T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:3- Finding
Overbroad Activation Scope and Tool Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
AI新闻工具-免费版
Security checks for vulnerabilities and agentic risk
Overview
The skill is a news lookup tool, but its instructions also advertise unrelated database, analytics, file-processing, and command-execution uses with broad local execution permissions.
Review before installing. This skill does not show theft, destruction, or hidden persistence, but it grants shell and read capabilities while describing uses beyond news lookup. Install only if you are comfortable limiting its use to explicit news requests, reviewing commands before execution, and avoiding unattended cache or summary writes unless you choose the output path.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:124- Finding
Unvalidated Shell Interpolation in Article Retrieval Guidance
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger conditions are broad keyword matches such as '新闻', '日报', and '头条', which can activate the skill in many loosely related conversations. Because the skill has exec permission, accidental invocation is more dangerous than in a read-only skill: it can initiate network requests and shell commands without the user intending to use this tool.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The later activation text says the skill should be used for data analysis, report generation, statistical insight, and visualization, which is unrelated to a news API reader. This ambiguity materially broadens the contexts in which the agent may select the skill, enabling command execution and external access in workflows far outside its stated purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest advertises database, SQL, and data-storage use cases while the body only implements news retrieval. This kind of scope mismatch can cause the agent to invoke the skill in unrelated contexts, leading to unnecessary tool use and execution of shell commands when the user asked for database help.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill includes examples that save summaries and caches to local files in the user's home directory, but it does not clearly warn that local state will be created or modified. In an agent setting, undocumented file writes can surprise users, leave residual sensitive data, and create persistence artifacts from ordinary news queries.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation says the free edition does not provide scheduled push or advanced automation, but the examples include a scheduled daily-summary workflow that writes files locally. This inconsistency can mislead operators about the skill's real behavior and hide persistence-like or unattended execution patterns behind a supposedly limited news tool.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Later sections generalize the skill into file processing, automation, command execution, and information retrieval capabilities unrelated to news retrieval. Expanding a narrowly branded skill into generic operational powers increases the chance of overbroad invocation and misuse of the allowed exec tool under false expectations.
- Content