Security audit

订阅摘要(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This RSS digest skill is coherent and mostly disclosed, but users should notice that some examples can change local feed state.

Install only if you are comfortable using the external feed CLI. Ask the agent to keep actions read-only unless you explicitly want to add subscriptions or mark entries as read, because those actions change your local feed database.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a read-oriented RSS digest tool, but it also includes a state-changing capability to mark entries as read. Hidden or understated mutation is dangerous because an agent may perform persistent changes to a user's feed state during what appears to be a retrieval/summarization workflow, causing data integrity and workflow disruption.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The document inconsistently claims the free edition does not support AI deep summarization while also advertising summary generation and listing an LLM API as required. Capability contradictions are dangerous because they obscure what the agent may actually invoke, making it harder for users and policy systems to assess data flow to models or external components.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill claims broad file-processing and API-integration capabilities unrelated to a narrowly scoped RSS digest tool. Overbroad capability claims increase attack surface by normalizing actions beyond the stated purpose, which can lead an agent to access files or external services without clear necessity or user expectation.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The skill says no API key is needed while also stating an LLM API is required. This inconsistency can mislead users about external service dependencies and data disclosure, potentially causing content to be sent to a model-backed service without informed consent.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation language is overly broad, including generic productivity and workflow-optimization scenarios far beyond RSS digestion. Broad invocation criteria are risky because they can cause the skill to trigger in unrelated contexts, increasing the chance of unnecessary command execution and unintended access to feed data or state-changing actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions include bulk mark-read behavior without a clear warning that it persistently changes user state. In an agent setting, this is dangerous because users may ask for summaries or filtering and unintentionally lose unread tracking if the agent follows the example workflow automatically.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The quick-start examples include commands that add feeds and mark entries read, both of which persistently modify local subscription state, but they are presented without user-facing warnings. This makes accidental state changes more likely, especially when an agent executes example flows verbatim.

Static analysis

No suspicious patterns detected.