Security audit

每日新闻简报(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a news-briefing assistant, but it asks for broad file and command authority and includes loosely scoped automatic outbound delivery.

Install only if you are comfortable giving this skill broad local tool access for a news workflow. Before use, restrict webhook destinations, require confirmation before scheduled or automatic pushes, and avoid letting it process arbitrary files or run shell commands unless you explicitly approve each action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill is presented as a news-brief generation and distribution tool, but the documentation later adds generic file-processing capabilities unrelated to that purpose. This scope expansion increases the chance that an agent will read, parse, or write arbitrary files under the guise of normal skill use, creating unnecessary access to sensitive local data.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documentation claims command-execution capability for a news briefing skill without showing a legitimate, tightly bounded need. In an agent setting with Bash available, this can normalize arbitrary shell execution and lead to command injection, local reconnaissance, data exfiltration, or destructive actions outside the skill's stated business function.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The tutorial explicitly instructs users to execute commands even though command execution is not necessary for the advertised news-briefing role. Operationally, this teaches downstream agents and users to treat shell actions as normal, which materially raises the risk of unsafe command use and abuse of the Bash tool.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest advertises a specialized news assistant, but later sections broaden it into a general file/API/command automation tool. This mismatch undermines least privilege and informed use, because an agent may activate a much more powerful behavior set than a user would reasonably expect from the declared skill purpose.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation scope is broad and unclear, including vague capability language and keyword-driven coverage that extends beyond a focused news-brief workflow. Ambiguous triggering criteria can cause the agent to invoke the skill in unrelated contexts, increasing the chance of unnecessary tool use and exposure of data or system capabilities.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes automatic multi-channel pushing and callback URLs but does not provide a clear, prominent warning that content may be transmitted to external services. In a tool that can aggregate internal or sensitive news content, silent outbound delivery raises data-leakage and unauthorized dissemination risks.

Static analysis

No suspicious patterns detected.