T09 · Insecure Skill Coding Practices
Warning
- Location
references/detail.md:37- Finding
Arbitrary Feed URL Fetching Enables SSRF and Local Resource Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Feedstream Monitor Free
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent security-feed monitor, but its examples let an agent fetch arbitrary URLs and persist results locally without enough safeguards for sensitive environments.
Review before installing or running examples. Use only trusted HTTPS feed URLs, avoid internal or metadata-service addresses, run it in a constrained environment, add response-size and domain controls, and skip or pin the optional feedparser dependency.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:285- Finding
Unpinned Optional Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The documented code adds external RSS sources and is designed to fetch them, which creates outbound network connections to third-party domains. In a security-monitoring skill this is expected, but it is still security-relevant because it can disclose usage patterns, bypass assumptions of local-only operation, and expose agents to untrusted remote content.
- Content
add_feed("NVD漏洞公告", "https://nvd.nist.gov/feeds/xml/cve/misc/nvd-rss-analyzed.xml", "rss", "cve") add_feed("CERT公告", "https://www.kb.cert.org/vulfeed", "rss", "vendor") add_feed("安全客", "https://api.anquanke.com/data/v1/rss", "rss", "blog")
text ### 120秒标准搭建
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill description limits scope to multi-source RSS/Atom subscription, severity grading, basic keyword filtering, and local deduplication. However, the keyword filtering section defines an additional 'alert' action, which goes beyond passive local monitoring and introduces a notification/alerting capability not stated in the manifest description.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill's activation scope is overly broad and includes generic operations terms such as monitoring, log analysis, alerting, and deployment management. In an agent ecosystem, this increases the chance the skill is invoked outside its intended RSS/advisory-monitoring purpose, potentially leading to unintended execution of networked or file-writing actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This example again instructs the monitor to pull content from an external feed, creating intentional data transmission to a third-party service. While consistent with the skill's purpose, it remains a true security concern because the skill processes untrusted remote input and performs network activity that may be unexpected in tightly controlled environments.
- Content
python monitor = FeedStreamMonitor() monitor.add_feed("安全客", "https://api.anquanke.com/data/v1/rss", "rss", "blog") monitor.fetch_all() monitor.stats()
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims that cloud calls are not involved, yet the examples explicitly fetch remote RSS/Atom feeds over the network using urllib. This can mislead users and agents about data egress and network behavior, causing execution in environments where outbound access is restricted or sensitive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The embedded example performs live network requests to external RSS/Atom sources and writes persistent data under the user's home directory without any warning, consent flow, or sandboxing guidance. In an agent skill context, documentation examples are often copied and executed directly, so this creates a real risk of unintended outbound connections and local state changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md monitor = FeedStreamMonitor() monitor.add_feed("NVD漏洞公告", "https://nvd.nist.gov/feeds/xml/cve/misc/nvd-rss-analyzed.xml", "rss", "cve") monitor.add_feed("安全客", "https://api.anquanke.com/data/v1/rss", "rss", "blog") monitor.list_feeds()
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
L310 明确将技能设计为“完全中文化表达”，但文档未说明可根据用户偏好切换语言，也未给出这是合规或区域限定所必需的理由。按规则，这属于自然语言层面的语言/locale 限制风险。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language documentation, comments, docstrings, and user-facing print strings are all Chinese-only, which can impose a language choice on users without opt-in. The policy allows locale constraints when explicitly offered as a choice or clearly justified, but that is not stated here.
- Content