Security audit

RSS聚合工具免费版

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly an RSS news aggregator, but its instructions inconsistently steer agents toward API, webhook, and system-connection tasks that the free edition says it does not support.

Review before installing. This skill appears suitable for manual RSS aggregation, but keep it limited to trusted feed lists and a known ~/rss-aggregator directory. Do not provide callback URLs or use it for API integration, webhook setup, or system-connection work unless the publisher clarifies those behaviors and their data disclosure rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The free-edition documentation says API integration is unsupported, yet the interface exposes a callback_url for asynchronous notifications. This inconsistency can mislead users and downstream agents into sending data to external endpoints without clear consent, creating privacy and unexpected data-flow risks.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The trigger conditions instruct use for API integration, webhook configuration, and system connection tasks, directly contradicting the stated free-version restrictions. This can cause the agent to invoke the skill in broader integration contexts than intended, increasing the chance of unsafe outbound connections or misuse of exec-enabled workflows.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger condition is ambiguous and mismatched to the skill’s described RSS aggregation purpose, which can lead to incorrect auto-selection for unrelated tasks. In an agent environment with read/exec capabilities, overly broad routing increases the risk of the skill being invoked in contexts involving system connectivity or automation beyond user expectations.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The capability coverage section includes broad generic keywords such as search, retrieval, and aggregation-adjacent phrases that may overlap with many ordinary requests. This can cause overmatching by skill-selection logic, leading the agent to use an exec-capable skill more often than necessary.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill describes reading and appending to a local pushed_history.log file but does not clearly warn users that local files will be created and modified. In practice, silent stateful writes can expose sensitive reading history, overwrite expected files in the workspace, or surprise users who believed the tool was read-only.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill fetches remote RSS/article content and optionally supports callback URLs, but does not provide a privacy warning about outbound network access or external data disclosure. Users may unknowingly expose their interests, feed lists, fetched summaries, or metadata to third-party servers, especially when callback behavior is present.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.