Security audit

订阅

Security checks for vulnerabilities and agentic risk

Overview

This feed digest skill asks for broad command, file, and external API abilities that are not tightly scoped to feed summarization.

Review before installing. The artifact does not show malicious code, but it asks agents for broad local command and file powers. Install only if you are comfortable granting those powers, and constrain use to trusted feeds, known storage paths, and explicit user-approved commands.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest presents the skill as a simple feed-digest helper, but the document broadens scope to generic command execution, file handling, and external API use. This creates capability mismatch and increases the chance an agent will grant or invoke privileges beyond what users expect, enabling misuse or over-collection of data.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Advertising shell or command execution for a feed-digest skill is dangerous because it grants a powerful primitive unrelated to the core use case. If an agent honors this capability, crafted inputs or workflow misuse could turn a simple content-processing skill into a vehicle for arbitrary local actions, data access, or persistence.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation expands the skill into generic file read/write and external API integration, which exceeds what a straightforward feed digest helper should need. This broader scope increases attack surface for data exfiltration, unsafe file modification, and unauthorized network interactions, especially when paired with an agent runtime.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation language is overly broad and suggests the skill should be used for general AI/agent orchestration scenarios rather than a narrowly scoped feed-digest task. Ambiguous routing instructions can cause over-invocation of a higher-privilege skill, increasing exposure to unnecessary tool use and unintended side effects.

Static analysis

No suspicious patterns detected.