中国新闻聚合(免费版)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.2

Overview

This skill is a coherent RSS news aggregation guide, with some ordinary local-file and dependency risks users should control.

Install and run this only in a normal project or virtual environment, pin requests if you need reproducibility, and set a dedicated output/cache directory before generating briefs. Do not pass untrusted filenames or paths to its save helpers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:330

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 330-330 and 470-470
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

pip install requests

The dependency table repeats the same installation instruction:

text

requests | Python library | Required | pip install requests

Technical Analysis

The Skill directs the Agent to install requests without specifying an audited version, verifying a package hash, or using a locked dependency manifest. Consequently, the installed code depends on whichever release and package index resolution are current when the command runs.

Although requests is a legitimate package and no malicious package is explicitly named, this installation pattern provides weaker supply-chain integrity than necessary. A compromised upstream release, compromised package index, or manipulated package-index configuration could cause unreviewed code to enter the execution environment.

Package installation may execute package build or installation logic under the privileges of the user running the Agent. The risk is therefore not limited to the later behavior of the imported library.

Attack Path

1. An attacker compromises an upstream dependency release or influences the Python package index used by the environment.
2. The Agent follows the Skill instructions and runs pip install requests.
3. pip resolves and downloads an unpinned package release without hash verification.
4. Package installation or build logic executes with the Agent user's privileges.
5. The compromised package can access files, environment variables, network resources, and other assets available to that user.

This attack path requires compromise or manipulation of the dependency supply chain; the audited Skill does not itself provide such a malicious package.

Impact Assessment

Successful exploitation could permit arbitrary code exec ...[truncated 360 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned installation command with a dependency lock file containing an audited version.
• Require hashes using a command such as pip install --require-hashes -r requirements.txt.
• Configure installation to use the official trusted package index explicitly.
• Install dependencies in an isolated virtual environment with minimal filesystem and network permissions.
• Use automated dependency scanning and a controlled update process rather than resolving the newest release during every run.
• Avoid automatically executing installation commands without explicit user approval.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:221

Finding

Caller-Controlled Output Filename Can Escape the Intended Directory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 221-229
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: Medium

Vulnerable Code

python

def save_to_file(self, content, filename=None):
    import os
    if filename is None:
        filename = f"news_{datetime.now().strftime('%Y%m%d')}.md"

    output_dir = os.environ.get('OUTPUT_DIR', os.getcwd())
    output_path = os.path.join(output_dir, filename)

    with open(output_path, 'w', encoding='utf-8') as f:
        f.write(content)

Technical Analysis

The filename parameter is joined directly with output_dir and then opened in destructive write mode. The implementation does not reject absolute paths, parent-directory components such as ../, symbolic-link destinations, or existing sensitive files.

In Python, an absolute second argument to os.path.join can replace the intended base directory. A relative filename containing parent-directory components can similarly escape OUTPUT_DIR. Opening the resulting path with mode w truncates an existing file before writing the generated content.

This violates the least-privilege expectation for a news brief generator, which only needs to create reports inside a dedicated output directory.

Attack Path

1. An attacker or untrusted workflow supplies a crafted filename, such as ../../target-file, or an absolute path.
2. os.path.join(output_dir, filename) produces a path outside the intended report directory.
3. The Skill opens that path using w mode.
4. If the Agent user has write permission, the target file is created or truncated and replaced with attacker-influenced report content.
5. If the overwritten file is operationally significant, subsequent tools or processes may consume the modified content.

Exploitation requires the attacker to influence filename and the Agent user to have write permission for the selected destination.

...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

• Accept only a simple basename rather than an arbitrary path.
• Reject absolute paths and filenames containing parent-directory components.
• Resolve both the output directory and destination with pathlib.Path.resolve(), then verify that the destination remains beneath the approved output directory.
• Create and use a dedicated output directory with minimal permissions.
• Prevent unintended replacement by opening new reports in exclusive creation mode or requiring explicit confirmation before overwriting.
• Account for symbolic-link attacks by rejecting symlink destinations or using platform-specific safe file-creation primitives.
• Generate filenames internally where caller-selected filenames are not required.

A hardened containment check should follow this pattern:

python

from pathlib import Path

base = Path(output_dir).resolve()
candidate = (base / filename).resolve()

if candidate.parent != base:
    raise ValueError("Output filename must remain in the output directory")

with candidate.open("x", encoding="utf-8") as output_file:
    output_file.write(content)

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The core positioning section explicitly says 'AI智能摘要' is not supported in the free version. Later, the dependency table marks 'LLM API' as required, which contradicts the stated no-AI-summary positioning and suggests an AI-backed dependency despite the examples only using RSS parsing and keyword classification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill includes code paths that write markdown briefs and cache files locally, but the surrounding documentation does not prominently warn users that execution creates persistent files. In an exec-capable agent context, undisclosed file creation can lead to unintended data persistence, clutter, or writes into sensitive working directories if environment variables such as OUTPUT_DIR are influenced by the runtime.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill declares an excessively broad capability scope using generic trigger phrases such as general model-calling and dialogue terms. In an agent ecosystem, this can cause the skill to activate for unrelated prompts, increasing the chance of unintended execution of network access and file-writing behaviors under the skill's exec-enabled workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The skill is presented primarily as a China-focused news tool with Chinese-language naming, summaries, and examples, which may impose a locale-specific experience by default. Although an English output example exists later, the primary description does not clearly state that users may choose their preferred language at invocation time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest description focuses on fetching RSS news, classifying it, and producing briefs for personal lightweight use. The SKILL file additionally defines a NewsCache component that creates a cache directory and persists fetched news to JSON files, which is extra behavior not described in the manifest’s main capability statement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.