热点新闻聚合

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.3

Overview

The skill is not clearly malicious, but it asks for broad command, read, and write authority while its documented news-aggregation purpose is inconsistent and under-scoped.

Review before installing. Only use this skill in a constrained workspace, avoid granting write access unless truly needed, pin dependencies in a virtual environment, and treat fetched news content as untrusted text rather than instructions for the agent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:142

Finding

Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 142-145
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code:

bash

# Install Python dependencies
pip install requests beautifulsoup4 markdown

# Verify installation

Technical Analysis

The Skill instructs the user or agent to install three Python packages without fixed versions, package hashes, a lockfile, or explicit index restrictions. Consequently, the artifacts installed when the command runs may differ from those present when the Skill was reviewed.

Package installation can execute package-controlled build and installation logic under the privileges of the invoking user. If an upstream package, release process, dependency, or configured package index is compromised, following this instruction could introduce attacker-controlled code into the environment.

The package names do not exhibit evident typosquatting, and the audited artifact does not deliberately select an identified malicious package. The risk arises from mutable, insufficiently verified dependencies rather than confirmed malicious package content.

Attack Path

1. A user or tool-enabled agent follows the dependency setup instructions in SKILL.md.
2. pip queries its configured package index and resolves the latest compatible releases and their transitive dependencies.
3. An upstream release, transitive dependency, or package-index response has been compromised or unexpectedly modified since the Skill was audited.
4. pip downloads and installs the unreviewed artifact.
5. Package-controlled installation or subsequently imported runtime code executes with the privileges of the invoking process.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip. Depending on that account and environment, the code could read or modify accessible files, access environment va ...[truncated 169 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the direct installation command with a reviewed requirements or lock file containing exact versions.
2. Record cryptographic hashes for every direct and transitive package and require hash verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Restrict installation to an explicitly trusted package index and disallow unintended extra indexes.
4. Generate dependencies in a controlled build process and regularly scan them for known vulnerabilities.
5. Install packages in an isolated virtual environment under a non-privileged account.
6. Document the reviewed package versions and the process for securely updating them.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:19

Finding

Overbroad and Inconsistent Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6 and lines 19-22
Vulnerability Type: Excessive agent tool permissions
Risk Level: Medium

Vulnerable Code:

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Technical Analysis

The Skill requests general command execution, file-reading, and file-writing capabilities even though the package contains only SKILL.md and no implementation script. The stated news-aggregation purpose does not establish a need for unrestricted local filesystem access or general command execution.

The permission declarations are also inconsistent: allowed-tools grants read and exec, while the separate tools list additionally requests write. Depending on which declaration the host treats as authoritative, the Skill may receive broader permissions than a reviewer or user expects.

General exec access can expose all commands and resources available to the agent process. General read and write access can expose or alter unrelated files. These broad capabilities are especially risky for a news-processing Skill because externally sourced article content may be attacker-controlled and could contain instructions designed to influence a tool-using agent.

No direct instruction in the audited file was found that intentionally reads sensitive files, modifies the system, or executes an embedded malicious payload. This finding concerns the unnecessary capability boundary and resulting attack surface.

Attack Path

1. An agent loads the Skill and grants the tools declared in its metadata.
2. The host interprets the broader tools list and provides exec, read, and write access.
3. The agent retrieves or processes attacker-controlled news content, or receives a maliciously crafted user input.
4. That content attempts to induce the agent to invoke one of the broadly available tools outside the legitimate news-aggrega ...[truncated 693 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write unless each permission is demonstrably required by implemented functionality.
2. Prefer a narrowly scoped HTTPS retrieval capability restricted to an explicit allowlist of documented news domains.
3. If local output is required, restrict writing to one dedicated output directory and prohibit overwriting existing or sensitive files.
4. If command execution is unavoidable, expose a fixed wrapper with enumerated arguments rather than a general shell.
5. Maintain one authoritative tool-permission declaration so hosts and reviewers cannot interpret conflicting permission sets.
6. Treat all retrieved news content as untrusted data and prohibit it from supplying agent instructions, commands, file paths, or tool parameters.
7. Require explicit user confirmation before any command execution or access to files outside a dedicated Skill workspace.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description contains broad invocation language around SEO, keyword analysis, ranking improvement, and traffic optimization that overlaps with unrelated marketing workflows. In an agent ecosystem, such broad language can cause the skill to be selected outside its true purpose, enabling unnecessary privileged operations and misleading users about what the skill is safe and intended to do.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition says to use the skill for data analysis, report generation, statistical insights, and data visualization, which is far broader than a lightweight news aggregation tool. Overbroad triggers are dangerous because they can cause automatic routing into this skill for unrelated tasks, where its exec/read/write capabilities may then be exercised in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description combines a news aggregation tool with SEO, keyword analysis, ranking improvement, and traffic optimization use cases that are not implemented elsewhere in the skill. This kind of scope mismatch can cause agents to invoke the skill in unrelated workflows and grant exec/write-backed behavior under false pretenses, increasing the chance of unsafe or unintended tool use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description explicitly states '支持中文交互' and presents Chinese as the default interaction mode, which can amount to a language policy constraint if users are not offered a choice. Although a language parameter exists later, the top-level description does not make language selection optional or user-driven.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation repeatedly states that unsupported features can still be executed via input_params for create/query/export operations, directly contradicting the surrounding text that says those capabilities are not supported. Contradictory instructions are dangerous because an agent may attempt operations outside the intended scope, potentially invoking exec/write flows or fabricating capability that bypasses user expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'core features' section expands the skill from a narrowly described news aggregator into generic automation, file processing, API integration, and command execution. In a skill with exec/read/write permissions, this broadening is particularly risky because it can justify unrelated high-privilege actions that have little to do with news retrieval, increasing the attack surface for misuse or prompt-induced overreach.

Content

No source excerpt is available for this finding.