Security audit

AI新闻工具-免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a news-fetching helper, but its instructions broaden into unrelated database, analytics, file-processing, and command-execution uses without clear limits.

Install only if you want a command-capable agent helper for fetching Chinese news via external APIs. Review and narrow the trigger text and generic command/file-processing claims before use, and require explicit approval before it runs shell commands or writes cache/summary files.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest and description present the skill as a news-retrieval tool, but the scope text also claims database, SQL, and data-storage management applicability. This mismatch can cause an agent to invoke the skill in unrelated contexts and grant command/network execution for tasks outside its true purpose, increasing the chance of unsafe or unintended operations.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation advertises create/query/export and modify/reset/import style operations through generic parameters, but the actual skill behavior is described as read-only news access. Overstating mutating capabilities can mislead an agent into treating the skill as a general-purpose executor, which is risky because the skill has exec permission and could be steered into unintended actions.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The skill first says it is not suitable for several non-news scenarios, but later suggests broad data analysis, report generation, statistics, and visualization triggers. This inconsistency expands the effective activation surface and may cause accidental invocation for unrelated tasks, though the issue is primarily one of scope confusion rather than direct code execution guidance.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The later sections redefine the skill as a generic automation, file-processing, API-integration, and command-execution tool rather than a narrowly scoped news reader. In a skill with allowed-tools including exec, this broad framing makes prompt-based misuse more likely because the agent may treat the skill as authorization to run arbitrary local commands or handle unrelated files.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger conditions are overly broad, matching common words like '新闻', '日报', and '头条', which can cause the skill to auto-activate in many ordinary conversations. Because the skill exposes exec and network access, over-triggering materially increases the risk of unnecessary command execution, external requests, and tool confusion in contexts where the user did not intend to use this skill.

Vague Triggers

High

Confidence: 95% confidence
Finding: The later trigger text redirects the skill toward generic data analysis, reporting, statistics, and visualization use cases, which conflicts with the stated news-only scope. This ambiguity can cause the agent to invoke a command-capable skill for broad analytic tasks, greatly increasing misuse potential and widening the prompt surface for unsafe execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The usage examples write fetched data to local files in the user's home directory without prominently warning that persistent local storage will occur. In an agent context, silent file writes can surprise users, leak sensitive contextual data into predictable locations, or accumulate artifacts that other tools/processes can access.

Static analysis

No suspicious patterns detected.