Plaintext external content retrieval
Risk Level: Medium

Vulnerable Code Snippet

markdown

1. **Variety** (http://variety.com/feed/) - Business and production standards.

Technical Analysis

The skill explicitly instructs the agent to retrieve the Variety RSS feed over plaintext HTTP. HTTP provides neither transport confidentiality nor cryptographic server authentication and integrity. An attacker with a suitable network position could intercept the request and modify the feed response before it reaches the agent.

Because external feed content is used to construct the news digest, manipulated titles, article text, or links could be treated as legitimate source material. An attacker could consequently introduce false reporting, malicious links, or adversarial instructions embedded in feed content. The project does not document HTTPS enforcement, redirect validation, content sanitization, or isolation of retrieved text as untrusted data.

Attack Path

1. The skill invokes web_fetch for http://variety.com/feed/.
2. A network-positioned attacker intercepts the unencrypted HTTP request or response.
3. The attacker replaces or modifies RSS entries, article links, or embedded text.
4. The agent processes the modified response during aggregation and analysis.
5. Fabricated information or attacker-controlled links may appear in the resulting digest. If retrieved content is not treated strictly as data, embedded adversarial text could also attempt to influence subsequent agent behavior.

Impact Assessment

The primary impact is loss of integrity and authenticity for one of the skill's curated information sources. An attacker could manipulate rankings, introduce false industry news, redirect users to malicious websites, or reduce confidence in cross-source verification.

This issue does not itself grant local system p ...[truncated 325 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the plaintext endpoint with https://variety.com/feed/.
2. Require HTTPS for every external source and reject any redirect that downgrades from HTTPS to HTTP.
3. Validate final redirect destinations against an explicit allowlist of trusted hostnames.
4. Treat all retrieved feed and article content as untrusted data rather than executable instructions.
5. Prevent fetched content from overriding system, developer, user, or skill instructions.
6. Sanitize and validate externally supplied links before displaying or opening them.
7. Where practical, corroborate significant stories through multiple independently secured sources before including them in the final digest.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation description says the skill runs 'Upon request (e.g., "Cinema news")', but it does not define a clear set of trigger phrases or boundaries for when the skill should or should not activate. 'Cinema news' is broad enough to overlap with ordinary user requests about movies or entertainment, which could cause unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.