Security audit

RSS新闻订阅免费版

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for RSS news fetching, but its instructions are inconsistent enough that users should review it before installing.

Review this before installing. It is not showing malicious behavior, but the documentation is inconsistent: do not provide API keys or callback URLs unless the publisher clarifies why they are needed, and expect the agent to make outbound requests to news RSS sites if used.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims the free edition does not support API integration, yet it exposes a `callback_url` for asynchronous notifications. This creates ambiguous behavior and can lead agents or users to send data to arbitrary external endpoints, expanding the skill’s network and data-exfiltration surface beyond its stated scope.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The trigger conditions instruct use for marketing copy, title optimization, and content creation, which do not match an RSS retrieval tool. This mismatch can cause inappropriate invocation in unrelated contexts, increasing the chance the skill is selected when users did not intend outbound fetching or news-processing behavior.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The documentation repeatedly states the free version is zero-API-key, but the known limitations section says an API key is required. Contradictory operational requirements are dangerous because agents may mis-handle secrets, prompt users for unnecessary credentials, or route execution through unintended integrations.

Vague Triggers

High

Confidence: 90% confidence
Finding: The trigger condition is overly broad and mismatched to the tool’s RSS-news function, directing invocation for generic writing and marketing tasks. Overbroad triggers are risky in agent ecosystems because they can hijack unrelated user workflows and cause unnecessary code execution or network access under false pretenses.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill does not prominently warn that it performs outbound HTTP requests to third-party news sources. In an agent setting, undisclosed network access is a meaningful security and privacy issue because users may unknowingly trigger external requests that reveal IP, timing, or query-related metadata to outside services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.