央视新闻抓取(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.4

Overview

The skill appears aimed at fetching public CCTV news, but its command permissions and setup instructions are broader and less bounded than the stated task needs.

Review before installing. Use a sandboxed workspace, avoid running the curl-to-bash Bun installer, pin and review dependencies, verify the actual crawler script before allowing exec, and make any cache/export behavior explicit and easy to clean up.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:419

Finding

Remote Bun Installer Downloaded and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 419
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

markdown

| Bun 1.0+ | Runtime | One of two options | `curl -fsSL https://bun.sh/install \| bash` |

Technical Analysis

The installation instruction downloads a mutable script from an external URL and passes its response directly to Bash. There is no intermediate review, version pinning, cryptographic checksum validation, or signature verification.

The effective executable payload is therefore not contained in the audited project and can change after the Skill has been reviewed. Although the URL appears to be Bun's official installation endpoint, its integrity and future responses cannot be established from the project contents.

This behavior exceeds the minimum privileges required for the declared news-fetching functionality. The document already supports Node.js as an alternative runtime, so executing a remote installation script is not necessary to perform the task.

Attack Path

1. A user or tool-enabled Agent follows the dependency setup instructions.
2. curl retrieves the current response from https://bun.sh/install.
3. The response is streamed directly into Bash without inspection or integrity validation.
4. If the distribution endpoint, domain, DNS route, TLS trust path, or hosted installer is compromised, attacker-controlled shell commands execute immediately.
5. Those commands run with the privileges of the user operating the Agent and can access resources available to that account.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's identity. Depending on that account's permissions, the payload could read or alter project files, access user-readable credentials, install additional software, modify shell configuration, or establish persistence.

The instruction ...[truncated 237 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash installation instruction.
• Prefer the already-supported Node.js runtime when it is installed.
• Direct users to an official, version-specific release artifact rather than a mutable installer endpoint.
• Pin the required Bun version and provide an expected SHA-256 or stronger cryptographic digest.
• Download the artifact to a local file, verify its checksum or publisher signature, and only then execute or install it.
• Avoid automatically installing runtimes through the Agent; require explicit user approval for environment changes.
• Document the expected download host, version, artifact name, and verification procedure.
• Run any required installation in a restricted container or sandbox without access to credentials or unrelated files.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:286

Finding

Unpinned Third-Party Package Installation Without Reproducible Integrity Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 286-287 and line 420
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

npm install node-html-parser
bun add node-html-parser

The dependency table repeats the installation guidance:

markdown

| node-html-parser | npm package | Required | `npm install node-html-parser` or `bun add node-html-parser` |

Technical Analysis

The instructions install node-html-parser without an exact version, committed lockfile, integrity hash, or documented registry restriction. Package resolution consequently depends on mutable external registry state at installation time.

The audited project contains only SKILL.md; it does not include a package manifest, lockfile, vendored dependency, or the referenced scripts/news_crawler.js. Consequently, neither the exact dependency graph nor the code that consumes the package can be reviewed.

Installing by an unpinned package name does not itself prove that the current package is malicious. It nevertheless creates a supply-chain exposure because future versions, transitive dependencies, registry-account compromise, or package lifecycle scripts may introduce code not represented in the reviewed artifact.

Attack Path

1. A user or Agent follows the setup instructions and runs one of the package-manager commands.
2. The package manager queries its configured registry and resolves the package version available at that time.
3. The selected package and its transitive dependencies are downloaded without comparison against a project-provided lockfile or expected integrity value.
4. If a resolved package, maintainer account, registry response, or transitive dependency has been compromised, malicious package code or lifecycle scripts can run during installation or later when imported.
5. The malicious code executes with the package manager or c ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

• Add a package manifest that pins node-html-parser to an audited exact version.
• Commit the appropriate lockfile with registry-resolved integrity metadata.
• Use reproducible installation commands such as npm ci rather than unconstrained installation.
• Configure an explicit trusted registry and prevent unexpected registry substitution.
• Review direct and transitive dependencies for known vulnerabilities before release.
• Disable dependency lifecycle scripts where compatible with the required package, such as through --ignore-scripts.
• Use automated dependency scanning while requiring review before version updates.
• Include the referenced crawler implementation in the package so its imports, network destinations, and data handling can be audited.
• Run dependency installation and crawler execution in a least-privileged sandbox with no unnecessary secrets or filesystem access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description includes broad activation phrases for marketing copy, writing, title optimization, and general content creation, which are not tightly tied to a CCTV news fetcher. In agent routing systems, this can cause the skill to trigger in many unrelated conversations, exposing exec-capable functionality more often than necessary and increasing the chance of misuse or unintended command execution.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The documentation recommends curl -fsSL https://bun.sh/install | bash, which is a classic remote-script-to-shell pattern. If copied by users or executed by an agent, it allows immediate execution of network-fetched code without local review, creating a direct supply-chain and remote code execution risk.

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

md

| 依赖项 | 类型 | 是否必需 | 获取方式 |
|:-------|:-----|:---------|:---------|
| Node.js 16+ | 运行时 | 二选一 | 官网下载安装 |
| Bun 1.0+ | 运行时 | 二选一 | `curl -fsSL https://bun.sh/install \| bash` |
| node-html-parser | npm包 | 必需 | `npm install node-html-parser` 或 `bun add node-html-parser` |
| Python 3.8+ | 运行时 | 可选 | 辅助脚本使用 |
| LLM API | API | 必需 | 由Agent平台内置LLM提供 |

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest and capability table state that the free version does not support batch date queries and is focused on single-day lookup. However, later examples and helper functions iterate over recent dates, build recent-date lists, and cache per-date results, which operationally enables repeated multi-date retrieval beyond the advertised scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill description says the free version provides only titles and summaries, not full text. Yet the categorizer explicitly reads a content field and examples populate news items with content, which contradicts the stated data scope rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The caching example writes fetched results to local files without prominently warning users that data will persist on disk. Silent persistence can create privacy, retention, and workspace contamination issues, especially in shared or automated environments where users may expect a transient fetch-only operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrase '执行核心功能' is so vague that it could match ordinary conversation and spur unintended skill activation. Because the skill has exec permission, accidental routing is more dangerous than for a read-only skill and could lead to unnecessary command execution or file/network side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The capability summary broadens a narrow CCTV scraping skill into generic automation, file handling, API integration, and command execution. In an agent ecosystem, overly broad capability claims can cause accidental invocation in unrelated contexts and justify actions outside user expectations, increasing the chance of unsafe tool use or unwanted side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Advertising generic file write capabilities is risky because the skill's stated purpose does not require broad local file modification. In a tool-enabled agent, that mismatch can normalize persistence and file writes that users did not intend, potentially leading to data retention, overwrites, or planting artifacts on disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Claiming generic external API integration expands the implied trust boundary far beyond public-page scraping. In an agent setting this can prompt operators or orchestration layers to permit broader network interactions than necessary, increasing risk of data leakage or unintended third-party communication.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

One section states the free version requires no API key and relies on public web content. Another security section warns about API key leakage and recommends environment-variable configuration, which creates conflicting intent about whether this skill uses secrets at all.

Content

No source excerpt is available for this finding.