新闻聚合工具免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.0

Overview

The skill is a news aggregation prompt package, but it asks for broad command execution and includes under-scoped callback and trigger guidance that users should review before installing.

Install only if you are comfortable with a news summarization skill that may be granted shell command access. Prefer running it without exec if the platform allows, avoid using callback_url unless you control the destination, and treat fetched news pages as untrusted content, especially from HTTP sources.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:21

Finding

Unnecessary Unrestricted Command-Execution Capability

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-26
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

yaml

tools:
  - read
  - exec
  - glob
  - grep
homepage: ""

Technical Analysis

The skill declares access to the unrestricted exec tool even though its primary functions are searching, filtering, deduplicating, and summarizing news. These operations can be implemented through dedicated search, browser, and constrained file-access tools without providing arbitrary command execution.

The documented command-line examples only create an example configuration and perform a connectivity check. They do not establish a functional requirement for unrestricted shell access. Granting exec expands the skill's authority from processing web content to executing commands with the permissions of the Agent process.

Because the skill processes external news pages, those pages represent untrusted input. If malicious content is interpreted as an instruction by the Agent, access to exec could turn a content-based prompt-injection event into local command execution. The reviewed file does not itself contain a command that performs such exploitation, but the unnecessary capability creates the dangerous privilege boundary.

Attack Path

1. The Agent loads the skill and grants it the declared exec capability.
2. A user requests aggregation from one of the configured external news sources.
3. An attacker controls or compromises content returned by that source, or injects malicious instructions into a page consumed by the Agent.
4. The Agent incorrectly treats the untrusted page content as operational instructions.
5. The injected instructions direct the Agent to invoke exec.
6. Commands execute with the operating-system privileges and filesystem or network access available to the Agent process.

Impact Assessment

Successful exploitati ...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec from the declared tool list.
• Use dedicated browser or search tools for news retrieval.
• Use a constrained file-writing API if generating local configuration files is genuinely required.
• Replace shell-based connectivity checks with a dedicated HTTP health-check operation.
• If command execution cannot be removed, implement an allowlist of fixed commands and arguments.
• Prohibit shell interpolation, redirection, command substitution, pipelines, and user-controlled command arguments.
• Run any required command in a sandbox with a read-only filesystem, minimal environment variables, restricted network access, and a dedicated low-privilege account.
• Treat all retrieved webpage content as untrusted data and explicitly prevent it from modifying tool-use instructions.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:222

Finding

News Sources Configured over Unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 222-225
Vulnerability Type: Missing transport encryption and source-integrity protection
Risk Level: Low

yaml

    - name: 央视新闻
      url: "http://news.cctv.com/"
      tier: A
    - name: 新华社
      url: "http://www.xinhuanet.com/"
      tier: A

Technical Analysis

Two configured news sources use plaintext HTTP. HTTP does not authenticate the remote server or protect response integrity while content is in transit. A network-positioned attacker can therefore intercept, modify, or replace retrieved content.

This is particularly relevant for an AI Agent because retrieved pages may be processed as natural-language input. Manipulated content could corrupt news summaries, spread false information, or contain prompt-injection text intended to influence subsequent Agent behavior. Labeling these sources as tier A may also cause modified content to receive elevated trust during filtering.

Attack Path

1. The Agent requests one of the configured http:// source URLs.
2. An attacker with control over a local network, proxy, DNS path, or other intermediary intercepts the plaintext request.
3. The attacker modifies the HTTP response or substitutes an attacker-controlled page.
4. The Agent processes the modified content as trusted news-source material.
5. The manipulated response affects generated summaries or attempts to direct the Agent's tool use.
6. If combined with broader capabilities such as exec, a successful content-injection attack may have consequences beyond inaccurate output.

Impact Assessment

Exploitation can compromise the confidentiality and integrity of retrieved content. The direct impact includes falsified headlines, inaccurate summaries, manipulated credibility assessments, and exposure of requested URLs or browsing activity to network observers.

The HTTP configuration alone does not grant local privileges or ex ...[truncated 180 chars]

Remediation

View remediation

Remediation Suggestions

• Replace both source URLs with their verified HTTPS equivalents.
• Reject redirects that downgrade a request from HTTPS to HTTP.
• Enable normal TLS certificate and hostname validation; do not permit insecure certificate bypasses.
• Apply an allowlist of expected HTTPS hostnames for news retrieval.
• Treat all fetched content as untrusted regardless of the source's credibility tier.
• Separate webpage data from Agent instructions and prevent retrieved content from authorizing tool calls.
• Record the final URL and transport scheme so downgraded or unexpected redirects can be detected and rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger guidance is overly broad and mixes in unrelated SEO scenarios, which can cause an agent to invoke this skill for requests outside its intended news-aggregation scope. In agent environments, ambiguous triggers increase the chance of mis-execution, unintended tool use, or processing user data in the wrong workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises a callback_url input for asynchronous notification without any warning, restriction, or validation guidance around outbound requests. In an agent context, this can enable data exfiltration, SSRF-like behavior, or unintended transmission of aggregated content and metadata to attacker-controlled endpoints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest states the free version does not support exporting news to PDF/email and presents limited capabilities for aggregation and structured summaries. However, the core execution section explicitly says the capability supports '创建/查询/导出操作', which expands behavior beyond the stated free-tier boundary. This is a semantic mismatch in the advertised scope of the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The capability coverage statement says the skill covers keywords including '聚合国内外社会' and '军事领域的新闻', tying them back to the description as supported scenarios. Elsewhere, the same file repeatedly states the free version does not support international news sources. This is an active contradiction inside the documentation about what the skill is intended to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The capability coverage keywords are excessively broad, including phrases that expand beyond the free edition's real scope. Broad trigger vocabulary can make an agent select this skill inappropriately, leading to incorrect web access, unnecessary tool invocation, and unreliable outputs from unbounded searches.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Inside the example output for a news aggregation skill, the document says the tool is for 'SEO优化、关键词分析、排名提升、搜索流量优化' and lists SEO-related unsuitable scenarios. That directly conflicts with the surrounding documentation describing a news aggregation assistant for social, tech, and military news. This indicates intent/documentation divergence rather than a mere omission.

Content

No source excerpt is available for this finding.