T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:10- Finding
Unnecessary Local File and Command-Execution Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
新闻聚合引擎(免费版)
Security checks for vulnerabilities and agentic risk
Overview
This news-summary skill appears purpose-aligned overall, but it asks for broad local file and command execution access that is not explained by the news aggregation workflow.
Review before installing. The skill is not shown to be malicious, but only install it in an environment where you are comfortable granting local file read and shell command capabilities, or where the host sandbox blocks those capabilities unless you explicitly approve them. Avoid using callback_url with sensitive prompts or summaries unless you trust the destination and know what will be sent.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description repeatedly says the skill can '自发搜索' and '可自发提升工作效率', which implies autonomous invocation or action without clearly defined triggers, scope, or user confirmation boundaries. In an agent environment, ambiguous self-invocation language can cause the model to over-apply the skill, perform unintended searches, or chain tool usage beyond user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest declares the exec capability, but the skill body never explains why command execution is needed for a news aggregation task or what commands may run. Unjustified exec access increases the attack surface because an agent may invoke shell/system commands in contexts where simple read or web retrieval would suffice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill accepts a callback_url for asynchronous completion but provides no warning that results may be transmitted to an external destination. This creates a clear exfiltration risk: users may unknowingly send prompts, summaries, or derived sensitive data to attacker-controlled endpoints, especially in shared agent environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The FAQ states that for international news, the skill will translate titles and key points into Chinese. This imposes a specific language/locale behavior without indicating user choice or opt-in, which can violate language preference policies when the skill may be used in multilingual environments.
- Content