Security audit

热点新闻聚合

Security checks for vulnerabilities and agentic risk

Overview

This looks like a non-malicious news tool, but it needs Review because its command/write authority and invocation scope are broader than its stated purpose.

Use this only for news aggregation, and be cautious about granting write or broad command execution until the publisher narrows the scope. Expect it may run Python commands, install dependencies, and contact third-party news websites; no artifact-backed evidence of credential theft, destructive behavior, or intentional exfiltration was found.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest description blends a benign news-aggregation purpose with SEO, keyword analysis, ranking improvement, and traffic optimization claims that are not implemented elsewhere in the skill. This kind of scope inflation can cause the agent to invoke the skill for unrelated tasks and may prompt unnecessary command execution or network activity under false pretenses.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation states that custom news sources are unsupported, but later instructions suggest switching sources and configurable source sets. This inconsistency can mislead an agent or user into attempting unsupported source manipulation, which is risky in a tool with exec/network behavior because it encourages behavior outside the validated workflow.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill advertises broad file handling, API integration, automation, and command execution capabilities that exceed what a lightweight news aggregation tool should need. Overstating or enabling generic read/write/exec behavior increases the attack surface by making it easier for the skill to be repurposed for arbitrary local file access, output persistence, or command execution beyond news retrieval.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger condition says to use the skill for broad data analysis, report generation, statistical insight, and visualization tasks, which is far wider than the stated news aggregation purpose. Ambiguous invocation criteria make accidental triggering more likely and can lead the agent to use exec/network-enabled behavior in contexts the user did not intend.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The manifest description combines unrelated domains and broad usage claims, leaving the invocation scope unclear. In an agent ecosystem, unclear scope is a security concern because it increases the chance that the wrong tool is selected and granted file/network/exec access for requests outside its true purpose.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The front matter and tool listing include write capability, but the skill does not clearly warn users that local files may be created or modified, nor where outputs would be stored. Hidden or underspecified file modification is dangerous because users may invoke what appears to be a read-oriented aggregation tool without realizing it can persist data locally.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes fetching external news from public websites but does not clearly disclose that prompts may cause third-party network requests. This creates privacy and operational risk because user queries, timing, IP metadata, and request patterns may be exposed to external sites without explicit notice or consent.

Static analysis

No suspicious patterns detected.