央视新闻抓取(专业版)

• Outcome: Review
• Latest audit: Aug 29, 2026 · 4:07 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a disclosed CCTV news scraping and briefing tool, but it needs review because it combines broad activation wording with arbitrary webhook/email delivery and exec-based setup guidance.

Install only if you intend to use the CCTV news scraping and external briefing workflows. Review webhook and email destinations before use, avoid sending internal or sensitive analysis through the generic push channel, and prefer safer package-manager or verified installer steps instead of piping remote scripts into a shell.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation guidance is extremely broad, including generic AI/agent usage contexts rather than narrowly scoped triggers for this specific news-grabbing skill. In an agent environment with read/exec/glob/grep permissions, vague invocation criteria increase the chance the skill is selected unexpectedly and performs scraping, subprocess execution, or outbound actions when the user did not explicitly request them.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example trigger phrase '执行核心功能' is so generic that an agent could invoke this skill for unrelated tasks. Because the skill advertises command execution and external integrations, a generic trigger can cause overbroad tool activation and unintended execution flow in a privileged agent context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill accepts a callback_url and later describes push/webhook delivery, but it does not present a clear, prominent warning that fetched content, summaries, and possibly user-supplied data may be transmitted to third-party endpoints. In agent settings, hidden or under-emphasized outbound transmission paths can lead to accidental data exfiltration or privacy violations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file provides ready-to-use webhook push code that sends arbitrary news content to external services (Feishu, DingTalk, WeChat, Slack, email, generic webhooks) but does not warn users that content will leave the local environment. In an agent-skill context, this creates a real data exfiltration risk because operators may adapt the example to sensitive inputs without explicit consent, allowlisting, or disclosure controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

url: https://qyapi.weixin.qq.com/cgi-（请参考skill目录中的脚本文件）?key=未指定
    - name: email
      type: email
      url: https://api.email-service.com/send
# ...
analyzer:
  top_keywords: 20

• Confidence: 84% confidence
• Finding: This finding reflects intentional external transmission capability via email/webhook endpoints. In this skill's context, outbound delivery is a core feature, but it still creates real security risk because news content, summaries, and possibly internal analysis can be sent to third-party services without strong destination controls or data minimization guarantees.

External Transmission

Medium

• Category: Data Exfiltration

Content

"elements": [{"tag": "div", "text": {"tag": "lark_md", "content": content}}]
            }
        }
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_dingtalk(self, url, title, content):

• Confidence: 95% confidence
• Finding: This code performs an outbound HTTP POST to a caller-supplied webhook URL containing message content. In an agent environment, if the content includes sensitive data or the URL is attacker-controlled, this enables straightforward data exfiltration to an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

"msgtype": "markdown",
            "markdown": {"title": title, "text": f"## {title}\n\n{content}"}
        }
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_wechat(self, url, title, content):

• Confidence: 95% confidence
• Finding: This DingTalk example sends content via requests.post to an external webhook endpoint. Because both destination and transmitted content are variable, misuse can disclose internal or sensitive information outside the platform boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

"msgtype": "markdown",
            "markdown": {"content": f"## {title}\n{content}"}
        }
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_email(self, url, title, content):

• Confidence: 95% confidence
• Finding: This WeCom webhook call transmits content directly to an external URL. In context, the example is operationally useful, but without guardrails it can be repurposed to export agent-visible data to third-party endpoints.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _push_email(self, url, title, content):
        """邮件推送"""
        payload = {"subject": title, "body": content, "format": "markdown"}
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_slack(self, url, title, content):

• Confidence: 94% confidence
• Finding: This email push helper posts subject/body content to an external endpoint, which may bridge agent-generated data into another system. If connected to sensitive summaries or internal content, it creates a concrete exfiltration path.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _push_slack(self, url, title, content):
        """Slack推送"""
        payload = {"text": f"*{title}*\n{content}"}
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_generic(self, url, title, content):

• Confidence: 95% confidence
• Finding: This Slack push method sends arbitrary title/content to an external webhook. In a skill setting, such generic external transmission is dangerous when combined with agent access to internal data because it can leak that data to an external workspace.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _push_generic(self, url, title, content):
        """通用推送"""
        payload = {"title": title, "content": content}
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

pusher = NewsPusher()

• Confidence: 97% confidence
• Finding: The generic push helper is the broadest exfiltration primitive because it POSTs arbitrary content to any provided URL without service-specific constraints. That flexibility makes the skill context more dangerous: a user or downstream component can direct potentially sensitive agent-produced content to attacker-controlled infrastructure.

External Script Fetching

High

• Category: Supply Chain

Content

| 依赖项 | 类型 | 是否必需 | 获取方式 |
|---:|---:|---:|---:|
| Node.js 16+ | 运行时 | 二选一 | 官网下载安装 |
| Bun 1.0+ | 运行时 | 二选一 | `curl -fsSL https://bun.sh/install \| bash` |
| node-html-parser | npm包 | 必需 | `npm install node-html-parser` |
| Python 3.8+ | 运行时 | 必需 | 官网下载安装 |
| requests | Python库 | 必需 | `pip install requests`（推送功能） |

• Confidence: 97% confidence
• Finding: The documentation recommends piping a remote script directly into bash (`curl ... | bash`) to install Bun. This is dangerous because it executes network-fetched code immediately without integrity verification, exposing users to supply-chain compromise, MITM-related trust failures, or malicious installer changes.

Static analysis

No suspicious patterns detected.