T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:256- Finding
RSS Feeds Retrieved Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
RSS新闻订阅免费版
Security checks for vulnerabilities and agentic risk
Overview
This RSS news skill is not malware, but it needs review because its command-execution guidance and network use are paired with mismatched triggers and inconsistent documentation.
Install only if you are comfortable with an agent making outbound requests to listed news RSS feeds and running local shell/Python commands. Treat retrieved feed text and links as untrusted, prefer HTTPS feeds, and avoid providing API keys or callback URLs because this free artifact does not clearly require or implement them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger condition is overly broad and mismatched to the tool’s purpose, instructing use for generic writing and content-generation scenarios. In a skill with exec capability and outbound HTTP behavior, imprecise routing materially increases the risk of unintended execution, data exposure, and user confusion about why the tool was invoked.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger conditions say the skill should be used for marketing copy, title optimization, and content creation, which is unrelated to an RSS news fetcher. This is especially risky in an agent setting because broad, mismatched triggers can cause the skill to activate in unrelated conversations and execute outbound network activity or local commands unexpectedly.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file says the free version requires no API key, but the known limitations section later says an API key is required. Contradictions about authentication and prerequisites are security-relevant because they can cause operators to inject unnecessary secrets into the skill workflow or mis-handle credential storage for a tool that should not need them.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The display name and the surrounding documentation are presented in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless clearly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description does not clearly warn users that the skill performs outbound HTTP requests to third-party news sources. Missing disclosure of network side effects is security-relevant because users and agents may invoke the skill without understanding that it will contact external services, potentially leaking metadata such as IP address, timing, and requested topics.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document claims support for create/query/export operations, but the described functionality is only RSS retrieval. Overstated capabilities can mislead an agent into invoking the skill in unintended contexts, which is dangerous because execution-enabled skills may be granted broader trust or permissions than their real purpose warrants.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents a callback_url parameter and callback-style processing, but the rest of the file only describes a local CLI RSS fetcher. This mismatch can cause an agent or integrator to send data to an assumed callback endpoint or expose workflow assumptions that do not actually exist, creating confusion around data flow and possible SSRF-style misuse if later implemented unsafely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Repeated claims of create/query/export support conflict with the free-version limitations and examples, indicating inconsistent and unreliable security-relevant documentation. In agent ecosystems, contradictory docs can lead to unsafe invocation, incorrect routing, or over-privileged execution because the platform cannot accurately infer what the skill does.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The capability coverage keywords are excessively broad and vague, making the skill appear applicable to many loosely related prompts. Broad matching is dangerous in agent environments because it can increase accidental activation frequency and push a networked execution skill into contexts where its behavior is unexpected or unnecessary.
- Content